From 63e0027e3dc1e886302ac371ebf5fefc82cf2b14 Mon Sep 17 00:00:00 2001 From: zhouwenpei Date: Thu, 31 Mar 2022 15:18:28 +0800 Subject: [PATCH] fix CVE-2021-0561 --- CVE-2021-0561.patch | 25 +++++++++++++++++++++++++ flac.spec | 7 ++++++- 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 CVE-2021-0561.patch diff --git a/CVE-2021-0561.patch b/CVE-2021-0561.patch new file mode 100644 index 0000000..f2195ed --- /dev/null +++ b/CVE-2021-0561.patch @@ -0,0 +1,25 @@ +From bbcef0eb5b501083b197acb7ad84b3bc82fdc8f2 Mon Sep 17 00:00:00 2001 +From: Neelkamal Semwal +Date: Fri, 18 Dec 2020 22:28:36 +0530 +Subject: [PATCH] libFlac: Exit at EOS in verify mode + +When verify mode is enabled, once decoder flags end of stream, encode processing is considered complete +--- + src/libFLAC/stream_encoder.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/libFLAC/stream_encoder.c b/src/libFLAC/stream_encoder.c +index 4c91247fe8..7109802c27 100644 +--- a/src/libFLAC/stream_encoder.c ++++ b/src/libFLAC/stream_encoder.c +@@ -2610,7 +2610,9 @@ FLAC__bool write_bitbuffer_(FLAC__StreamEncoder *encoder, uint32_t samples, FLAC + encoder->private_->verify.needs_magic_hack = true; + } + else { +- if(!FLAC__stream_decoder_process_single(encoder->private_->verify.decoder)) { ++ if(!FLAC__stream_decoder_process_single(encoder->private_->verify.decoder) ++ || (!is_last_block ++ && (FLAC__stream_encoder_get_verify_decoder_state(encoder) == FLAC__STREAM_DECODER_END_OF_STREAM))) { + FLAC__bitwriter_release_buffer(encoder->private_->frame); + FLAC__bitwriter_clear(encoder->private_->frame); + if(encoder->protected_->state != FLAC__STREAM_ENCODER_VERIFY_MISMATCH_IN_AUDIO_DATA) diff --git a/flac.spec b/flac.spec index c95c1d5..3c37cb6 100644 --- a/flac.spec +++ b/flac.spec @@ -2,12 +2,14 @@ Name: flac Version: 1.3.3 -Release: 1 +Release: 2 Summary: encoder/decoder which support the Free Lossless Audio Codec License: BSD and GPLv2+ and GFDL Source0: http://downloads.xiph.org/releases/flac/flac-%{version}.tar.xz URL: http://www.xiph.org/flac/ +Patch0000: CVE-2021-0561.patch + Provides: %{name}-libs Obsoletes: %{name}-libs @@ -98,6 +100,9 @@ update-desktop-database &> /dev/null || : %doc flac-doc-devel/* %changelog +* Thu Mar 31 2022 zhouwenpei - 1.3.3-2 +- fix CVE-2021-0561 + * Fri Apr 24 2020 lihongjiang - 1.3.3-1 - update version to 1.3.3