!59 [sync] PR-58: fix CVE-2024-50612

From: @openeuler-sync-bot 
Reviewed-by: @liqingqing_1229 
Signed-off-by: @liqingqing_1229

0001-CVE-2021-3246.patch

@@ -1,38 +0,0 @@
-From deb669ee8be55a94565f6f8a6b60890c2e7c6f32 Mon Sep 17 00:00:00 2001
-From: bobsayshilol <bobsayshilol@live.co.uk>
-Date: Thu, 18 Feb 2021 21:52:09 +0000
-Subject: [PATCH] ms_adpcm: Fix and extend size checks
-
-'blockalign' is the size of a block, and each block contains 7 samples
-per channel as part of the preamble, so check against 'samplesperblock'
-rather than 'blockalign'. Also add an additional check that the block
-is big enough to hold the samples it claims to hold.
-
-https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26803
----
- src/ms_adpcm.c | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-
-diff --git a/src/ms_adpcm.c b/src/ms_adpcm.c
-index 5e8f1a316..a21cb9941 100644
---- a/src/ms_adpcm.c
-+++ b/src/ms_adpcm.c
-@@ -128,8 +128,14 @@ wavlike_msadpcm_init	(SF_PRIVATE *psf, int blockalign, int samplesperblock)
- 	if (psf->file.mode == SFM_WRITE)
- 		samplesperblock = 2 + 2 * (blockalign - 7 * psf->sf.channels) / psf->sf.channels ;
- 
--	if (blockalign < 7 * psf->sf.channels)
--	{	psf_log_printf (psf, "*** Error blockalign (%d) should be > %d.\n", blockalign, 7 * psf->sf.channels) ;
-+	/* There's 7 samples per channel in the preamble of each block */
-+	if (samplesperblock < 7 * psf->sf.channels)
-+	{	psf_log_printf (psf, "*** Error samplesperblock (%d) should be >= %d.\n", samplesperblock, 7 * psf->sf.channels) ;
-+		return SFE_INTERNAL ;
-+		} ;
-+
-+	if (2 * blockalign < samplesperblock * psf->sf.channels)
-+	{	psf_log_printf (psf, "*** Error blockalign (%d) should be >= %d.\n", blockalign, samplesperblock * psf->sf.channels / 2) ;
- 		return SFE_INTERNAL ;
- 		} ;
-
-

0002-CVE-2021-4156.patch

@@ -1,25 +0,0 @@
-From ced91d7b971be6173b604154c39279ce90ad87cc Mon Sep 17 00:00:00 2001
-From: yuan <ssspeed00@gmail.com>
-Date: Tue, 20 Apr 2021 16:16:32 +0800
-Subject: [PATCH] flac: Fix improper buffer reusing (#732)
-
----
- src/flac.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/src/flac.c b/src/flac.c
-index 64d0172e6..e33204505 100644
---- a/src/flac.c
-+++ b/src/flac.c
-@@ -948,7 +948,11 @@ flac_read_loop (SF_PRIVATE *psf, unsigned len)
- 	/* Decode some more. */
- 	while (pflac->pos < pflac->len)
- 	{	if (FLAC__stream_decoder_process_single (pflac->fsd) == 0)
-+		{	psf_log_printf (psf, "FLAC__stream_decoder_process_single returned false\n") ;
-+			/* Current frame is busted, so NULL the pointer. */
-+			pflac->frame = NULL ;
- 			break ;
-+			} ;
- 		state = FLAC__stream_decoder_get_state (pflac->fsd) ;
- 		if (state >= FLAC__STREAM_DECODER_END_OF_STREAM)
- 		{	psf_log_printf (psf, "FLAC__stream_decoder_get_state returned %s\n", FLAC__StreamDecoderStateString [state]) ;

0003-Fix-memory-leak-in-caf_read_header.patch

@@ -1,65 +0,0 @@
-From 65cf4511928ff0a4b387a15e10ae9f2431596cf7 Mon Sep 17 00:00:00 2001
-From: ctl-ly <liying_1@chinatelecom.cn>
-Date: Thu, 29 Dec 2022 10:53:55 +0800
-Subject: [PATCH] fix1
-
----
- docs/index.md        | 2 +-
- include/sndfile.h.in | 4 ++--
- src/caf.c            | 5 +++++
- 3 files changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/docs/index.md b/docs/index.md
-index 3779fdf..ee6bd07 100644
---- a/docs/index.md
-+++ b/docs/index.md
-@@ -194,7 +194,7 @@ long as you abide by [the license](http://www.gnu.org/copyleft/lesser.html).
- Check latest version on
- [GitHub Releases page](https://github.com/libsndfile/libsndfile/releases/).
- 
--Binatries and source packages are signed by current releaser David Seifert aka
-+Binaries and source packages are signed by current releaser David Seifert aka
- @SoapGentoo. You can verify signatures with his public GPG key:
- 
- ```
-diff --git a/include/sndfile.h.in b/include/sndfile.h.in
-index 917ff4b..970fb26 100644
---- a/include/sndfile.h.in
-+++ b/include/sndfile.h.in
-@@ -173,6 +173,7 @@ enum
- 
- 	SFC_SET_RAW_START_OFFSET		= 0x1090,
- 
-+	/* Commands reserved for dithering, which is not implemented. */
- 	SFC_SET_DITHER_ON_WRITE			= 0x10A0,
- 	SFC_SET_DITHER_ON_READ			= 0x10A1,
- 
-@@ -386,8 +387,7 @@ typedef struct
- 
- /*
- ** Enums and typedefs for adding dither on read and write.
--** See the html documentation for sf_command(), SFC_SET_DITHER_ON_WRITE
--** and SFC_SET_DITHER_ON_READ.
-+** Reserved for future implementation.
- */
- 
- enum
-diff --git a/src/caf.c b/src/caf.c
-index 45b1dba..6b2e579 100644
---- a/src/caf.c
-+++ b/src/caf.c
-@@ -416,6 +416,11 @@ caf_read_header (SF_PRIVATE *psf)
- 					return SFE_CAF_BAD_PEAK ;
- 					} ;
- 
-+				if (psf->peak_info)
-+				{	psf_log_printf (psf, "*** Found existing peak info, using last one.\n") ;
-+					free (psf->peak_info) ;
-+					psf->peak_info = NULL ;
-+				};
- 				if ((psf->peak_info = peak_info_calloc (psf->sf.channels)) == NULL)
- 					return SFE_MALLOC_FAILED ;
- 
--- 
-2.27.0
-

backport-CVE-2022-33065.patch

@@ -0,0 +1,42 @@
+From da1fcb0199f6a5c883fd158a20896a0e9c085e02 Mon Sep 17 00:00:00 2001
+From: Alex Stewart <alex.stewart@ni.com>
+Date: Wed, 22 Nov 2023 17:15:12 +0800
+Subject: [PATCH] mat4/mat5: fix int overflow in dataend calculation
+The clang sanitizer warns of a possible signed integer overflow when
+calculating the `dataend` value in `mat4_read_header()`.
+ 
+```
+src/mat4.c:323:41: runtime error: signed integer overflow: 205 * -100663296 cannot be represented in type 'int'
+SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:41 in
+src/mat4.c:323:48: runtime error: signed integer overflow: 838860800 * 4 cannot be represented in type 'int'
+SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:48 in
+```
+ 
+Cast the offending `rows` and `cols` ints to `sf_count_t` (the type of
+`dataend` before performing the calculation, to avoid the issue.
+ 
+CVE: CVE-2022-33065
+Fixes: https://github.com/libsndfile/libsndfile/issues/789
+Fixes: https://github.com/libsndfile/libsndfile/issues/833
+ 
+Signed-off-by: Alex Stewart <alex.stewart@ni.com>
+---
+ src/mat4.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+ 
+diff --git a/src/mat4.c b/src/mat4.c
+index 3c73680..e2f98b7 100644
+--- a/src/mat4.c
++++ b/src/mat4.c
+@@ -320,7 +320,7 @@ mat4_read_header (SF_PRIVATE *psf)
+ 				psf->filelength - psf->dataoffset, psf->sf.channels * psf->sf.frames * psf->bytewidth) ;
+ 		}
+ 	else if ((psf->filelength - psf->dataoffset) > psf->sf.channels * psf->sf.frames * psf->bytewidth)
+-		psf->dataend = psf->dataoffset + rows * cols * psf->bytewidth ;
++		psf->dataend = psf->dataoffset + (sf_count_t) rows * (sf_count_t) cols * psf->bytewidth ;
+ 
+ 	psf->datalength = psf->filelength - psf->dataoffset - psf->dataend ;
+ 
+-- 
+2.27.0
+

backport-CVE-2024-50612.patch

@@ -0,0 +1,407 @@
+From 274198fd95152b412ada49be059258ec0efca272 Mon Sep 17 00:00:00 2001
+From: Arthur Taylor <art@ified.ca>
+Date: Fri, 15 Nov 2024 19:46:53 -0800
+Subject: [PATCH 1/3] src/ogg: better error checking for vorbis. Fixes #1035
+
+---
+ src/ogg.c        |  12 ++--
+ src/ogg_opus.c   |  17 +++--
+ src/ogg_vorbis.c | 170 ++++++++++++++++++++++++++---------------------
+ 3 files changed, 114 insertions(+), 85 deletions(-)
+
+diff --git a/src/ogg.c b/src/ogg.c
+index 529941af8..e2d679d41 100644
+--- a/src/ogg.c
++++ b/src/ogg.c
+@@ -211,12 +211,16 @@ ogg_read_first_page (SF_PRIVATE *psf, OGG_PRIVATE *odata)
+ 
+ int
+ ogg_write_page (SF_PRIVATE *psf, ogg_page *page)
+-{	int bytes ;
++{	int n ;
+ 
+-	bytes = psf_fwrite (page->header, 1, page->header_len, psf) ;
+-	bytes += psf_fwrite (page->body, 1, page->body_len, psf) ;
++	n = psf_fwrite (page->header, 1, page->header_len, psf) ;
++	if (n == page->header_len)
++		n += psf_fwrite (page->body, 1, page->body_len, psf) ;
+ 
+-	return bytes == page->header_len + page->body_len ;
++	if (n != page->body_len + page->header_len)
++		return -1 ;
++
++	return n ;
+ } /* ogg_write_page */
+ 
+ sf_count_t
+diff --git a/src/ogg_opus.c b/src/ogg_opus.c
+index 511653ecc..e01224b99 100644
+--- a/src/ogg_opus.c
++++ b/src/ogg_opus.c
+@@ -827,15 +827,16 @@ ogg_opus_write_header (SF_PRIVATE *psf, int UNUSED (calc_length))
+ 
+ 	/* The first page MUST only contain the header, so flush it out now */
+ 	ogg_stream_packetin (&odata->ostream, &op) ;
+-	for ( ; (nn = ogg_stream_flush (&odata->ostream, &odata->opage)) ; )
+-	{	if (! (nn = ogg_write_page (psf, &odata->opage)))
++	while (ogg_stream_flush (&odata->ostream, &odata->opage))
++	{	nn = ogg_write_page (psf, &odata->opage) ;
++		if (nn < 0)
+ 		{	psf_log_printf (psf, "Opus : Failed to write header!\n") ;
+ 			if (psf->error)
+ 				return psf->error ;
+ 			return SFE_INTERNAL ;
+ 			} ;
+ 		psf->dataoffset += nn ;
+-		}
++		} ;
+ 
+ 	/*
+ 	** Metadata Tags (manditory)
+@@ -850,15 +851,16 @@ ogg_opus_write_header (SF_PRIVATE *psf, int UNUSED (calc_length))
+ 	vorbiscomment_write_tags (psf, &op, &opustags_ident, opus_get_version_string (), - (OGG_OPUS_COMMENT_PAD)) ;
+ 	op.packetno = 2 ;
+ 	ogg_stream_packetin (&odata->ostream, &op) ;
+-	for ( ; (nn = ogg_stream_flush (&odata->ostream, &odata->opage)) ; )
+-	{	if (! (nn = ogg_write_page (psf, &odata->opage)))
++	while (ogg_stream_flush (&odata->ostream, &odata->opage))
++	{	nn = ogg_write_page (psf, &odata->opage) ;
++		if (nn < 0)
+ 		{	psf_log_printf (psf, "Opus : Failed to write comments!\n") ;
+ 			if (psf->error)
+ 				return psf->error ;
+ 			return SFE_INTERNAL ;
+ 			} ;
+ 		psf->dataoffset += nn ;
+-		}
++		} ;
+ 
+ 	return 0 ;
+ } /* ogg_opus_write_header */
+@@ -1132,7 +1134,8 @@ ogg_opus_write_out (SF_PRIVATE *psf, OGG_PRIVATE *odata, OPUS_PRIVATE *oopus)
+ 		if (nbytes > 0)
+ 		{	oopus->u.encode.last_segments -= ogg_page_segments (&odata->opage) ;
+ 			oopus->pg_pos = oopus->pkt_pos ;
+-			ogg_write_page (psf, &odata->opage) ;
++			if (ogg_write_page (psf, &odata->opage) < 0)
++				return -1 ;
+ 			}
+ 		else
+ 			break ;
+diff --git a/src/ogg_vorbis.c b/src/ogg_vorbis.c
+index add123966..fae252ca0 100644
+--- a/src/ogg_vorbis.c
++++ b/src/ogg_vorbis.c
+@@ -82,28 +82,6 @@
+ /* How many seconds in the future to not bother bisection searching for. */
+ #define VORBIS_SEEK_THRESHOLD 2
+ 
+-typedef int convert_func (SF_PRIVATE *psf, int, void *, int, int, float **) ;
+-
+-static int	vorbis_read_header (SF_PRIVATE *psf) ;
+-static int	vorbis_write_header (SF_PRIVATE *psf, int calc_length) ;
+-static int	vorbis_close (SF_PRIVATE *psf) ;
+-static int	vorbis_command (SF_PRIVATE *psf, int command, void *data, int datasize) ;
+-static int	vorbis_byterate (SF_PRIVATE *psf) ;
+-static int	vorbis_calculate_granulepos (SF_PRIVATE *psf, uint64_t *gp_out) ;
+-static int	vorbis_skip (SF_PRIVATE *psf, uint64_t target_gp) ;
+-static int	vorbis_seek_trysearch (SF_PRIVATE *psf, uint64_t target_gp) ;
+-static sf_count_t	vorbis_seek (SF_PRIVATE *psf, int mode, sf_count_t offset) ;
+-static sf_count_t	vorbis_read_s (SF_PRIVATE *psf, short *ptr, sf_count_t len) ;
+-static sf_count_t	vorbis_read_i (SF_PRIVATE *psf, int *ptr, sf_count_t len) ;
+-static sf_count_t	vorbis_read_f (SF_PRIVATE *psf, float *ptr, sf_count_t len) ;
+-static sf_count_t	vorbis_read_d (SF_PRIVATE *psf, double *ptr, sf_count_t len) ;
+-static sf_count_t	vorbis_write_s (SF_PRIVATE *psf, const short *ptr, sf_count_t len) ;
+-static sf_count_t	vorbis_write_i (SF_PRIVATE *psf, const int *ptr, sf_count_t len) ;
+-static sf_count_t	vorbis_write_f (SF_PRIVATE *psf, const float *ptr, sf_count_t len) ;
+-static sf_count_t	vorbis_write_d (SF_PRIVATE *psf, const double *ptr, sf_count_t len) ;
+-static sf_count_t	vorbis_read_sample (SF_PRIVATE *psf, void *ptr, sf_count_t lens, convert_func *transfn) ;
+-static int	vorbis_rnull (SF_PRIVATE *psf, int samples, void *vptr, int off , int channels, float **pcm) ;
+-
+ typedef struct
+ {	int id ;
+ 	const char *name ;
+@@ -145,6 +123,45 @@ typedef struct
+ 	sf_count_t last_page ;
+ } VORBIS_PRIVATE ;
+ 
++typedef int convert_func (SF_PRIVATE *psf, int, void *, int, int, float **) ;
++
++static int	vorbis_read_header (SF_PRIVATE *psf) ;
++static int	vorbis_write_header (SF_PRIVATE *psf, int calc_length) ;
++static int	vorbis_close (SF_PRIVATE *psf) ;
++static int	vorbis_command (SF_PRIVATE *psf, int command, void *data, int datasize) ;
++static int	vorbis_byterate (SF_PRIVATE *psf) ;
++static int	vorbis_calculate_granulepos (SF_PRIVATE *psf, uint64_t *gp_out) ;
++static int	vorbis_skip (SF_PRIVATE *psf, uint64_t target_gp) ;
++static int	vorbis_seek_trysearch (SF_PRIVATE *psf, uint64_t target_gp) ;
++static sf_count_t	vorbis_seek (SF_PRIVATE *psf, int mode, sf_count_t offset) ;
++static sf_count_t	vorbis_read_s (SF_PRIVATE *psf, short *ptr, sf_count_t len) ;
++static sf_count_t	vorbis_read_i (SF_PRIVATE *psf, int *ptr, sf_count_t len) ;
++static sf_count_t	vorbis_read_f (SF_PRIVATE *psf, float *ptr, sf_count_t len) ;
++static sf_count_t	vorbis_read_d (SF_PRIVATE *psf, double *ptr, sf_count_t len) ;
++static sf_count_t	vorbis_write_s (SF_PRIVATE *psf, const short *ptr, sf_count_t len) ;
++static sf_count_t	vorbis_write_i (SF_PRIVATE *psf, const int *ptr, sf_count_t len) ;
++static sf_count_t	vorbis_write_f (SF_PRIVATE *psf, const float *ptr, sf_count_t len) ;
++static sf_count_t	vorbis_write_d (SF_PRIVATE *psf, const double *ptr, sf_count_t len) ;
++static sf_count_t	vorbis_read_sample (SF_PRIVATE *psf, void *ptr, sf_count_t lens, convert_func *transfn) ;
++static int	vorbis_write_samples (SF_PRIVATE *psf, OGG_PRIVATE *odata, VORBIS_PRIVATE *vdata, int in_frames) ;
++static int	vorbis_rnull (SF_PRIVATE *psf, int samples, void *vptr, int off , int channels, float **pcm) ;
++static void	vorbis_log_error (SF_PRIVATE *psf, int error) ;
++
++
++static void
++vorbis_log_error(SF_PRIVATE *psf, int error) {
++	switch (error)
++	{	case 0: return;
++		case OV_EIMPL:		psf->error = SFE_UNIMPLEMENTED ; break ;
++		case OV_ENOTVORBIS:	psf->error = SFE_MALFORMED_FILE ; break ;
++		case OV_EBADHEADER:	psf->error = SFE_MALFORMED_FILE ; break ;
++		case OV_EVERSION:	psf->error = SFE_UNSUPPORTED_ENCODING ; break ;
++		case OV_EFAULT:
++		case OV_EINVAL:
++		default: psf->error = SFE_INTERNAL ;
++		} ;
++} ;
++
+ static int
+ vorbis_read_header (SF_PRIVATE *psf)
+ {	OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
+@@ -380,7 +397,6 @@ vorbis_write_header (SF_PRIVATE *psf, int UNUSED (calc_length))
+ 	{	ogg_packet header ;
+ 		ogg_packet header_comm ;
+ 		ogg_packet header_code ;
+-		int result ;
+ 
+ 		vorbis_analysis_headerout (&vdata->vdsp, &vdata->vcomment, &header, &header_comm, &header_code) ;
+ 		ogg_stream_packetin (&odata->ostream, &header) ; /* automatically placed in its own page */
+@@ -390,9 +406,9 @@ vorbis_write_header (SF_PRIVATE *psf, int UNUSED (calc_length))
+ 		/* This ensures the actual
+ 		 * audio data will start on a new page, as per spec
+ 		 */
+-		while ((result = ogg_stream_flush (&odata->ostream, &odata->opage)) != 0)
+-		{	ogg_write_page (psf, &odata->opage) ;
+-			} ;
++		while (ogg_stream_flush (&odata->ostream, &odata->opage))
++			if (ogg_write_page (psf, &odata->opage) < 0)
++				return -1 ;
+ 	}
+ 
+ 	return 0 ;
+@@ -402,6 +418,7 @@ static int
+ vorbis_close (SF_PRIVATE *psf)
+ {	OGG_PRIVATE* odata = psf->container_data ;
+ 	VORBIS_PRIVATE *vdata = psf->codec_data ;
++	int ret = 0 ;
+ 
+ 	if (odata == NULL || vdata == NULL)
+ 		return 0 ;
+@@ -412,34 +429,14 @@ vorbis_close (SF_PRIVATE *psf)
+ 	if (psf->file.mode == SFM_WRITE)
+ 	{
+ 		if (psf->write_current <= 0)
+-			vorbis_write_header (psf, 0) ;
+-
+-		vorbis_analysis_wrote (&vdata->vdsp, 0) ;
+-		while (vorbis_analysis_blockout (&vdata->vdsp, &vdata->vblock) == 1)
+-		{
++			ret = vorbis_write_header (psf, 0) ;
+ 
+-		/* analysis, assume we want to use bitrate management */
+-			vorbis_analysis (&vdata->vblock, NULL) ;
+-			vorbis_bitrate_addblock (&vdata->vblock) ;
+-
+-			while (vorbis_bitrate_flushpacket (&vdata->vdsp, &odata->opacket))
+-			{	/* weld the packet into the bitstream */
+-				ogg_stream_packetin (&odata->ostream, &odata->opacket) ;
+-
+-				/* write out pages (if any) */
+-				while (!odata->eos)
+-				{	int result = ogg_stream_pageout (&odata->ostream, &odata->opage) ;
+-					if (result == 0) break ;
+-					ogg_write_page (psf, &odata->opage) ;
+-
+-		/* this could be set above, but for illustrative purposes, I do
+-		   it here (to show that vorbis does know where the stream ends) */
+-
+-					if (ogg_page_eos (&odata->opage)) odata->eos = 1 ;
+-				}
+-			}
+-		}
+-	}
++		if (ret == 0)
++		{	/* A write of zero samples tells Vorbis the stream is done and to
++			   flush. */
++			ret = vorbis_write_samples (psf, odata, vdata, 0) ;
++			} ;
++		} ;
+ 
+ 	/* ogg_page and ogg_packet structs always point to storage in
+ 	   libvorbis.  They are never freed or manipulated directly */
+@@ -449,7 +446,7 @@ vorbis_close (SF_PRIVATE *psf)
+ 	vorbis_comment_clear (&vdata->vcomment) ;
+ 	vorbis_info_clear (&vdata->vinfo) ;
+ 
+-	return 0 ;
++	return ret ;
+ } /* vorbis_close */
+ 
+ int
+@@ -688,33 +685,40 @@ vorbis_read_d (SF_PRIVATE *psf, double *ptr, sf_count_t lens)
+ /*==============================================================================
+ */
+ 
+-static void
++static int
+ vorbis_write_samples (SF_PRIVATE *psf, OGG_PRIVATE *odata, VORBIS_PRIVATE *vdata, int in_frames)
+-{
+-	vorbis_analysis_wrote (&vdata->vdsp, in_frames) ;
++{	int ret ;
++
++	if ((ret = vorbis_analysis_wrote (&vdata->vdsp, in_frames)) != 0)
++		return ret ;
+ 
+ 	/*
+ 	**	Vorbis does some data preanalysis, then divvies up blocks for
+ 	**	more involved (potentially parallel) processing. Get a single
+ 	**	block for encoding now.
+ 	*/
+-	while (vorbis_analysis_blockout (&vdata->vdsp, &vdata->vblock) == 1)
++	while ((ret = vorbis_analysis_blockout (&vdata->vdsp, &vdata->vblock)) == 1)
+ 	{
+ 		/* analysis, assume we want to use bitrate management */
+-		vorbis_analysis (&vdata->vblock, NULL) ;
+-		vorbis_bitrate_addblock (&vdata->vblock) ;
++		if ((ret = vorbis_analysis (&vdata->vblock, NULL)) != 0)
++			return ret ;
++		if ((ret = vorbis_bitrate_addblock (&vdata->vblock)) != 0)
++			return ret ;
+ 
+-		while (vorbis_bitrate_flushpacket (&vdata->vdsp, &odata->opacket))
++		while ((ret = vorbis_bitrate_flushpacket (&vdata->vdsp, &odata->opacket)) == 1)
+ 		{
+ 			/* weld the packet into the bitstream */
+-			ogg_stream_packetin (&odata->ostream, &odata->opacket) ;
++			if ((ret = ogg_stream_packetin (&odata->ostream, &odata->opacket)) != 0)
++				return ret ;
+ 
+ 			/* write out pages (if any) */
+ 			while (!odata->eos)
+-			{	int result = ogg_stream_pageout (&odata->ostream, &odata->opage) ;
+-				if (result == 0)
++			{	ret = ogg_stream_pageout (&odata->ostream, &odata->opage) ;
++				if (ret == 0)
+ 					break ;
+-				ogg_write_page (psf, &odata->opage) ;
++
++				if (ogg_write_page (psf, &odata->opage) < 0)
++					return -1 ;
+ 
+ 				/*	This could be set above, but for illustrative purposes, I do
+ 				**	it here (to show that vorbis does know where the stream ends) */
+@@ -722,16 +726,22 @@ vorbis_write_samples (SF_PRIVATE *psf, OGG_PRIVATE *odata, VORBIS_PRIVATE *vdata
+ 					odata->eos = 1 ;
+ 				} ;
+ 			} ;
++		if (ret != 0)
++			return ret ;
+ 		} ;
++	if (ret != 0)
++		return ret ;
+ 
+ 	vdata->gp += in_frames ;
++
++	return 0 ;
+ } /* vorbis_write_data */
+ 
+ 
+ static sf_count_t
+ vorbis_write_s (SF_PRIVATE *psf, const short *ptr, sf_count_t lens)
+ {
+-	int i, m, j = 0 ;
++	int i, m, j = 0, ret ;
+ 	OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
+ 	VORBIS_PRIVATE *vdata = (VORBIS_PRIVATE *) psf->codec_data ;
+ 	int in_frames = lens / psf->sf.channels ;
+@@ -740,14 +750,17 @@ vorbis_write_s (SF_PRIVATE *psf, const short *ptr, sf_count_t lens)
+ 		for (m = 0 ; m < psf->sf.channels ; m++)
+ 			buffer [m][i] = (float) (ptr [j++]) / 32767.0f ;
+ 
+-	vorbis_write_samples (psf, odata, vdata, in_frames) ;
++	if ((ret = vorbis_write_samples (psf, odata, vdata, in_frames)))
++	{	vorbis_log_error (psf, ret) ;
++		return 0 ;
++		} ;
+ 
+ 	return lens ;
+ } /* vorbis_write_s */
+ 
+ static sf_count_t
+ vorbis_write_i (SF_PRIVATE *psf, const int *ptr, sf_count_t lens)
+-{	int i, m, j = 0 ;
++{	int i, m, j = 0, ret ;
+ 	OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
+ 	VORBIS_PRIVATE *vdata = (VORBIS_PRIVATE *) psf->codec_data ;
+ 	int in_frames = lens / psf->sf.channels ;
+@@ -756,14 +769,17 @@ vorbis_write_i (SF_PRIVATE *psf, const int *ptr, sf_count_t lens)
+ 		for (m = 0 ; m < psf->sf.channels ; m++)
+ 			buffer [m][i] = (float) (ptr [j++]) / 2147483647.0f ;
+ 
+-	vorbis_write_samples (psf, odata, vdata, in_frames) ;
++	if ((ret = vorbis_write_samples (psf, odata, vdata, in_frames)))
++	{	vorbis_log_error (psf, ret) ;
++		return 0 ;
++		} ;
+ 
+ 	return lens ;
+ } /* vorbis_write_i */
+ 
+ static sf_count_t
+ vorbis_write_f (SF_PRIVATE *psf, const float *ptr, sf_count_t lens)
+-{	int i, m, j = 0 ;
++{	int i, m, j = 0, ret ;
+ 	OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
+ 	VORBIS_PRIVATE *vdata = (VORBIS_PRIVATE *) psf->codec_data ;
+ 	int in_frames = lens / psf->sf.channels ;
+@@ -772,14 +788,17 @@ vorbis_write_f (SF_PRIVATE *psf, const float *ptr, sf_count_t lens)
+ 		for (m = 0 ; m < psf->sf.channels ; m++)
+ 			buffer [m][i] = ptr [j++] ;
+ 
+-	vorbis_write_samples (psf, odata, vdata, in_frames) ;
++	if ((ret = vorbis_write_samples (psf, odata, vdata, in_frames)) != 0)
++	{	vorbis_log_error (psf, ret) ;
++		return 0 ;
++		} ;
+ 
+ 	return lens ;
+ } /* vorbis_write_f */
+ 
+ static sf_count_t
+ vorbis_write_d (SF_PRIVATE *psf, const double *ptr, sf_count_t lens)
+-{	int i, m, j = 0 ;
++{	int i, m, j = 0, ret ;
+ 	OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
+ 	VORBIS_PRIVATE *vdata = (VORBIS_PRIVATE *) psf->codec_data ;
+ 	int in_frames = lens / psf->sf.channels ;
+@@ -788,7 +807,10 @@ vorbis_write_d (SF_PRIVATE *psf, const double *ptr, sf_count_t lens)
+ 		for (m = 0 ; m < psf->sf.channels ; m++)
+ 			buffer [m][i] = (float) ptr [j++] ;
+ 
+-	vorbis_write_samples (psf, odata, vdata, in_frames) ;
++	if ((ret = vorbis_write_samples (psf, odata, vdata, in_frames)) != 0)
++	{	vorbis_log_error (psf, ret) ;
++		return 0 ;
++		} ;
+ 
+ 	return lens ;
+ } /* vorbis_write_d */
+@@ -884,7 +906,7 @@ vorbis_seek_trysearch (SF_PRIVATE *psf, uint64_t target_gp)
+ 		return 0 ;
+ 
+ 	/*	Search for a position a half large-block before our target. As Vorbis is
+-	**	lapped, every sample position come from two blocks, the "left" half of
++	**	lapped, every sample position comes from two blocks, the "left" half of
+ 	**	one block and the "right" half of the previous block.  The granule
+ 	**	position of an Ogg page of a Vorbis stream is the sample offset of the
+ 	**	last finished sample in the stream that can be decoded from a page.  A
+

libsndfile-1.0.25-system-gsm.patch

@@ -0,0 +1,103 @@
+diff -up libsndfile-1.1.0/CMakeLists.txt.system-gsm libsndfile-1.1.0/CMakeLists.txt
+--- libsndfile-1.1.0/CMakeLists.txt.system-gsm	2022-03-27 14:39:27.000000000 +0200
++++ libsndfile-1.1.0/CMakeLists.txt	2022-04-25 22:41:46.472440316 +0200
+@@ -286,7 +286,6 @@ add_library (sndfile
+ 	src/double64.c
+ 	src/ima_adpcm.c
+ 	src/ms_adpcm.c
+-	src/gsm610.c
+ 	src/dwvw.c
+ 	src/vox_adpcm.c
+ 	src/interleave.c
+@@ -347,23 +346,6 @@ add_library (sndfile
+ 	src/mpeg.c
+ 	src/mpeg_decode.c
+ 	src/mpeg_l3_encode.c
+-	src/GSM610/config.h
+-	src/GSM610/gsm.h
+-	src/GSM610/gsm610_priv.h
+-	src/GSM610/add.c
+-	src/GSM610/code.c
+-	src/GSM610/decode.c
+-	src/GSM610/gsm_create.c
+-	src/GSM610/gsm_decode.c
+-	src/GSM610/gsm_destroy.c
+-	src/GSM610/gsm_encode.c
+-	src/GSM610/gsm_option.c
+-	src/GSM610/long_term.c
+-	src/GSM610/lpc.c
+-	src/GSM610/preprocess.c
+-	src/GSM610/rpe.c
+-	src/GSM610/short_term.c
+-	src/GSM610/table.c
+ 	src/G72x/g72x.h
+ 	src/G72x/g72x_priv.h
+ 	src/G72x/g721.c
+@@ -412,6 +394,7 @@ target_link_libraries (sndfile
+ 		$<$<BOOL:${HAVE_EXTERNAL_XIPH_LIBS}>:Opus::opus>
+ 		$<$<BOOL:${HAVE_MPEG}>:MPG123::libmpg123>
+ 		$<$<BOOL:${HAVE_MPEG}>:mp3lame::mp3lame>
++		-lgsm
+ 	)
+ set_target_properties (sndfile PROPERTIES
+ 	PUBLIC_HEADER "${sndfile_HDRS}"
+diff -up libsndfile-1.1.0/Makefile.am.system-gsm libsndfile-1.1.0/Makefile.am
+--- libsndfile-1.1.0/Makefile.am.system-gsm	2022-03-27 10:55:12.000000000 +0200
++++ libsndfile-1.1.0/Makefile.am	2022-04-25 22:39:56.976112391 +0200
+@@ -47,7 +47,6 @@ SYMBOL_FILES = src/Symbols.gnu-binutils
+ 
+ EXTRA_DIST += src/config.h.in src/test_endswap.tpl src/test_endswap.def \
+ 	$(SYMBOL_FILES) src/create_symbols_file.py src/binheader_writef_check.py \
+-	src/GSM610/README src/GSM610/COPYRIGHT src/GSM610/ChangeLog \
+ 	src/G72x/README src/G72x/README.original src/G72x/ChangeLog \
+ 	src/make-static-lib-hidden-privates.sh \
+ 	src/config.h.cmake
+@@ -72,7 +71,7 @@ src_libsndfile_la_SOURCES = src/sndfile.
+ 	src/ogg.c src/ogg.h src/ogg_vorbis.c src/ogg_speex.c src/ogg_pcm.c src/ogg_opus.c src/ogg_vcomment.c src/ogg_vcomment.h \
+ 	src/common.h src/sfconfig.h src/sfendian.h src/wavlike.h src/sf_unistd.h src/chanmap.h src/mpeg.c
+ nodist_src_libsndfile_la_SOURCES = $(nodist_include_HEADERS)
+-src_libsndfile_la_LIBADD = src/GSM610/libgsm.la src/G72x/libg72x.la src/ALAC/libalac.la \
++src_libsndfile_la_LIBADD = -lgsm src/G72x/libg72x.la src/ALAC/libalac.la \
+ 	src/libcommon.la $(EXTERNAL_XIPH_LIBS) -lm $(MPEG_LIBS)
+ EXTRA_src_libsndfile_la_DEPENDENCIES = $(SYMBOL_FILES)
+ 
+@@ -91,17 +90,6 @@ src_test_main_SOURCES = src/test_main.c
+ 	src/test_binheader_writef.c src/test_nms_adpcm.c
+ src_test_main_LDADD = src/libcommon.la
+ 
+-##############
+-# src/GSM610 #
+-##############
+-
+-noinst_LTLIBRARIES += src/GSM610/libgsm.la
+-src_GSM610_libgsm_la_SOURCES = src/GSM610/config.h src/GSM610/gsm.h src/GSM610/gsm610_priv.h \
+-	src/GSM610/add.c src/GSM610/code.c src/GSM610/decode.c src/GSM610/gsm_create.c \
+-	src/GSM610/gsm_decode.c src/GSM610/gsm_destroy.c src/GSM610/gsm_encode.c \
+-	src/GSM610/gsm_option.c src/GSM610/long_term.c src/GSM610/lpc.c src/GSM610/preprocess.c \
+-	src/GSM610/rpe.c src/GSM610/short_term.c src/GSM610/table.c
+-
+ ############
+ # src/G72x #
+ ############
+diff -up libsndfile-1.1.0/src/gsm610.c.system-gsm libsndfile-1.1.0/src/gsm610.c
+--- libsndfile-1.1.0/src/gsm610.c.system-gsm	2021-05-17 11:12:28.000000000 +0200
++++ libsndfile-1.1.0/src/gsm610.c	2022-04-25 22:37:21.059496852 +0200
+@@ -27,7 +27,7 @@
+ #include "sfendian.h"
+ #include "common.h"
+ #include "wavlike.h"
+-#include "GSM610/gsm.h"
++#include <gsm.h>
+ 
+ #define	GSM610_BLOCKSIZE		33
+ #define	GSM610_SAMPLES			160
+@@ -391,7 +391,8 @@ gsm610_seek	(SF_PRIVATE *psf, int UNUSED
+ 		psf_fseek (psf, psf->dataoffset, SEEK_SET) ;
+ 		pgsm610->blockcount = 0 ;
+ 
+-		gsm_init (pgsm610->gsm_data) ;
++                gsm_destroy (pgsm610->gsm_data) ;
++                pgsm610->gsm_data = gsm_create () ;
+ 		if ((SF_CONTAINER (psf->sf.format)) == SF_FORMAT_WAV ||
+ 				(SF_CONTAINER (psf->sf.format)) == SF_FORMAT_W64)
+ 			gsm_option (pgsm610->gsm_data, GSM_OPT_WAV49, &true_flag) ;

libsndfile.spec

@@ -1,18 +1,23 @@
 Name: libsndfile
-Version: 1.0.31
+Version: 1.2.2
 Release: 3
 Summary: Library for reading and writing sound files
-License: LGPLv2+ and GPLv2+ and BSD
+License: LGPL-2.1-or-later AND GPL-2.0-or-later AND BSD-3-Clause
 URL: http://libsndfile.github.io/libsndfile
-Source0: https://github.com/libsndfile/libsndfile/releases/download/%{version}/%{name}-%{version}.tar.bz2
+Source0: https://github.com/libsndfile/libsndfile/releases/download/%{version}/%{name}-%{version}.tar.xz
+Patch0:		libsndfile-1.0.25-system-gsm.patch
+Patch1:		backport-CVE-2022-33065.patch
+Patch2:         backport-CVE-2024-50612.patch
 
 BuildRequires: alsa-lib-devel gcc gcc-c++ flac-devel
 BuildRequires: libogg-devel libtool libvorbis-devel pkgconfig
 BuildRequires: sqlite-devel
-
-Patch1:		0001-CVE-2021-3246.patch
-Patch2:		0002-CVE-2021-4156.patch
-Patch3:		0003-Fix-memory-leak-in-caf_read_header.patch
+BuildRequires: opus-devel
+BuildRequires: gsm-devel
+BuildRequires: make
+BuildRequires: python3
+BuildRequires: lame-devel
+BuildRequires: mpg123-devel
 
 %description
 Libsndfile is a C library for reading and writing files containing
@@ -40,24 +45,33 @@ BuildArch: noarch
 Help files for %{name}-utils.
 
 %prep
-%autosetup -n %{name}-%{version} -p1
+%setup -q
+%patch -P0 -p1 -b .system-gsm
+rm -r src/GSM610
+%patch -P1 -p1
+%patch -P2 -p1
 
 %build
+autoreconf -I M4 -fiv # for system-gsm patch
 %configure \
 	--disable-dependency-tracking \
 	--enable-sqlite \
 	--enable-alsa \
 	--enable-largefile \
+	--enable-mpeg \
 	--disable-static
 %disable_rpath
 %make_build
 
 %install
 %make_install
+%delete_la
 rm -rf __docs
 mkdir __docs
 cp -pR $RPM_BUILD_ROOT%{_docdir}/%{name}/* __docs
 rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}
+
+# fix multilib issues
 mv %{buildroot}%{_includedir}/sndfile.h \
    %{buildroot}%{_includedir}/sndfile-%{__isa_bits}.h
 
@@ -76,11 +90,9 @@ EOF
 %check
 LD_LIBRARY_PATH=$PWD/src/.libs make check
 
-%ldconfig_scriptlets
-
 %files
 %{_libdir}/%{name}.so.*
-%doc AUTHORS README NEWS
+%doc AUTHORS README NEWS.OLD
 %license COPYING
 
 %files utils
@@ -102,7 +114,6 @@ LD_LIBRARY_PATH=$PWD/src/.libs make check
 %{_libdir}/%{name}.so
 %{_libdir}/pkgconfig/sndfile.pc
 %doc __docs ChangeLog
-%exclude %{_libdir}/*.la
 
 %files utils-help
 %{_mandir}/man1/sndfile-cmp.1*
@@ -117,6 +128,21 @@ LD_LIBRARY_PATH=$PWD/src/.libs make check
 %{_mandir}/man1/sndfile-salvage.1*
 
 %changelog
+* Tue Nov 19 2024 Funda Wang <fundawang@yeah.net> - 1.2.2-3
+- fix CVE-2024-50612
+
+* Fri Sep 13 2024 zhangnaichuan <zhangnaichuan@huawei.com> - 1.2.2-2
+- fix CVE-2203-33065
+
+* Tue Oct 31 2023 haomimi <haomimi@uniontech.com> - 1.2.2-1
+- pdate to 1.2.2
+
+* Mon Sep 11 2023 penghaitao <htpengc@isoftstone.com> - 1.2.0-2
+- Add opus-devel to satisfy configure requirements check
+
+* Fri Feb 10 2023 Liu Yuntao <liuyuntao10@huawei.com> - 1.2.0-1
+- update to 1.2.0, and update upstream URL
+
 * Thu Dec 29 2022 liying <liying_1@chinatelecom.cn> - 1.0.31-3
 - Marked unimplemented dither enums in the header file as such.
 - Fix typo