commit a577331a466986f801e074b75c60bc99242ea1ca Author: overweight <5324761+overweight@user.noreply.gitee.com> Date: Mon Sep 30 11:18:04 2019 -0400 Package init diff --git a/0001-Don-t-assume-TDRC-is-an-instance-of-TextIdentificati.patch b/0001-Don-t-assume-TDRC-is-an-instance-of-TextIdentificati.patch new file mode 100644 index 0000000..81d36d9 --- /dev/null +++ b/0001-Don-t-assume-TDRC-is-an-instance-of-TextIdentificati.patch @@ -0,0 +1,33 @@ +From eb9ded1206f18f2c319157337edea2533a40bea6 Mon Sep 17 00:00:00 2001 +From: "Stephen F. Booth" +Date: Sun, 23 Jul 2017 10:11:09 -0400 +Subject: [PATCH] Don't assume TDRC is an instance of TextIdentificationFrame + +If TDRC is encrypted, FrameFactory::createFrame() returns UnknownFrame +which causes problems in rebuildAggregateFrames() when it is assumed +that TDRC is a TextIdentificationFrame +--- + taglib/mpeg/id3v2/id3v2framefactory.cpp | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/taglib/mpeg/id3v2/id3v2framefactory.cpp b/taglib/mpeg/id3v2/id3v2framefactory.cpp +index 759a9b7b..9347ab86 100644 +--- a/taglib/mpeg/id3v2/id3v2framefactory.cpp ++++ b/taglib/mpeg/id3v2/id3v2framefactory.cpp +@@ -334,10 +334,11 @@ void FrameFactory::rebuildAggregateFrames(ID3v2::Tag *tag) const + tag->frameList("TDAT").size() == 1) + { + TextIdentificationFrame *tdrc = +- static_cast(tag->frameList("TDRC").front()); ++ dynamic_cast(tag->frameList("TDRC").front()); + UnknownFrame *tdat = static_cast(tag->frameList("TDAT").front()); + +- if(tdrc->fieldList().size() == 1 && ++ if(tdrc && ++ tdrc->fieldList().size() == 1 && + tdrc->fieldList().front().size() == 4 && + tdat->data().size() >= 5) + { +-- +2.13.5 + diff --git a/CVE-2018-11439-Fixed-OOB-read-when-loading-invalid-ogg-flac-file.-8.patch b/CVE-2018-11439-Fixed-OOB-read-when-loading-invalid-ogg-flac-file.-8.patch new file mode 100644 index 0000000..d966339 --- /dev/null +++ b/CVE-2018-11439-Fixed-OOB-read-when-loading-invalid-ogg-flac-file.-8.patch @@ -0,0 +1,46 @@ +From 2c4ae870ec086f2ddd21a47861a3709c36faac45 Mon Sep 17 00:00:00 2001 +From: Scott Gayou +Date: Tue, 9 Oct 2018 18:46:55 -0500 +Subject: [PATCH] Fixed OOB read when loading invalid ogg flac file. (#868) + (#869) + +CVE-2018-11439 is caused by a failure to check the minimum length +of a ogg flac header. This header is detailed in full at: +https://xiph.org/flac/ogg_mapping.html. Added more strict checking +for entire header. + +--- + taglib/ogg/flac/oggflacfile.cpp | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/taglib/ogg/flac/oggflacfile.cpp b/taglib/ogg/flac/oggflacfile.cpp +index 53d04508..07ea9dcc 100644 +--- a/taglib/ogg/flac/oggflacfile.cpp ++++ b/taglib/ogg/flac/oggflacfile.cpp +@@ -231,11 +231,21 @@ void Ogg::FLAC::File::scan() + + if(!metadataHeader.startsWith("fLaC")) { + // FLAC 1.1.2+ ++ // See https://xiph.org/flac/ogg_mapping.html for the header specification. ++ if(metadataHeader.size() < 13) ++ return; ++ ++ if(metadataHeader[0] != 0x7f) ++ return; ++ + if(metadataHeader.mid(1, 4) != "FLAC") + return; + +- if(metadataHeader[5] != 1) +- return; // not version 1 ++ if(metadataHeader[5] != 1 && metadataHeader[6] != 0) ++ return; // not version 1.0 ++ ++ if(metadataHeader.mid(9, 4) != "fLaC") ++ return; + + metadataHeader = metadataHeader.mid(13); + } +-- +2.19.1 + diff --git a/taglib-1.11.1.tar.gz b/taglib-1.11.1.tar.gz new file mode 100644 index 0000000..c0b7a3e Binary files /dev/null and b/taglib-1.11.1.tar.gz differ diff --git a/taglib-1.5rc1-multilib.patch b/taglib-1.5rc1-multilib.patch new file mode 100644 index 0000000..4f0cb40 --- /dev/null +++ b/taglib-1.5rc1-multilib.patch @@ -0,0 +1,20 @@ +diff -up taglib-1.5rc1/taglib-config.cmake.multilib-2 taglib-1.5rc1/taglib-config.cmake +--- taglib-1.5rc1/taglib-config.cmake.multilib-2 2008-01-29 19:30:00.000000000 -0600 ++++ taglib-1.5rc1/taglib-config.cmake 2008-02-13 06:41:11.000000000 -0600 +@@ -16,7 +16,6 @@ EOH + + prefix=${CMAKE_INSTALL_PREFIX} + exec_prefix=${CMAKE_INSTALL_PREFIX} +-libdir=${LIB_INSTALL_DIR} + includedir=${INCLUDE_INSTALL_DIR} + + flags="" +@@ -29,7 +28,7 @@ while test $# -gt 0 + do + case $1 in + --libs) +- flags="$flags -L$libdir -ltag" ++ flags="$flags -ltag" + ;; + --cflags) + flags="$flags -I$includedir/taglib" diff --git a/taglib.spec b/taglib.spec new file mode 100644 index 0000000..75a2593 --- /dev/null +++ b/taglib.spec @@ -0,0 +1,88 @@ +Name: taglib +Summary: Audio Meta-Data Library +Version: 1.11.1 +Release: 10 +License: LGPLv2 or MPLv1.1 +URL: https://taglib.github.io/ +Source0: https://taglib.github.io/releases/%{name}-%{version}.tar.gz + +# patch0 comes from redhat +Patch0: taglib-1.5rc1-multilib.patch + +# patch1 comes from TagLib official +Patch1: 0001-Don-t-assume-TDRC-is-an-instance-of-TextIdentificati.patch +Patch6000: CVE-2018-11439-Fixed-OOB-read-when-loading-invalid-ogg-flac-file.-8.patch + +BuildRequires: gcc gcc-c++ cmake pkgconfig zlib-devel + +%description +TagLib is a library for reading and editing the meta-data of several popular +audio formats. Currently it supports both ID3v1 and ID3v2 for MP3 files, Ogg +Vorbis comments and ID3 tags and Vorbis comments in FLAC, MPC, Speex, WavPack +TrueAudio, WAV, AIFF, MP4 and ASF files. + +%package devel +Summary: Development files for %{name} +Requires: %{name}%{?_isa} = %{version}-%{release} +%description devel +Files needed when building software with %{name}. + +%package_help + + +%prep +%autosetup -n %{name}-%{version} -p1 + +%build +mkdir %{_target_platform} +pushd %{_target_platform} +%{cmake} .. -DCMAKE_BUILD_TYPE:STRING="Release" +popd + +%make_build -C %{_target_platform} + +%install +make install/fast DESTDIR=%{buildroot} -C %{_target_platform} + +%check +export PKG_CONFIG_PATH=%{buildroot}%{_libdir}/pkgconfig +test "$(pkg-config --modversion taglib)" = "%{version}" +test "$(pkg-config --modversion taglib_c)" = "%{version}" + +%ldconfig_scriptlets + +%files +%license AUTHORS COPYING.LGPL COPYING.MPL +%{_libdir}/libtag*.so.* + +%files devel +%{_bindir}/%{name}-config +%{_includedir}/%{name}/ +%{_libdir}/libtag*.so +%{_libdir}/pkgconfig/taglib*.pc + +%files help +%doc NEWS examples + + +%changelog +* Mon Sep 09 2019 openEuler Buildteam - 1.11.1-10 +- Type: enhancement +- ID: NA +- SUG: NA +- DESC: Add help package, remove bcond_without doc&test. + +* Wed Aug 21 2019 cangyi - 1.11.1-9.h2 +- Type: bugfix +- ID: NA +- SUG: NA +- DESC: format patches + +* Mon Jun 03 2019 gaoyi - 1.11.1-9.h1 +- Type: bugfix +- ID: NA +- SUG: NA +- DESC: backport CVE-2018-11439 + +* Mon Jun 03 2019 openEuler Buildteam - 1.11.1-8 +- Package init