Per [1] this CVE is already patched by commit [2].
This can be also verified with yocto build.
Running without this patch:
root@qemux86-64:~# sfconvert poc.wav output format wave
malloc(): corrupted top size
Aborted
Running with it:
root@qemux86-64:~# sfconvert poc.wav output format wave
Audio File Library: Bad number of coefficients [error 62]
Could not open file 'poc.wav' for reading.
[1] https://github.com/mpruett/audiofile/issues/56
[2] c48e4c6503
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 68f55c158e15a5d35702ae5c730586001e487f86)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details:
https://nvd.nist.gov/vuln/detail/CVE-2018-13440https://nvd.nist.gov/vuln/detail/CVE-2018-17059
The patches have been backported from Debian - upstream
has been inactive for almost a decade by now.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e16a7d11d1dc0c577cb17652085b0c183c791883)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2019-13147https://nvd.nist.gov/vuln/detail/CVE-2022-24599
These patches are used by opensuse to mitigate the corresponding vulnerabulities.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8ef997336aec6f51318f1a7fa55d57e3990914e8)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
There is new patch-status QA check in oe-core:
https://git.openembedded.org/openembedded-core/commit/?id=76a685bfcf927593eac67157762a53259089ea8a
This is temporary work around just to hide _many_ warnings from
optional patch-status (if you add it to WARN_QA).
This just added
Upstream-Status: Pending
everywhere without actually investigating what's the proper status.
This is just to hide current QA warnings and to catch new .patch files being
added without Upstream-Status, but the number of Pending patches is now terrible:
5 (26%) meta-xfce
6 (50%) meta-perl
15 (42%) meta-webserver
21 (36%) meta-gnome
25 (57%) meta-filesystems
26 (43%) meta-initramfs
45 (45%) meta-python
47 (55%) meta-multimedia
312 (63%) meta-networking
756 (61%) meta-oe
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
It uses std::unary_function which is removed from c++17 onwards, until
this is removed/replaced we can not move beyond c++14
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Fixes build with musl
../audiofile-0.3.6/configure: line 16964: PKG_PROG_PKG_CONFIG: command not found
../audiofile-0.3.6/configure: line 16971: syntax error near unexpected token `FLAC,'
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
License checksum changed by altering address of FSF
Signed-off-by: Andreas Müller <schnitzeltony@googlemail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Fixed SRC_URI:
* ${PN} -> ${BPN}, use ${BP} if it was ${PN}-${PV}
* ${P} -> ${BP}
Otherwise we would meet do_fetch errors when we do the multilib, native
or nativesdk build.
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* Remove all PR = "r0" from all .bb files in meta-oe repo. This was done
with the command sed -e '/^PR.*=.*r0\"/d' meta*/recipes*/*/*.bb -i
* We've switching to the PR server, PR bumps are no longer needed and
this saves people either accidentally bumping them or forgetting to
remove the lines (r0 is the default anyway).
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
In this way meta-oe recipes will be parsed correctly in yocto.
Signed-off-by: Andrei Gherzan <andrei@gherzan.ro>
Signed-off-by: Koen Kooi <koen@dominion.thruhere.net>
0.2.7 fixes various bugs of 0.2.6 and adds further support for WAVE and AIFF-C
formats.
Drop patches:
* CVE-2008-5824 is already fixed in 0.2.7 (patch has just been a workaround):
e8cf0095b3
* oldstyle patch is not needed , since current toolchain compiles C files
with old style function declarations
* audiofile-0.2.6 patch is already applied in 0.2.7
* audiofile-m4_quote_fix is already applied in 0.2.7
Signed-off-by: Michael Lippautz <michael.lippautz@gmail.com>
