gentoo resync : 15.12.2019

4 files changed, 117 insertions, 0 deletions

diff --git a/media-libs/libvorbis/Manifest b/media-libs/libvorbis/Manifest
index fabd783fc72a..59aa86de8362 100644
--- a/media-libs/libvorbis/Manifest
+++ b/media-libs/libvorbis/Manifest
@@ -1,3 +1,6 @@
+AUX libvorbis-1.3.6-CVE-2017-14160.patch 738 BLAKE2B 799426d01cb7a55a79e518d4014a50ba0145987a7763a797ddb8d6e29eb51af29f435858dd01b3cc24dc31989037aa8e9efb0b2ec964a713134a7e5d6359a423 SHA512 a33e36b11e868063203771b62ded24f2dbb3fa83422687e5cda4cd1f75e9c1f2012de075b688f2604f5cfc85d082e32792505fd8993727c3c6d347947e1e1a45
+AUX libvorbis-1.3.6-CVE-2018-10392.patch 728 BLAKE2B 774165f3b0483924d464289bc6ae28b774e6307c3be7b388b33ff73d52f5e77d4180648af5644e28e23abce4561d09ae0e3fe8b548e06bd0c9138a77ea555676 SHA512 294de5e0c40b64d495df7f53196260be5ffaba11c75fc4a1a54ec0c058eeba4793c1ef685c8cf866195a2972c91a7a896df5f05f478b7f25a564abb3f82f331f
 DIST libvorbis-1.3.6.tar.xz 1195388 BLAKE2B 9fc1dd125fdecb95687ea159b75cd66eed21329ec0795a3050e52e6cc58e1aac7b084ca25c4e52ca6f251ff474f6d71a716c0fbb2367beda8eb6a51a8fa9049a SHA512 a5d990bb88db2501b16f8eaee9f2ecb599cefd7dab2134d16538d8905263a972157c7671867848c2a8a358bf5e5dbc7721205ece001032482f168be7bda4f132
+EBUILD libvorbis-1.3.6-r1.ebuild 1377 BLAKE2B 1fc6bc31966d5aeb94d3b7f73dcc17c5add462df6683cf9c936b16b180686c9d695466eb608e3bc1cbab838fc9fafcb08dbe92dc3b8f1b033a6be94fa138c605 SHA512 b0f57d36f92f234fb4359202776f83698065bd8e351e439e33b0c623b2c541b5c66a3063759f6b6a512bf71faed72586de7fe871e629486a7cd9f93aa7bd742b
 EBUILD libvorbis-1.3.6.ebuild 1035 BLAKE2B c4c5e4045311b4e9ddd5f226024f7cd8e6fb1b2a02e94741612d83369594c551424c17ce953e57cb1d274a4f2a601c5e11a4eda77afb7623529c799d54366e7e SHA512 28992e302e610af02c665710cef8ae0503151aeb3a30d0a5463cb5991fb0c321001dac1179cf8065f329453a60e965f0bf04d3acab454bfd74f3b6634644ef9a
 MISC metadata.xml 329 BLAKE2B a6d5d9be9186aaf3d6735d864b6cb04bffa351cc1a1ddc13e469ca002502048e74ae672f4079626afcb89798faa4628b6b859d200b241c4d643b65ff9c23e6ca SHA512 2fde69847e03cd50deb51ecb44508c41ffbdada22e1838a4e4a6f8165f550aa107849705b666166fe5cd9b1372a76bc5c50eeadb560a76043563dfdc98ce14bf
diff --git a/media-libs/libvorbis/files/libvorbis-1.3.6-CVE-2017-14160.patch b/media-libs/libvorbis/files/libvorbis-1.3.6-CVE-2017-14160.patch
new file mode 100644
index 000000000000..7759e2eb2a6c
--- /dev/null
+++ b/media-libs/libvorbis/files/libvorbis-1.3.6-CVE-2017-14160.patch
@@ -0,0 +1,29 @@
+This is also the patch for CVE-2018-10393.
+
+From 018ca26dece618457dd13585cad52941193c4a25 Mon Sep 17 00:00:00 2001
+From: Thomas Daede <daede003@umn.edu>
+Date: Wed, 9 May 2018 14:56:59 -0700
+Subject: [PATCH] CVE-2017-14160: fix bounds check on very low sample rates.
+
+---
+ lib/psy.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/psy.c b/lib/psy.c
+index 422c6f1..1310123 100644
+--- a/lib/psy.c
++++ b/lib/psy.c
+@@ -602,8 +602,9 @@ static void bark_noise_hybridmp(int n,const long *b,
+   for (i = 0, x = 0.f;; i++, x += 1.f) {
+ 
+     lo = b[i] >> 16;
+-    if( lo>=0 ) break;
+     hi = b[i] & 0xffff;
++    if( lo>=0 ) break;
++    if( hi>=n ) break;
+ 
+     tN = N[hi] + N[-lo];
+     tX = X[hi] - X[-lo];
+-- 
+2.22.0
+
diff --git a/media-libs/libvorbis/files/libvorbis-1.3.6-CVE-2018-10392.patch b/media-libs/libvorbis/files/libvorbis-1.3.6-CVE-2018-10392.patch
new file mode 100644
index 000000000000..a12038a94235
--- /dev/null
+++ b/media-libs/libvorbis/files/libvorbis-1.3.6-CVE-2018-10392.patch
@@ -0,0 +1,25 @@
+From 112d3bd0aaacad51305e1464d4b381dabad0e88b Mon Sep 17 00:00:00 2001
+From: Thomas Daede <daede003@umn.edu>
+Date: Thu, 17 May 2018 16:19:19 -0700
+Subject: [PATCH] Sanity check number of channels in setup.
+
+Fixes #2335.
+---
+ lib/vorbisenc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/vorbisenc.c b/lib/vorbisenc.c
+index 4fc7b62..64a51b5 100644
+--- a/lib/vorbisenc.c
++++ b/lib/vorbisenc.c
+@@ -684,6 +684,7 @@ int vorbis_encode_setup_init(vorbis_info *vi){
+   highlevel_encode_setup *hi=&ci->hi;
+ 
+   if(ci==NULL)return(OV_EINVAL);
++  if(vi->channels<1||vi->channels>255)return(OV_EINVAL);
+   if(!hi->impulse_block_p)i0=1;
+ 
+   /* too low/high an ATH floater is nonsensical, but doesn't break anything */
+-- 
+2.22.0
+
diff --git a/media-libs/libvorbis/libvorbis-1.3.6-r1.ebuild b/media-libs/libvorbis/libvorbis-1.3.6-r1.ebuild
new file mode 100644
index 000000000000..92f52227407f
--- /dev/null
+++ b/media-libs/libvorbis/libvorbis-1.3.6-r1.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+inherit autotools multilib-minimal
+
+DESCRIPTION="The Ogg Vorbis sound file format library"
+HOMEPAGE="https://xiph.org/vorbis/"
+SRC_URI="https://downloads.xiph.org/releases/vorbis/${P}.tar.xz"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sh ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris"
+IUSE="static-libs test"
+
+RESTRICT="!test? ( test )"
+
+BDEPEND="virtual/pkgconfig"
+
+RDEPEND=">=media-libs/libogg-1.3.0[${MULTILIB_USEDEP}]"
+
+DEPEND="${RDEPEND}"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-CVE-2017-14160.patch
+	"${FILESDIR}"/${P}-CVE-2018-10392.patch
+)
+
+src_prepare() {
+	default
+
+	sed -i \
+		-e '/CFLAGS/s:-O20::' \
+		-e '/CFLAGS/s:-mcpu=750::' \
+		-e '/CFLAGS/s:-mno-ieee-fp::' \
+		configure.ac || die
+
+	# Un-hack docdir redefinition.
+	find -name 'Makefile.am' \
+		-exec sed -i \
+			-e 's:$(datadir)/doc/$(PACKAGE)-$(VERSION):@docdir@/html:' \
+			{} + || die
+
+	eautoreconf
+}
+
+multilib_src_configure() {
+	local myconf=(
+		--enable-shared
+		$(use_enable static-libs static)
+		$(use_enable test oggtest)
+	)
+
+	einfo "Running configure in ${BUILD_DIR}"
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name '*.la' -delete || die
+}