From aecae8eb0797de29fa4607cbabde03843b40cc15 Mon Sep 17 00:00:00 2001 From: Vijay Anusuri Date: Fri, 17 Oct 2025 13:12:40 +0530 Subject: [PATCH] vorbis-tools: Fix CVE-2023-43361 Upstream-commits: https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/68c5a33685f5b86e7f18f239ceb8861484fee552 & https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/5bb47f58582c15c2413564b741d1d95e7b566aa8 Drop md5sum Signed-off-by: Vijay Anusuri Signed-off-by: Gyorgy Sarvari --- ...g-include-utf8.h-to-codec_skeleton.c.patch | 28 +++++++++ .../vorbis-tools/CVE-2023-43361.patch | 57 +++++++++++++++++++ .../vorbis-tools/vorbis-tools_1.4.2.bb | 3 +- 3 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 meta-multimedia/recipes-multimedia/vorbis-tools/vorbis-tools/0001-Added-missing-include-utf8.h-to-codec_skeleton.c.patch create mode 100644 meta-multimedia/recipes-multimedia/vorbis-tools/vorbis-tools/CVE-2023-43361.patch diff --git a/meta-multimedia/recipes-multimedia/vorbis-tools/vorbis-tools/0001-Added-missing-include-utf8.h-to-codec_skeleton.c.patch b/meta-multimedia/recipes-multimedia/vorbis-tools/vorbis-tools/0001-Added-missing-include-utf8.h-to-codec_skeleton.c.patch new file mode 100644 index 0000000000..db7d142543 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/vorbis-tools/vorbis-tools/0001-Added-missing-include-utf8.h-to-codec_skeleton.c.patch @@ -0,0 +1,28 @@ +From 68c5a33685f5b86e7f18f239ceb8861484fee552 Mon Sep 17 00:00:00 2001 +From: Petter Reinholdtsen +Date: Sun, 6 Apr 2025 07:53:53 +0200 +Subject: [PATCH] Added missing include "utf8.h" to codec_skeleton.c. + +Patch from Sebastian Ramacher and Debian. + +Upstream-Status: Backport [https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/68c5a33685f5b86e7f18f239ceb8861484fee552] +Signed-off-by: Vijay Anusuri +--- + ogginfo/codec_skeleton.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/ogginfo/codec_skeleton.c b/ogginfo/codec_skeleton.c +index a27f8da..0709860 100644 +--- a/ogginfo/codec_skeleton.c ++++ b/ogginfo/codec_skeleton.c +@@ -25,6 +25,7 @@ + #include + + #include "i18n.h" ++#include "utf8.h" + + #include "private.h" + +-- +GitLab + diff --git a/meta-multimedia/recipes-multimedia/vorbis-tools/vorbis-tools/CVE-2023-43361.patch b/meta-multimedia/recipes-multimedia/vorbis-tools/vorbis-tools/CVE-2023-43361.patch new file mode 100644 index 0000000000..69286907fa --- /dev/null +++ b/meta-multimedia/recipes-multimedia/vorbis-tools/vorbis-tools/CVE-2023-43361.patch @@ -0,0 +1,57 @@ +From 5bb47f58582c15c2413564b741d1d95e7b566aa8 Mon Sep 17 00:00:00 2001 +From: Ralph Giles +Date: Sun, 17 Sep 2023 11:49:12 -0700 +Subject: [PATCH] oggenc: Don't assume the output path ends in a file name. + +oggenc attempts to create any specified directories in the output +file path if they don't exist. The parser was assuming there was +a final filename after the last directory separator, and so would +try to read off the end of the argument if it was a bare directory +such as `./` or `outdir/`. It also did not handle more than one +consecutive separator. This corrects both issues. + +Thanks to Frank-Z7 (Zeng Yunxiang) at Huazhong University of Science +and Technology (cse.hust.edu.cn) for the report. + +Fixes CVE-2023-43361. + +Upstream-Status: Backport [https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/5bb47f58582c15c2413564b741d1d95e7b566aa8] +CVE: CVE-2023-43361 +Signed-off-by: Vijay Anusuri +--- + oggenc/platform.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/oggenc/platform.c b/oggenc/platform.c +index 6d9f4ef..d50ad99 100644 +--- a/oggenc/platform.c ++++ b/oggenc/platform.c +@@ -136,18 +136,22 @@ int create_directories(char *fn, int isutf8) + { + char *end, *start; + struct stat statbuf; +- char *segment = malloc(strlen(fn)+1); ++ const size_t fn_len = strlen(fn); ++ char *segment = malloc(fn_len+1); + #ifdef _WIN32 + wchar_t seg[MAX_PATH+1]; + #endif + + start = fn; + #ifdef _WIN32 +- if(strlen(fn) >= 3 && isalpha(fn[0]) && fn[1]==':') ++ // Strip drive prefix ++ if(fn_len >= 3 && isalpha(fn[0]) && fn[1]==':') { + start = start+2; ++ } + #endif + +- while((end = strpbrk(start+1, PATH_SEPS)) != NULL) ++ // Loop through path segments, creating directories if necessary ++ while((end = strpbrk(start + strspn(start, PATH_SEPS), PATH_SEPS)) != NULL) + { + int rv; + memcpy(segment, fn, end-fn); +-- +GitLab + diff --git a/meta-multimedia/recipes-multimedia/vorbis-tools/vorbis-tools_1.4.2.bb b/meta-multimedia/recipes-multimedia/vorbis-tools/vorbis-tools_1.4.2.bb index 290162127f..33a212de8e 100644 --- a/meta-multimedia/recipes-multimedia/vorbis-tools/vorbis-tools_1.4.2.bb +++ b/meta-multimedia/recipes-multimedia/vorbis-tools/vorbis-tools_1.4.2.bb @@ -12,9 +12,10 @@ DEPENDS = "libogg libvorbis" SRC_URI = "http://downloads.xiph.org/releases/vorbis/${BP}.tar.gz \ file://gettext.patch \ + file://0001-Added-missing-include-utf8.h-to-codec_skeleton.c.patch \ + file://CVE-2023-43361.patch \ " -SRC_URI[md5sum] = "998fca293bd4e4bdc2b96fb70f952f4e" SRC_URI[sha256sum] = "db7774ec2bf2c939b139452183669be84fda5774d6400fc57fde37f77624f0b0" inherit autotools pkgconfig gettext