mirror of
https://git.yoctoproject.org/poky
synced 2026-06-02 01:19:52 +00:00
Tanu Kaskinen
d748513116
Prevent out-of-bounds write in codebook decoding. The bug could allow code execution from a specially crafted Ogg Vorbis file. References: https://www.debian.org/security/2018/dsa-4140 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5146 (From OE-Core rev: 5c880fe974907195c563b5580cb43b3b2fb92203) Signed-off-by: Tanu Kaskinen <tanuk@iki.fi> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
23 lines
942 B
BlitzBasic
23 lines
942 B
BlitzBasic
SUMMARY = "Ogg Vorbis Audio Codec"
|
|
DESCRIPTION = "Ogg Vorbis is a high-quality lossy audio codec \
|
|
that is free of intellectual property restrictions. libvorbis \
|
|
is the main vorbis codec library."
|
|
HOMEPAGE = "http://www.vorbis.com/"
|
|
BUGTRACKER = "https://trac.xiph.org"
|
|
SECTION = "libs"
|
|
LICENSE = "BSD"
|
|
LIC_FILES_CHKSUM = "file://COPYING;md5=7d2c487d2fc7dd3e3c7c465a5b7f6217 \
|
|
file://include/vorbis/vorbisenc.h;beginline=1;endline=11;md5=d1c1d138863d6315131193d4046d81cb"
|
|
DEPENDS = "libogg"
|
|
|
|
SRC_URI = "http://downloads.xiph.org/releases/vorbis/${BP}.tar.xz \
|
|
file://0001-configure-Check-for-clang.patch \
|
|
file://CVE-2017-14633.patch \
|
|
file://CVE-2017-14632.patch \
|
|
file://CVE-2018-5146.patch \
|
|
"
|
|
SRC_URI[md5sum] = "28cb28097c07a735d6af56e598e1c90f"
|
|
SRC_URI[sha256sum] = "54f94a9527ff0a88477be0a71c0bab09a4c3febe0ed878b24824906cd4b0e1d1"
|
|
|
|
inherit autotools pkgconfig
|