Return to patch-CVE-2017-12678 CVS log

Up to [cvs.NetBSD.org] / pkgsrc / audio / taglib / patches

Pullup ticket #6005 - requested by nia
audio/taglib: security fix

Revisions pulled up:
- audio/taglib/Makefile                                         1.40
- audio/taglib/distinfo                                         1.22
- audio/taglib/patches/patch-CVE-2017-12678                     1.1
- audio/taglib/patches/patch-CVE-2018-11439                     1.1

---
   Module Name:	pkgsrc
   Committed By:	nia
   Date:		Thu Jul 18 09:36:37 UTC 2019

   Modified Files:
   	pkgsrc/audio/taglib: Makefile distinfo
   Added Files:
   	pkgsrc/audio/taglib/patches: patch-CVE-2017-12678 patch-CVE-2018-11439

   Log Message:
   taglib: Add patches from upstream's git for the following CVEs:

   CVE-2017-12678 - denial-of-service
   CVE-2018-11439 - information-disclosure

   Bump PKGREVISION.

$NetBSD: patch-CVE-2017-12678,v 1.1.2.2 2019/07/18 13:33:53 bsiegert Exp $

Fix CVE-2017-12678

In TagLib 1.11.1, the rebuildAggregateFrames function in id3v2framefactory.cpp
has a pointer to cast vulnerability, which allows remote attackers to cause a
denial of service or possibly have unspecified other impact via a crafted
audio file. 

Upstream commit:
https://github.com/taglib/taglib/commit/cb9f07d9dcd791b63e622da43f7b232adaec0a9a

--- taglib/mpeg/id3v2/id3v2framefactory.cpp.orig	2016-10-24 03:03:23.000000000 +0000
+++ taglib/mpeg/id3v2/id3v2framefactory.cpp
@@ -334,10 +334,11 @@ void FrameFactory::rebuildAggregateFrame
      tag->frameList("TDAT").size() == 1)
   {
     TextIdentificationFrame *tdrc =
-      static_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front());
+      dynamic_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front());
     UnknownFrame *tdat = static_cast<UnknownFrame *>(tag->frameList("TDAT").front());
 
-    if(tdrc->fieldList().size() == 1 &&
+    if(tdrc &&
+       tdrc->fieldList().size() == 1 &&
        tdrc->fieldList().front().size() == 4 &&
        tdat->data().size() >= 5)
     {