diff options
Diffstat (limited to 'poky/meta/recipes-support/taglib')
-rw-r--r-- | poky/meta/recipes-support/taglib/taglib/CVE-2017-12678.patch | 40 | ||||
-rw-r--r-- | poky/meta/recipes-support/taglib/taglib_1.11.1.bb | 43 |
2 files changed, 83 insertions, 0 deletions
diff --git a/poky/meta/recipes-support/taglib/taglib/CVE-2017-12678.patch b/poky/meta/recipes-support/taglib/taglib/CVE-2017-12678.patch new file mode 100644 index 000000000..4bd9f2be1 --- /dev/null +++ b/poky/meta/recipes-support/taglib/taglib/CVE-2017-12678.patch @@ -0,0 +1,40 @@ +From eb9ded1206f18f2c319157337edea2533a40bea6 Mon Sep 17 00:00:00 2001 +From: "Stephen F. Booth" <me@sbooth.org> +Date: Sun, 23 Jul 2017 10:11:09 -0400 +Subject: [PATCH] Don't assume TDRC is an instance of TextIdentificationFrame + +If TDRC is encrypted, FrameFactory::createFrame() returns UnknownFrame +which causes problems in rebuildAggregateFrames() when it is assumed +that TDRC is a TextIdentificationFrame + +Upstream-Status: Backport +[https://github.com/taglib/taglib/pull/831/commits/eb9ded1206f18f2c319157337edea2533a40bea6] + +CVE: CVE-2017-12678 + +Signed-off-by: Yi Zhao <yi.zhao@windriver.com> +--- + taglib/mpeg/id3v2/id3v2framefactory.cpp | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/taglib/mpeg/id3v2/id3v2framefactory.cpp b/taglib/mpeg/id3v2/id3v2framefactory.cpp +index 759a9b7b..9347ab86 100644 +--- a/taglib/mpeg/id3v2/id3v2framefactory.cpp ++++ b/taglib/mpeg/id3v2/id3v2framefactory.cpp +@@ -334,10 +334,11 @@ void FrameFactory::rebuildAggregateFrames(ID3v2::Tag *tag) const + tag->frameList("TDAT").size() == 1) + { + TextIdentificationFrame *tdrc = +- static_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front()); ++ dynamic_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front()); + UnknownFrame *tdat = static_cast<UnknownFrame *>(tag->frameList("TDAT").front()); + +- if(tdrc->fieldList().size() == 1 && ++ if(tdrc && ++ tdrc->fieldList().size() == 1 && + tdrc->fieldList().front().size() == 4 && + tdat->data().size() >= 5) + { +-- +2.13.5 + diff --git a/poky/meta/recipes-support/taglib/taglib_1.11.1.bb b/poky/meta/recipes-support/taglib/taglib_1.11.1.bb new file mode 100644 index 000000000..50439bc14 --- /dev/null +++ b/poky/meta/recipes-support/taglib/taglib_1.11.1.bb @@ -0,0 +1,43 @@ +SUMMARY = "Library for reading and editing the meta-data of popular audio formats" +SECTION = "libs/multimedia" +HOMEPAGE = "http://taglib.github.io/" +LICENSE = "LGPLv2.1 | MPL-1" +LIC_FILES_CHKSUM = "file://COPYING.LGPL;md5=4fbd65380cdd255951079008b364516c \ + file://COPYING.MPL;md5=bfe1f75d606912a4111c90743d6c7325 \ + file://taglib/audioproperties.h;beginline=1;endline=24;md5=9df2c7399519b7310568a7c55042ecee" + +DEPENDS = "zlib" + +SRC_URI = "http://taglib.github.io/releases/${BP}.tar.gz \ + file://CVE-2017-12678.patch \ + " + +SRC_URI[md5sum] = "cee7be0ccfc892fa433d6c837df9522a" +SRC_URI[sha256sum] = "b6d1a5a610aae6ff39d93de5efd0fdc787aa9e9dc1e7026fa4c961b26563526b" + +UPSTREAM_CHECK_URI = "http://github.com/taglib/taglib/releases/" + +BINCONFIG = "${bindir}/taglib-config" + +inherit cmake pkgconfig binconfig-disabled + +PACKAGES =+ "${PN}-c" +FILES_${PN}-c = "${libdir}/libtag_c.so.*" + +EXTRA_OECMAKE = "-DBUILD_SHARED_LIBS=ON \ + -DCMAKE_DISABLE_FIND_PACKAGE_Boost=TRUE \ + -DHAVE_BOOST_BYTESWAP=FALSE \ + -DCMAKE_CXX_STANDARD=11 \ + -DCMAKE_CXX_STANDARD_REQUIRED=OFF \ + -DLIB_SUFFIX=${@d.getVar('baselib').replace('lib', '')} \ +" +CXXFLAGS += "-std=c++11" + +do_configure_prepend () { + rm -f ${S}/admin/ltmain.sh + rm -f ${S}/admin/libtool.m4.in +} + +# without -fPIC depending packages failed with many error like: +# | <...>/ld: error: <...>/usr/lib/libtag.a(modfilebase.cpp.o): requires unsupported dynamic reloc R_ARM_THM_MOVW_ABS_NC; recompile with -fPIC +CXXFLAGS += "-fPIC" |