210ccaef57
Upstream libid3tag is dead since 2004 so switch to debian to get two patches that fix the following CVEs: - CVE-2004-2779: id3_utf16_deserialize() in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service (DoS). - CVE-2017-11550: The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file. - CVE-2017-11551: The id3_field_parse function in field.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (OOM) via a crafted MP3 file. Moreover, drop patch (replaced by add-m4-directory.patch debian patch) Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
35 lines
1.1 KiB
Makefile
35 lines
1.1 KiB
Makefile
################################################################################
|
|
#
|
|
# libid3tag
|
|
#
|
|
################################################################################
|
|
|
|
LIBID3TAG_VERSION = 0.15.1b
|
|
LIBID3TAG_PATCH = libid3tag_$(LIBID3TAG_VERSION)-14.debian.tar.xz
|
|
LIBID3TAG_SOURCE = libid3tag_$(LIBID3TAG_VERSION).orig.tar.gz
|
|
LIBID3TAG_SITE = \
|
|
http://snapshot.debian.org/archive/debian/20190310T213528Z/pool/main/libi/libid3tag
|
|
LIBID3TAG_LICENSE = GPL-2.0+
|
|
LIBID3TAG_LICENSE_FILES = COPYING COPYRIGHT
|
|
LIBID3TAG_INSTALL_STAGING = YES
|
|
LIBID3TAG_DEPENDENCIES = zlib
|
|
|
|
# debian/patches/10_utf16.dpatch
|
|
LIBID3TAG_IGNORE_CVES += CVE-2004-2779 CVE-2017-11551
|
|
|
|
# debian/patches/11_unknown_encoding.dpatch
|
|
LIBID3TAG_IGNORE_CVES += CVE-2017-11550
|
|
|
|
# Force autoreconf to be able to use a more recent libtool script, that
|
|
# is able to properly behave in the face of a missing C++ compiler.
|
|
LIBID3TAG_AUTORECONF = YES
|
|
|
|
define LIBID3TAG_INSTALL_STAGING_PC
|
|
$(INSTALL) -D package/libid3tag/id3tag.pc \
|
|
$(STAGING_DIR)/usr/lib/pkgconfig/id3tag.pc
|
|
endef
|
|
|
|
LIBID3TAG_POST_INSTALL_STAGING_HOOKS += LIBID3TAG_INSTALL_STAGING_PC
|
|
|
|
$(eval $(autotools-package))
|