Debian Patches

Status for mp3splt/2.6.2+20170630-3.2

Patch Description Author Forwarded Bugs Origin Last update
10_Properly-zero-initialise-the-ogg-and-vorbis-state-st.patch [PATCH] Properly zero initialise the ogg and vorbis state structs
This prevents things from exploding in flames if an error occurs and the
code tries to unwind before the codec and container initialiser functions
can all be called. It fixes the second issue indicated in CVE-2017-11333,
which isn't the fault of libvorbis, it's caused by us passing junk data
to vorbis_block_clear() when an invalid file is detected and we bail out
before vorbis_block_init() gets called.

Ideally, we should simplify all of this and get rid of most of the malloc
farm there by embedding the needed structs in splt_ogg_state (instead of
pointers to them), then just do a single malloc and memset for the whole
lot - but that would be a much more intrusive change, so for now just
ensure the allocated memory is all safely zeroed in the simplest manner.
Ron <> no 2017-09-27
20_mp3splt-gtk-0.9.2-fno-common.patch Fix build error with gcc10 David Seifert <> no debian other, 2021-01-06

All known versions for source package 'mp3splt'