| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 10_Properly-zero-initialise-the-ogg-and-vorbis-state-st.patch | [PATCH] Properly zero initialise the ogg and vorbis state structs This prevents things from exploding in flames if an error occurs and the code tries to unwind before the codec and container initialiser functions can all be called. It fixes the second issue indicated in CVE-2017-11333, which isn't the fault of libvorbis, it's caused by us passing junk data to vorbis_block_clear() when an invalid file is detected and we bail out before vorbis_block_init() gets called. Ideally, we should simplify all of this and get rid of most of the malloc farm there by embedding the needed structs in splt_ogg_state (instead of pointers to them), then just do a single malloc and memset for the whole lot - but that would be a much more intrusive change, so for now just ensure the allocated memory is all safely zeroed in the simplest manner. |
Ron <ron@debian.org> | no | 2017-09-27 | ||
| 20_mp3splt-gtk-0.9.2-fno-common.patch | Fix build error with gcc10 | David Seifert <soap@gentoo.org> | no | debian | other, https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=500f9cbf8e5c576c893077ca6b3952cbee1b728d | 2021-01-06 |