- added fseek-sec patch (arbitrary code execution through wave file)

- release 4, STBR to ra/updates/security

Changed files:
    bladeenc-fseek-sec.patch -> 1.1
    bladeenc.spec -> 1.37

diff --git a/bladeenc-fseek-sec.patch b/bladeenc-fseek-sec.patch
new file mode 100644 (file)
index 0000000..e04e4c2
--- /dev/null
+++ b/bladeenc-fseek-sec.patch
@@ -0,0 +1,29 @@
+--- bladeenc-0.94.2/bladeenc/samplein.c.orig   Tue May  8 14:11:53 2001
++++ bladeenc-0.94.2/bladeenc/samplein.c        Mon Feb  3 20:47:55 2003
+@@ -75,7 +75,7 @@
+ static        int                             initAIFF (SI_Stream *psInfo);
+ static        uint                    readAIFFSamples (SI_Stream *psInfo, int nSamples, short *wpSamples);
+ 
+-static        int                             myFseek (FILE *fp, int offset);
++static        int                             myFseek (FILE *fp, unsigned int offset);
+ 
+ 
+ 
+@@ -332,6 +332,8 @@
+               {
+                       if (fread (aTemp, sizeof(sFmtChunk), 1, psInfo->fp) != 1)
+                               goto unexpEndOfFile;
++                      if (intlLong(&header[4]) < sizeof(sFmtChunk))
++                              goto unexpEndOfFile; /* I can't find "corrupted file" error code */
+                       myFseek (psInfo->fp, intlLong(&header[4]) - sizeof(sFmtChunk));
+                       fFmtChunkFound = TRUE;
+               }
+@@ -613,7 +615,7 @@
+ 
+ /* We can't use the real fseek() since you can't seek in a stream (stdin) */
+ 
+-static int                                    myFseek (FILE *fp, int offset)
++static int                                    myFseek (FILE *fp, unsigned int offset)
+ {
+       char                                    dummy[256];
+ 

diff --git a/bladeenc.spec b/bladeenc.spec
index 14d7aefd801dd607f0f3bde5cd19406a489c9150..e5bb53790a9e747ecbc039c0040584a2a084a502 100644 (file)
--- a/bladeenc.spec
+++ b/bladeenc.spec
@@ -1,13 +1,14 @@
 Summary:       Blade's MP3 Encoder
-Summary(pl):   Encoder MP3 Blade'a
+Summary(pl):   Koder MP3 Blade'a
 Name:          bladeenc
 Version:       0.94.2
-Release:       3
+Release:       4
 Epoch:         1
 License:       GPL
 Vendor:                Tord Jansson <tord.jansson@swipnet.se>
 Group:         Applications/Sound
 Source0:       http://bladeenc.mp3.no/source/%{name}-%{version}-src-stable.tar.gz
+Patch0:                %{name}-fseek-sec.patch
 URL:           http://bladeenc.mp3.no/
 BuildRequires: autoconf
 BuildRequires: automake
@@ -24,6 +25,7 @@ d
 
 %prep
 %setup -q
+%patch -p1
 
 %build
 %{__aclocal}