Fix for security #217603.

Package-Manager: portage-2.1.5_rc3

4 files changed, 67 insertions, 2 deletions

diff --git a/media-sound/vorbis-tools/ChangeLog b/media-sound/vorbis-tools/ChangeLog
index 5771f8b14e1f..0371abb3f334 100644
--- a/media-sound/vorbis-tools/ChangeLog
+++ b/media-sound/vorbis-tools/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for media-sound/vorbis-tools
 # Copyright 2002-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/media-sound/vorbis-tools/ChangeLog,v 1.72 2008/04/08 17:11:36 armin76 Exp $
+# $Header: /var/cvsroot/gentoo-x86/media-sound/vorbis-tools/ChangeLog,v 1.73 2008/04/14 13:53:58 drac Exp $
+
+*vorbis-tools-1.2.0-r1 (14 Apr 2008)
+
+  14 Apr 2008; Samuli Suominen <drac@gentoo.org>
+  +files/vorbis-tools-1.2.0-sec.patch, +vorbis-tools-1.2.0-r1.ebuild:
+  Fix for security #217603.
 
   08 Apr 2008; Raúl Porcel <armin76@gentoo.org> vorbis-tools-1.2.0.ebuild:
   ia64/sparc stable wrt #215022
diff --git a/media-sound/vorbis-tools/Manifest b/media-sound/vorbis-tools/Manifest
index 39576ac3e3d4..34255b89f0a9 100644
--- a/media-sound/vorbis-tools/Manifest
+++ b/media-sound/vorbis-tools/Manifest
@@ -1,10 +1,12 @@
 AUX vorbis-tools-1.1.1-curl-7.16.0.patch 553 RMD160 4e50e2d6314fdeea6741301ae06df0dc6d39fc8a SHA1 94d9001330216f41f254054e904b3b5b0a24ad6f SHA256 542ed708e90c805da6a29ecf1ba2e80d0eb92b7697cec6c8e651a25df521700d
 AUX vorbis-tools-1.1.1-utf8.patch 1307 RMD160 dbdd6a8394fc3cbdc4ded5ab067fdbcde15fddf1 SHA1 0689ad4e7b65fdc40117afaaa8fc153d20e7eab1 SHA256 e35ffa1b9eeadd218580dc947941b469cf886976a588425b2d53e1b98b4332f1
+AUX vorbis-tools-1.2.0-sec.patch 642 RMD160 d869da8ef8ec80d22b36cb6c0cec2cf00cdc459b SHA1 9bf63b57a2e83642d2faa7cac52ebd149589170f SHA256 169aa8bd7fd7bb6a311008fb56b5faaaa5738ac673dc866d945370db27baafce
 AUX vorbis-tools-1.2.0-with-args.patch 1175 RMD160 60149bb7e4e838b1f70674beb9c54f31e50fa4f2 SHA1 6fe1c5d2d913c6fd005642d79de99221c2dca032 SHA256 d182e0d42aa85eb78c321aa21dbc5499aa484e461b29a76b0565d9eb63f5c980
 DIST vorbis-tools-1.1.1+flac-1.1.3.tar.bz2 4119 RMD160 8da2d4bd0f65681dbbb5e71c94ca7419633dde60 SHA1 02faba6b94fe7158430b10c4a381a480688e046f SHA256 2a5f74087c10f33b0891c41b71c6c51bda21e017287dd2190019cc4546645646
 DIST vorbis-tools-1.1.1.tar.gz 948837 RMD160 ed38929b8a81f833f726e489e55e9f62d5ed69ec SHA1 a1394b39905b389d72f12c2a9f0c86a33d07a487 SHA256 617b4aa69e600c215b34fa3fd5764bc1d9d205d9d7d9fe7812bde7ec956fcaad
 DIST vorbis-tools-1.2.0.tar.gz 1076814 RMD160 8cb6925c6e4e69373b6c91ff20d7ed8d75153b7c SHA1 c5c5ee4637ab8c9fc953d203663b7264432f874a SHA256 dbe753ce0ae0797f25117720bb2ba0d848388d3f47af8db31ebc35552c3de07b
 EBUILD vorbis-tools-1.1.1-r5.ebuild 2072 RMD160 44712935b5605ce61812e206534a8f2c34e6d790 SHA1 cc6d2c338e0d759d502d04100a6d00ddbe793b01 SHA256 a37b461312279f1955d6bb6cd8cec17260dfe50f8fab5c25d313b4b35f1f8034
+EBUILD vorbis-tools-1.2.0-r1.ebuild 1222 RMD160 6b5ee2b997dda59038b44bc6af71ae8e888087fc SHA1 e0e2560c3218d9d88576e2fd7a453cef057b4adb SHA256 042addb4641ff2c0e2eb5a762fbde7ac1668600ae47f23d1b412d8ff625fce5c
 EBUILD vorbis-tools-1.2.0.ebuild 1182 RMD160 787cb3cfbd24f683c82d2a1db285ea7afec5cf93 SHA1 6cc4329136e805b43a2ae5ac08658094ad5e5c97 SHA256 38868976d0a17f67641cd7be36e81b6ff9406fd293cd120323c95d4621529d22
-MISC ChangeLog 10022 RMD160 e203da3dfb5333af182bca38964d597dfb72b5c9 SHA1 4589597994042724771e710e2e433d7a122f1a08 SHA256 25b65a0278b2ef6774f874df2f34f1d724fc0439bbcd4cdc1b0c5976f1510401
+MISC ChangeLog 10205 RMD160 c8a0b54bc9141c77373070ce11f13fdb2a9c3edd SHA1 78d80c4bb618250ca41fd3d68854571db9adf418 SHA256 5d506e6212da91170032ef89a35aaec7ed84fbb4e5fe1f9f15197a970b7e022c
 MISC metadata.xml 252 RMD160 68406e733c1a9f26b7ab37e79ab53b3f59305b3a SHA1 6e5cc1551616801a2f257d688e6fc286044c3499 SHA256 5ab00710d822d203a1a38e1b6a9754137de4fe2cf5c4e79470419ed3f3927450
diff --git a/media-sound/vorbis-tools/files/vorbis-tools-1.2.0-sec.patch b/media-sound/vorbis-tools/files/vorbis-tools-1.2.0-sec.patch
new file mode 100644
index 000000000000..75aecfcdfc04
--- /dev/null
+++ b/media-sound/vorbis-tools/files/vorbis-tools-1.2.0-sec.patch
@@ -0,0 +1,12 @@
+diff -ur vorbis-tools-1.2.0.orig/ogg123/speex_format.c vorbis-tools-1.2.0/ogg123/speex_format.c
+--- vorbis-tools-1.2.0.orig/ogg123/speex_format.c	2008-03-03 07:37:26.000000000 +0200
++++ vorbis-tools-1.2.0/ogg123/speex_format.c	2008-04-14 16:47:22.000000000 +0300
+@@ -475,7 +475,7 @@
+            cb->printf_error(callback_arg, ERROR, _("Cannot read header"));
+      return NULL;
+    }
+-   if ((*header)->mode >= SPEEX_NB_MODES) {
++   if ((*header)->mode >= SPEEX_NB_MODES || (*header)->mode < 0) {
+      cb->printf_error(callback_arg, ERROR, 
+ 		      _("Mode number %d does not (any longer) exist in this version"),
+ 	      (*header)->mode);
diff --git a/media-sound/vorbis-tools/vorbis-tools-1.2.0-r1.ebuild b/media-sound/vorbis-tools/vorbis-tools-1.2.0-r1.ebuild
new file mode 100644
index 000000000000..da9e13a77517
--- /dev/null
+++ b/media-sound/vorbis-tools/vorbis-tools-1.2.0-r1.ebuild
@@ -0,0 +1,45 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/media-sound/vorbis-tools/vorbis-tools-1.2.0-r1.ebuild,v 1.1 2008/04/14 13:53:58 drac Exp $
+
+EAPI=1
+
+inherit autotools eutils
+
+DESCRIPTION="tools for using the Ogg Vorbis sound file format"
+HOMEPAGE="http://www.vorbis.com"
+SRC_URI="http://downloads.xiph.org/releases/vorbis/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~x86-fbsd"
+IUSE="flac nls +ogg123 speex"
+
+RDEPEND=">=media-libs/libvorbis-1.1
+	flac? ( media-libs/flac )
+	ogg123? ( media-libs/libao net-misc/curl )
+	speex? ( media-libs/speex )"
+DEPEND="${RDEPEND}
+	nls? ( sys-devel/gettext )
+	dev-util/pkgconfig"
+
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+	epatch "${FILESDIR}"/${P}-with-args.patch \
+		"${FILESDIR}"/${P}-sec.patch
+	AT_M4DIR="m4" eautoreconf
+}
+
+src_compile() {
+	econf --docdir=/usr/share/doc/${PF} --enable-vcut \
+		$(use_enable nls) $(use_enable ogg123) \
+		$(use_with flac) $(use_with speex)
+	emake || die "emake failed."
+}
+
+src_install() {
+	emake DESTDIR="${D}" install || die "emake install failed."
+	dodoc AUTHORS CHANGES README
+	prepalldocs
+}