From a8e149434eb1500026256747b4ed21b8bab95926 Mon Sep 17 00:00:00 2001 From: Hartmut Goebel Date: Sat, 7 Dec 2019 13:22:04 +0100 Subject: gnu: Add audiofile. Patches should fix all CVEs reported by `guix lint`: CVE-2015-7747; CVE-2017-6827, CVE-2017-6828, CVE-2017-6829, CVE-2017-6830, CVE-2017-6831, CVE-2017-6832, CVE-2017-6833, CVE-2017-6834, CVE-2017-6835, CVE-2017-6836, CVE-2017-6837, CVE-2017-6838, CVE-2017-6839; CVE-2018-13440; CVE-2018-17095 Since the patches do not reference to CVEs, it's a bit hard to tell which patch actually closes which CVE. Debian reports all these to be closed by the patches below and NixPkgs provides references. * gnu/packages/audio.scm (audiofile): New variable. * gnu/packages/patches/audiofile-fix-datatypes-in-tests.patch, gnu/packages/patches/audiofile-fix-sign-conversion.patch, gnu/packages/patches/audiofile-CVE-2015-7747.patch, gnu/packages/patches/audiofile-CVE-2018-13440.patch, gnu/packages/patches/audiofile-CVE-2018-17095.patch, gnu/packages/patches/audiofile-Check-the-number-of-coefficients.patch, gnu/packages/patches/audiofile-Fail-on-error-in-parseFormat.patch, gnu/packages/patches/audiofile-Fix-index-overflow-in-IMA.cpp.patch, gnu/packages/patches/audiofile-Fix-multiply-overflow-sfconvert.patch, gnu/packages/patches/audiofile-Fix-overflow-in-MSADPCM-decodeSam.patch, gnu/packages/patches/audiofile-division-by-zero-BlockCodec-runPull.patch, gnu/packages/patches/audiofile-hurd.patch, gnu/packages/patches/audiofile-signature-of-multiplyCheckOverflow.patch: New files. * gnu/local.mk: Add them. --- gnu/packages/audio.scm | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) (limited to 'gnu/packages/audio.scm') diff --git a/gnu/packages/audio.scm b/gnu/packages/audio.scm index 87d6947657..76c59f33cc 100644 --- a/gnu/packages/audio.scm +++ b/gnu/packages/audio.scm @@ -26,6 +26,7 @@ ;;; Copyright © 2019 Alexandros Theodotou ;;; Copyright © 2019 Christopher Lemmer Webber ;;; Copyright © 2019 Jan Wielkiewicz +;;; Copyright © 2019 Hartmt Goebel ;;; ;;; This file is part of GNU Guix. ;;; @@ -467,6 +468,54 @@ and editing digital audio. It features digital effects and spectrum analysis tools.") (license license:gpl2+))) +(define-public audiofile + (package + (name "audiofile") + (version "0.3.6") + (source + (origin + (method url-fetch) + (uri (string-append + "https://audiofile.68k.org/audiofile-" version ".tar.gz")) + (sha256 + (base32 "0rb927zknk9kmhprd8rdr4azql4gn2dp75a36iazx2xhkbqhvind")) + (patches + ;; CVE references according to nixpgs + (search-patches + "audiofile-fix-datatypes-in-tests.patch" + "audiofile-fix-sign-conversion.patch" + "audiofile-hurd.patch" + "audiofile-CVE-2015-7747.patch" + ;; CVE-2017-6829: + "audiofile-Fix-index-overflow-in-IMA.cpp.patch" + ;; CVE-2017-6827, CVE-2017-6828, CVE-2017-6832, CVE-2017-6835, + ;; CVE-2017-6837: + "audiofile-Check-the-number-of-coefficients.patch" + ;; CVE-2017-6839: + "audiofile-Fix-overflow-in-MSADPCM-decodeSam.patch" + ;; CVE-2017-6830, CVE-2017-6834, CVE-2017-6836, CVE-2017-6838: + "audiofile-Fix-multiply-overflow-sfconvert.patch" + "audiofile-signature-of-multiplyCheckOverflow.patch" + ;; CVE-2017-6831: + "audiofile-Fail-on-error-in-parseFormat.patch" + ;; CVE-2017-6833: + "audiofile-division-by-zero-BlockCodec-runPull.patch" + "audiofile-CVE-2018-13440.patch" + "audiofile-CVE-2018-17095.patch")))) + (build-system gnu-build-system) + (inputs + `(("alsa-lib" ,alsa-lib))) + (home-page "https://audiofile.68k.org/") + (synopsis "Library to handle various audio file formats") + (description "This is an open-source version of SGI's audiofile library. +It provides a uniform programming interface for processing of audio data to +and from audio files of many common formats. + +Currently supported file formats include AIFF/AIFF-C, WAVE, and NeXT/Sun +.snd/.au, BICS, and raw data. Supported compression formats are currently +G.711 mu-law and A-law.") + (license license:lgpl2.1+))) + (define-public autotalent (package (name "autotalent") -- cgit v1.2.3