From c3a170040146210b23058a52fe5a6c09568eed17 Mon Sep 17 00:00:00 2001 From: 4fury-c3440d8 Date: Tue, 15 Sep 2020 10:58:55 +0300 Subject: [PATCH] yarock, taglib, sayonara. --- multimedia/misc/taglib/actions.py | 10 +- .../misc/taglib/files/CVE-2017-12678.patch | 30 +++ .../misc/taglib/files/CVE-2018-11439.patch | 41 ++++ .../taglib/files/fix_ogg_corruption.patch | 22 ++ .../misc/taglib/files/taglib-1.4_wchar.diff | 31 --- multimedia/misc/taglib/pspec.xml | 26 ++- multimedia/sound/sayonara/actions.py | 10 +- multimedia/sound/sayonara/pspec.xml | 81 ++++---- multimedia/sound/sayonara/translations.xml | 4 +- multimedia/sound/yarock/actions.py | 46 ++--- multimedia/sound/yarock/pspec.xml | 192 +++++++++--------- 11 files changed, 275 insertions(+), 218 deletions(-) create mode 100644 multimedia/misc/taglib/files/CVE-2017-12678.patch create mode 100644 multimedia/misc/taglib/files/CVE-2018-11439.patch create mode 100644 multimedia/misc/taglib/files/fix_ogg_corruption.patch delete mode 100644 multimedia/misc/taglib/files/taglib-1.4_wchar.diff diff --git a/multimedia/misc/taglib/actions.py b/multimedia/misc/taglib/actions.py index 05c1d7696f..e21c9c7d57 100644 --- a/multimedia/misc/taglib/actions.py +++ b/multimedia/misc/taglib/actions.py @@ -2,7 +2,7 @@ # -*- coding: utf-8 -*- # # Licensed under the GNU General Public License, version 3. -# See the file http://www.gnu.org/licenses/gpl.txt +# See the file https://www.gnu.org/licenses/gpl-3.0.txt from pisi.actionsapi import cmaketools from pisi.actionsapi import pisitools @@ -10,13 +10,13 @@ from pisi.actionsapi import get def setup(): cmaketools.configure("-DBUILD_SHARED_LIBS=ON \ - -DWITH_MP4=ON \ - -DWITH_ASF=ON") + -DWITH_MP4=ON \ + -DWITH_ASF=ON") def build(): cmaketools.make() def install(): - cmaketools.rawInstall("DESTDIR=%s" % get.installDIR()) + cmaketools.rawInstall("DESTDIR=%s" % get.installDIR()) - pisitools.dodoc("AUTHORS","COPYING*") + pisitools.dodoc("AUTHORS","COPYING*") diff --git a/multimedia/misc/taglib/files/CVE-2017-12678.patch b/multimedia/misc/taglib/files/CVE-2017-12678.patch new file mode 100644 index 0000000000..4b567da198 --- /dev/null +++ b/multimedia/misc/taglib/files/CVE-2017-12678.patch @@ -0,0 +1,30 @@ +From eb9ded1206f18f2c319157337edea2533a40bea6 Mon Sep 17 00:00:00 2001 +From: "Stephen F. Booth" +Date: Sun, 23 Jul 2017 10:11:09 -0400 +Subject: [PATCH] Don't assume TDRC is an instance of TextIdentificationFrame + +If TDRC is encrypted, FrameFactory::createFrame() returns UnknownFrame +which causes problems in rebuildAggregateFrames() when it is assumed +that TDRC is a TextIdentificationFrame +--- + taglib/mpeg/id3v2/id3v2framefactory.cpp | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/taglib/mpeg/id3v2/id3v2framefactory.cpp b/taglib/mpeg/id3v2/id3v2framefactory.cpp +index 759a9b7be..9347ab869 100644 +--- a/taglib/mpeg/id3v2/id3v2framefactory.cpp ++++ b/taglib/mpeg/id3v2/id3v2framefactory.cpp +@@ -334,10 +334,11 @@ void FrameFactory::rebuildAggregateFrames(ID3v2::Tag *tag) const + tag->frameList("TDAT").size() == 1) + { + TextIdentificationFrame *tdrc = +- static_cast(tag->frameList("TDRC").front()); ++ dynamic_cast(tag->frameList("TDRC").front()); + UnknownFrame *tdat = static_cast(tag->frameList("TDAT").front()); + +- if(tdrc->fieldList().size() == 1 && ++ if(tdrc && ++ tdrc->fieldList().size() == 1 && + tdrc->fieldList().front().size() == 4 && + tdat->data().size() >= 5) + { diff --git a/multimedia/misc/taglib/files/CVE-2018-11439.patch b/multimedia/misc/taglib/files/CVE-2018-11439.patch new file mode 100644 index 0000000000..17c3d630c0 --- /dev/null +++ b/multimedia/misc/taglib/files/CVE-2018-11439.patch @@ -0,0 +1,41 @@ +From 272648ccfcccae30e002ccf34a22e075dd477278 Mon Sep 17 00:00:00 2001 +From: Scott Gayou +Date: Mon, 4 Jun 2018 11:34:36 -0400 +Subject: [PATCH] Fixed OOB read when loading invalid ogg flac file. (#868) + +CVE-2018-11439 is caused by a failure to check the minimum length +of a ogg flac header. This header is detailed in full at: +https://xiph.org/flac/ogg_mapping.html. Added more strict checking +for entire header. +--- + taglib/ogg/flac/oggflacfile.cpp | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/taglib/ogg/flac/oggflacfile.cpp b/taglib/ogg/flac/oggflacfile.cpp +index 53d04508a..07ea9dccc 100644 +--- a/taglib/ogg/flac/oggflacfile.cpp ++++ b/taglib/ogg/flac/oggflacfile.cpp +@@ -231,11 +231,21 @@ void Ogg::FLAC::File::scan() + + if(!metadataHeader.startsWith("fLaC")) { + // FLAC 1.1.2+ ++ // See https://xiph.org/flac/ogg_mapping.html for the header specification. ++ if(metadataHeader.size() < 13) ++ return; ++ ++ if(metadataHeader[0] != 0x7f) ++ return; ++ + if(metadataHeader.mid(1, 4) != "FLAC") + return; + +- if(metadataHeader[5] != 1) +- return; // not version 1 ++ if(metadataHeader[5] != 1 && metadataHeader[6] != 0) ++ return; // not version 1.0 ++ ++ if(metadataHeader.mid(9, 4) != "fLaC") ++ return; + + metadataHeader = metadataHeader.mid(13); + } diff --git a/multimedia/misc/taglib/files/fix_ogg_corruption.patch b/multimedia/misc/taglib/files/fix_ogg_corruption.patch new file mode 100644 index 0000000000..f204d0b4d2 --- /dev/null +++ b/multimedia/misc/taglib/files/fix_ogg_corruption.patch @@ -0,0 +1,22 @@ +From 9336c82da3a04552168f208cd7a5fa4646701ea4 Mon Sep 17 00:00:00 2001 +From: Tsuda Kageyu +Date: Thu, 1 Dec 2016 11:32:01 +0900 +Subject: [PATCH] Fix possible Ogg packet losses. + +--- + taglib/ogg/oggfile.cpp | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/taglib/ogg/oggfile.cpp b/taglib/ogg/oggfile.cpp +index 86b0b0764..c36e4d46c 100644 +--- a/taglib/ogg/oggfile.cpp ++++ b/taglib/ogg/oggfile.cpp +@@ -253,7 +253,7 @@ void Ogg::File::writePacket(unsigned int i, const ByteVector &packet) + ByteVectorList packets = firstPage->packets(); + packets[i - firstPage->firstPacketIndex()] = packet; + +- if(firstPage != lastPage && lastPage->packetCount() > 2) { ++ if(firstPage != lastPage && lastPage->packetCount() > 1) { + ByteVectorList lastPagePackets = lastPage->packets(); + lastPagePackets.erase(lastPagePackets.begin()); + packets.append(lastPagePackets); diff --git a/multimedia/misc/taglib/files/taglib-1.4_wchar.diff b/multimedia/misc/taglib/files/taglib-1.4_wchar.diff deleted file mode 100644 index b84a61401f..0000000000 --- a/multimedia/misc/taglib/files/taglib-1.4_wchar.diff +++ /dev/null @@ -1,31 +0,0 @@ -diff -ruN taglib-1.4.org/taglib/toolkit/tstring.cpp taglib-1.4/taglib/toolkit/tstring.cpp ---- taglib-1.4.org/taglib/toolkit/tstring.cpp 2005-07-26 06:31:15.000000000 +0900 -+++ taglib-1.4/taglib/toolkit/tstring.cpp 2006-05-26 12:02:55.000000000 +0900 -@@ -202,12 +202,22 @@ - s.resize(d->data.size()); - - if(!unicode) { -- std::string::iterator targetIt = s.begin(); -- for(wstring::const_iterator it = d->data.begin(); it != d->data.end(); it++) { -- *targetIt = char(*it); -- ++targetIt; -+ bool cjk = false; -+ //pre-scan: is there any cjk unicode character? if so, convert the string into utf-8. -+ for(unsigned int i=0; i< d->data.size(); i++){ -+ if(d->data[i] > 0xff){ -+ cjk = true; -+ break; -+ } -+ } -+ if(!cjk){ -+ std::string::iterator targetIt = s.begin(); -+ for(wstring::const_iterator it = d->data.begin(); it != d->data.end(); it++) { -+ *targetIt = char(*it); -+ ++targetIt; -+ } -+ return s; - } -- return s; - } - - const int outputBufferSize = d->data.size() * 3 + 1; diff --git a/multimedia/misc/taglib/pspec.xml b/multimedia/misc/taglib/pspec.xml index b592a5eab3..5e51163ccd 100644 --- a/multimedia/misc/taglib/pspec.xml +++ b/multimedia/misc/taglib/pspec.xml @@ -1,9 +1,9 @@ - + taglib - http://developer.kde.org/~wheeler/taglib.html + https://taglib.org/ Stefan Gronewold(groni) groni@pisilinux.org @@ -12,12 +12,17 @@ library A library for reading and editing audio meta data TagLib is a library for reading and editing the meta data of several popular audio formats. - http://taglib.org/releases/taglib-1.11.1.tar.gz + https://taglib.org/releases/taglib-1.11.1.tar.gz cmake - boost-devel zlib-devel - + boost-devel + + + CVE-2017-12678.patch + CVE-2017-11439.patch + fix_ogg_corruption.patch + @@ -25,10 +30,10 @@ zlib libgcc - + - /usr/lib /usr/bin + /usr/lib /usr/share/doc @@ -46,6 +51,13 @@ + + 2020-09-15 + 1.11.1 + Rebuild. + Pisi Linux Community + admin@pisilinux.org + 2020-01-19 1.11.1 diff --git a/multimedia/sound/sayonara/actions.py b/multimedia/sound/sayonara/actions.py index 87e8517353..317cab0e78 100644 --- a/multimedia/sound/sayonara/actions.py +++ b/multimedia/sound/sayonara/actions.py @@ -2,14 +2,14 @@ # -*- coding: utf-8 -*- # # Licensed under the GNU General Public License, version 3. -# See the file http://www.gnu.org/licenses/gpl.txt +# See the file https://www.gnu.org/licenses/gpl-3.0.txt -from pisi.actionsapi import kde5 from pisi.actionsapi import pisitools +from pisi.actionsapi import kde5 from pisi.actionsapi import get def setup(): - kde5.configure() + kde5.configure("-DWITH_SYSTEM_TAGLIB=ON") def build(): kde5.make() @@ -19,7 +19,7 @@ def install(): pisitools.remove("usr/share/icons/sayonara.png") pisitools.dodoc("CHANGES", \ - "COPYING", \ "LICENSE", \ "MANUAL", \ - "README.txt") + "README.md") + diff --git a/multimedia/sound/sayonara/pspec.xml b/multimedia/sound/sayonara/pspec.xml index abf5280af7..0567931c5d 100644 --- a/multimedia/sound/sayonara/pspec.xml +++ b/multimedia/sound/sayonara/pspec.xml @@ -1,5 +1,5 @@ - + sayonara @@ -9,80 +9,73 @@ admins@pisilinux.org GPLv3 - sayonara app:gui - - Sayonara is a small, clear and fast audio player for Linux written in C++, supported by the Qt framework and uses Gstreamer as audio backend. - + Sayonara is a small, clear and fast audio player for Linux written in C++, supported by the Qt framework and uses Gstreamer as audio backend. Although Sayonara is considered as a lightweight player, it holds a lot of features to organize even big music collections. - - ftp://sayonara-player.com/sayonara-player-1.4.1-stable1.tar.gz + + https://gitlab.com/luciocarreras/sayonara-player/-/archive/1.6.0-beta6/sayonara-player-1.6.0-beta6.tar.bz2 - qt5-base-devel - qt5-sql-mysql - qt5-sql-odbc - qt5-sql-postgresql - qt5-sql-sqlite - qt5-linguist - gstreamer-devel + cmake + zlib-devel + glib2-devel + libmtp-devel taglib-devel + qt5-linguist + qt5-sql-odbc + qt5-sql-mysql + qt5-base-devel + qt5-sql-sqlite + gstreamer-devel libnotify-devel + gst-plugins-ugly + qt5-sql-postgresql gst-plugins-bad-devel gst-plugins-base-devel - gst-plugins-ugly - glib2-devel - zlib-devel - libmtp-devel - gstreamer-devel - gst-plugins-base-devel - cmake sayonara + zlib + glib2 + libgcc + libmtp + taglib qt5-base + libnotify + gstreamer gst-plugins-bad gst-plugins-base gst-plugins-good gst-plugins-ugly - gstreamer - taglib - libnotify - glib2 - libgcc - zlib - libmtp - gstreamer - gst-plugins-base /usr/bin /usr/lib/sayonara - /usr/share/appdata - /usr/share/applications - /usr/share/icons - /usr/share/pixmaps/sayonara.png - /usr/share/sayonara/* - /usr/share/man/man1 - /usr/share/doc/sayonara + /usr/share + /usr/share/man + /usr/share/doc - - - sayonara.desktop - - - sayonara.png - + + + 2020-09-15 + 1.6.0_beta6 + Ver. bump + fury + wascheme@tuta.io + 2020-03-08 1.4.1 diff --git a/multimedia/sound/sayonara/translations.xml b/multimedia/sound/sayonara/translations.xml index cf4660e328..9afffed8ff 100644 --- a/multimedia/sound/sayonara/translations.xml +++ b/multimedia/sound/sayonara/translations.xml @@ -2,7 +2,7 @@ sayonara - Sayonara is a small, clear and fast audio player for Linux written in C++, supported by the Qt framework. It uses Gstreamer as audio backend. - Although Sayoanra is considered as a lightweight player, it holds a lot of features to organize even big music collections. + Sayonara is a small, clear and fast audio player for Linux written in C++, supported by the Qt framework. It uses Gstreamer as audio backend. + Although Sayonara is considered as a lightweight player, it holds a lot of features to organize even big music collections. diff --git a/multimedia/sound/yarock/actions.py b/multimedia/sound/yarock/actions.py index 92754b1ce4..58569e7e82 100644 --- a/multimedia/sound/yarock/actions.py +++ b/multimedia/sound/yarock/actions.py @@ -1,46 +1,32 @@ #!/usr/bin/python # -*- coding: utf-8 -*- +# # Licensed under the GNU General Public License, version 3. -# See the file http://www.gnu.org/copyleft/gpl.txt +# See the file https://www.gnu.org/licenses/gpl-3.0.txt from pisi.actionsapi import cmaketools from pisi.actionsapi import shelltools from pisi.actionsapi import pisitools -# if pisi can't find source directory, see /var/pisi/yarock/work/ and: -# WorkDir="yarock-"+ get.srcVERSION() +"/sub_project_dir/" +j = "-DCMAKE_INSTALL_PREFIX=/usr \ + -DCMAKE_BUILD_TYPE=Release \ + -DENABLE_PHONON=ON \ + -DENABLE_MPV=ON \ + -DENABLE_VLC=OFF \ + " def setup(): - shelltools.makedirs("build") - shelltools.cd("build") - cmaketools.configure("-DCMAKE_BUILD_TYPE=Release \ - -DCMAKE_INSTALL_PREFIX=/usr \ - -DENABLE_VLC=OFF \ - -DENABLE_MPV=ON \ - -DENABLE_PHONON=ON", sourceDir = '..') + shelltools.makedirs("build") + shelltools.cd("build") + cmaketools.configure(j, sourceDir = '..') def build(): - shelltools.cd("build") - cmaketools.make() + shelltools.cd("build") + cmaketools.make() def install(): - shelltools.cd("build") - cmaketools.install() - shelltools.cd("..") + shelltools.cd("build") + cmaketools.install() -# Take a look at the source folder for these file as documentation. - pisitools.dodoc("CHANGES.md", \ - "COPYING", \ - "README.md") + pisitools.dodoc("../CHANGES.md", "../COPYING", "../README.md") -# If there is no install rule for a runnable binary, you can -# install it to binary directory. -# pisitools.dobin("yarock") - -# You can use these as variables, they will replace GUI values before build. -# Package Name : yarock -# Version : 1.4.0 -# Summary : Qt Modern Music Player with collection browse based on cover art - -# For more information, you can look at the Actions API -# from the Help menu and toolbar. diff --git a/multimedia/sound/yarock/pspec.xml b/multimedia/sound/yarock/pspec.xml index 81269ef0b8..3786eeb659 100644 --- a/multimedia/sound/yarock/pspec.xml +++ b/multimedia/sound/yarock/pspec.xml @@ -1,96 +1,100 @@ + + - - yarock - https://seb-apps.github.io/yarock/ - - Stefan Gronewold - groni@pisilinux.org - - GPLv3 - - Qt Modern Music Player with collection browse based on cover art. - - - Yarock is a music player in c++/Qt designed to provide a clean, simple and beautiful music collection based on album coverart. - - - https://launchpadlibrarian.net/416223454/Yarock_1.4.0_Sources.tar.gz - - - cmake - qt5-sql-odbc - qt5-linguist - qt5-sql-mysql - qt5-sql-sqlite - qt5-base-devel - qt5-sql-postgresql - qt5-x11extras-devel - mpv-player-devel - qt5-phonon-devel - htmlcxx-devel - taglib-devel - - - - - yarock - - qt5-linguist - qt5-base - qt5-x11extras - mpv-player - qt5-phonon - htmlcxx - taglib - - - /usr/bin - /usr/lib/yarock - /usr/share/appdata - /usr/share/applications - /usr/share/icons - /usr/share/pixmaps - /usr/share/yarock/translations - /usr/share/doc/yarock - - - - - 2020-03-07 - 1.4.0 - Rebuild New T. - Mustafa Cinasal - muscnsl@gmail.com - - - 2019-04-15 - 1.4.0 - Version bump - fury - wascheme@tuta.io - - - 2018-09-01 - 1.1.6 - Rebuild New T. - Mustafa Cinasal - muscnsl@gmail.com - - - 2017-04-23 - 1.1.6 - Rebuild with new toolchain - Stefan Gronewold - groni@pisilinux.org - - - 2016-11-24 - 1.1.6 - First Release - Stefan Gronewold - groni@pisilinux.org - - + + yarock + https://seb-apps.github.io/yarock/ + + Stefan Gronewold + groni@pisilinux.org + + GPLv3 + + Qt Modern Music Player with collection browse based on cover art. + + + Yarock is a music player in c++/Qt designed to provide a clean, simple and beautiful music collection based on album coverart. + + + https://launchpadlibrarian.net/416223454/Yarock_1.4.0_Sources.tar.gz + + + cmake + qt5-sql-odbc + qt5-linguist + qt5-sql-mysql + qt5-sql-sqlite + qt5-base-devel + qt5-sql-postgresql + qt5-x11extras-devel + mpv-player-devel + qt5-phonon-devel + htmlcxx-devel + taglib-devel + + + + + + + + yarock + + qt5-linguist + qt5-base + qt5-x11extras + mpv-player + qt5-phonon + htmlcxx + taglib + + + /usr/bin + /usr/lib/yarock + /usr/share/appdata + /usr/share/applications + /usr/share/icons + /usr/share/pixmaps + /usr/share/yarock/translations + /usr/share/doc/yarock + + + + + + 2020-03-07 + 1.4.0 + Rebuild New T. + Mustafa Cinasal + muscnsl@gmail.com + + + 2019-04-15 + 1.4.0 + Version bump + fury + wascheme@tuta.io + + + 2018-09-01 + 1.1.6 + Rebuild New T. + Mustafa Cinasal + muscnsl@gmail.com + + + 2017-04-23 + 1.1.6 + Rebuild with new toolchain + Stefan Gronewold + groni@pisilinux.org + + + 2016-11-24 + 1.1.6 + First Release + Stefan Gronewold + groni@pisilinux.org + +