Hello community, here is the log from the commit of package libcdaudio for openSUSE:Factory checked in at Tue Jul 28 00:31:29 CEST 2009. -------- --- libcdaudio/libcdaudio.changes 2008-10-07 18:03:31.000000000 +0200 +++ libcdaudio/libcdaudio.changes 2009-07-17 15:30:22.000000000 +0200 @@ -1,0 +2,5 @@ +Fri Jul 17 15:27:26 CEST 2009 - ro@suse.de + +- fix potential double-free (bnc#515027) + +------------------------------------------------------------------- calling whatdependson for head-i586 Old: ---- buffer-overflow.diff libcdaudio-0.99.12.dif New: ---- libcdaudio-buffer-overflow.diff libcdaudio-double_free.diff libcdaudio-libdir.diff libcdaudio-max_matches.diff ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libcdaudio.spec ++++++ --- /var/tmp/diff_new_pack.HzkRQ6/_old 2009-07-28 00:30:33.000000000 +0200 +++ /var/tmp/diff_new_pack.HzkRQ6/_new 2009-07-28 00:30:33.000000000 +0200 @@ -1,7 +1,7 @@ # # spec file for package libcdaudio (Version 0.99.12) # -# Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2009 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -23,10 +23,12 @@ Group: Productivity/Multimedia/CD/Grabbers Summary: Functions to Control Operation of a CD-ROM When Playing Audio CDs Version: 0.99.12 -Release: 139 +Release: 140 Source: libcdaudio-0.99.12.tar.bz2 -Patch: libcdaudio-0.99.12.dif -Patch1: buffer-overflow.diff +Patch: libcdaudio-max_matches.diff +Patch1: libcdaudio-libdir.diff +Patch2: libcdaudio-buffer-overflow.diff +Patch3: libcdaudio-double_free.diff BuildRoot: %{_tmppath}/%{name}-%{version}-build %description @@ -53,6 +55,8 @@ %setup -q %patch %patch1 +%patch2 +%patch3 %build CFLAGS="$RPM_OPT_FLAGS" ++++++ libcdaudio-buffer-overflow.diff ++++++ --- src/cddb.c +++ src/cddb.c @@ -1679,7 +1679,7 @@ cddb_read_disc_data(int cd_desc, struct disc_data *outdata) free(file); while(!feof(cddb_data)) { - fgets(inbuffer, 512, cddb_data); + fgets(inbuffer, 256, cddb_data); cddb_process_line(inbuffer, data); } ++++++ libcdaudio-double_free.diff ++++++ --- src/cddb.c +++ src/cddb.c @@ -1976,6 +1976,7 @@ if(cddb_mc_copy_from_data(data, indata) < 0) { free(indata); cddb_mc_free(data); + return -1; } free(indata); ++++++ libcdaudio-libdir.diff ++++++ --- libcdaudio-config.in +++ libcdaudio-config.in @@ -1,6 +1,7 @@ #!/bin/sh prefix=@prefix@ +libdir=@libdir@ exec_prefix=@exec_prefix@ exec_prefix_set=no @@ -49,7 +50,7 @@ echo @LIB_LDADD@ ;; --libs) - libdir=-L${exec_prefix}/lib + libdir=-L${libdir} echo $libdir -lcdaudio @LIBS@ ;; *) ++++++ libcdaudio-max_matches.diff ++++++ --- src/cddb.c +++ src/cddb.c @@ -1052,7 +1052,7 @@ } query->query_matches = 0; - while(!cddb_read_line(sock, inbuffer, 256)) { + while(query->query_matches < MAX_INEXACT_MATCHES && !cddb_read_line(sock, inbuffer, 256)) { slashed = 0; if(strchr(inbuffer, '/') != NULL && parse_disc_artist) { index = 0; ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... -- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org