From 7095b7c47a84d54e3ea8fec57bac4d7855c4c28c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com> Date: Fri, 26 Apr 2019 09:44:07 +0300 Subject: [PATCH] id3tag: Correctly validate the year from v1 tags before

Hello community, here is the log from the commit of package gstreamer-plugins-base for openSUSE:Factory checked in at 2019-05-02 19:15:16 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gstreamer-plugins-base (Old) and /work/SRC/openSUSE:Factory/.gstreamer-plugins-base.new.5148 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "gstreamer-plugins-base" Thu May 2 19:15:16 2019 rev:58 rq:699445 version:1.14.4 Changes: -------- --- /work/SRC/openSUSE:Factory/gstreamer-plugins-base/gstreamer-plugins-base.changes 2018-10-11 11:42:47.870989487 +0200 +++ /work/SRC/openSUSE:Factory/.gstreamer-plugins-base.new.5148/gstreamer-plugins-base.changes 2019-05-02 19:15:18.521163392 +0200 @@ -1,0 +2,9 @@ +Fri Apr 26 07:24:19 UTC 2019 - plater <davejplater@gmail.com> + +- Added: + 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch + which fixes: + https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384 + "Segfault since 1.16" which also occurs in 1.14.4. + +------------------------------------------------------------------- New: ---- 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gstreamer-plugins-base.spec ++++++ --- /var/tmp/diff_new_pack.BEeN5L/_old 2019-05-02 19:15:19.165164919 +0200 +++ /var/tmp/diff_new_pack.BEeN5L/_new 2019-05-02 19:15:19.165164919 +0200 @@ -1,7 +1,7 @@ # # spec file for package gstreamer-plugins-base # -# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -12,7 +12,7 @@ # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. -# Please submit bugfixes or comments via https://bugs.opensuse.org/ +# Please submit bugfixes or comments via http://bugs.opensuse.org/ # @@ -29,6 +29,7 @@ Source0: https://gstreamer.freedesktop.org/src/gst-plugins-base/%{_name}-%{version}.tar.xz Source1: gstreamer-plugins-base.appdata.xml Source2: baselibs.conf +Patch0: 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch BuildRequires: Mesa-libGLESv3-devel BuildRequires: cdparanoia-devel ++++++ 0001-id3tag-Correctly-validate-the-year-from-v1-tags-befo.patch ++++++ passing to GstDateTime By using strtoul(), invalid values will get mapped to MAXULONG and we would have to check errno. They won't get mapped to 0. To solve this, use the signed g_ascii_strtoll(). This will map errors to 0 or G_MAXINT64 or G_MININT64, and the valid range for GstDateTime is > 0 and <= 9999 so we can directly check for this here. Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/issues/384 --- gst-libs/gst/tag/gstid3tag.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/gst-libs/gst/tag/gstid3tag.c b/gst-libs/gst/tag/gstid3tag.c index 1149d5bce..4a528d7ee 100644 --- a/gst-libs/gst/tag/gstid3tag.c +++ b/gst-libs/gst/tag/gstid3tag.c @@ -262,7 +262,7 @@ gst_tag_extract_id3v1_string (GstTagList * list, const gchar * tag, GstTagList * gst_tag_list_new_from_id3v1 (const guint8 * data) { - guint year; + gint64 year; gchar *ystr; GstTagList *list; @@ -275,9 +275,9 @@ gst_tag_list_new_from_id3v1 (const guint8 * data) gst_tag_extract_id3v1_string (list, GST_TAG_ARTIST, (gchar *) & data[33], 30); gst_tag_extract_id3v1_string (list, GST_TAG_ALBUM, (gchar *) & data[63], 30); ystr = g_strndup ((gchar *) & data[93], 4); - year = strtoul (ystr, NULL, 10); + year = g_ascii_strtoll (ystr, NULL, 10); g_free (ystr); - if (year > 0) { + if (year > 0 && year <= 9999) { GstDateTime *dt = gst_date_time_new_y (year); gst_tag_list_add (list, GST_TAG_MERGE_REPLACE, GST_TAG_DATE_TIME, dt, NULL); -- 2.16.4