Re: Re: sox: patches for old vulnerabilities

[Steffen Nurpmeso <steffen () sdaoden eu>]

Hello Helmut, list, and special greetings to the happy moderator,

Steffen Nurpmeso wrote in
 <20230314191132.qDz3u%steffen () sdaoden eu>:
 ...
 |Helmut Grohne wrote in
 | <20230314110138.GA1192267 () subdivi de>:
 ||On Fri, Feb 03, 2023 at 09:44:47PM +0100, Helmut Grohne wrote:
 ||>  * CVE-2021-33844
 ||
 ||The original fix for this issue would cause a regression. After applying
 ||it, sox would be unable to decode WAV GSM files. This has been reported
 ...
 |You have chosen not to update to latest possible git(?).
 ...
 ||From: Helmut Grohne <helmut () subdivi de>
 ||Subject: wav: reject 0 bits per sample to avoid division by zero
 ||Bug: https://sourceforge.net/p/sox/bugs/349/
 ||Bug-Debian: https://bugs.debian.org/1021135
 | ...
 ||--- a/src/wav.c
 ||+++ b/src/wav.c
 ...

So then my take for the git variant would be as attached.
It compiles, but no GSM here.
(It seems our dear sox developer was out of dynamic tension when
he did that, overall.)

Ciao,

P.S.: on OpenBSD they committed additional code hunks; i still
have not looked into this, but have it on that stairway to over
the clowds to work through.

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)

Attachment: sox-git.patch
Description: