oss-sec mailing list archives
Re: sox: patches for old vulnerabilities
From: Steffen Nurpmeso <steffen () sdaoden eu>
Date: Sat, 04 Feb 2023 00:19:14 +0100
Hello. Helmut Grohne wrote in <Y91yP6mYIZ+UXmgf () alf mars>: |I am working on fixing known vulnerabilities in sox and since upstream |seems mostly dead (no commits in more than a year, no replies to bug |reports), I am posting my results here. My work on sox is compensated by |Freexian SARL. Thank you for this work on sox! But i was only wondering a bit, have you checked against the [master] branch? For example 02-fix-resource-leak-hcom.patch 03-fix-regression-in-CVE-2017-11358.patch 04-fix-hcom-big-endian.patch# 06-CVE-2021-33844.patch and 07-CVE-2021-3643.patch do not apply against it, and he introduced functions like dictvalid() to do things you seem to unroll differently? The rest just apply fine, and 02- was needed here, 03- seemed an unrolled dup, 04- in parts (stdint via sox.h, but overflow, sure), it is too late to check the rest, 'will do tomorrow. (I an maintaining an official contrib now private sox port for CRUX Linux based upon 42b3557e13e0fe0 as of 20211029.) Ciao! --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt)
Current thread:
- sox: patches for old vulnerabilities Helmut Grohne (Feb 03)
- Re: sox: patches for old vulnerabilities Steffen Nurpmeso (Feb 04)
- Re: sox: patches for old vulnerabilities Helmut Grohne (Mar 14)
- Re: Re: sox: patches for old vulnerabilities Steffen Nurpmeso (Mar 14)
- Re: Re: sox: patches for old vulnerabilities Steffen Nurpmeso (Mar 14)
- Re: Re: sox: patches for old vulnerabilities Steffen Nurpmeso (Mar 30)
- Re: Re: sox: patches for old vulnerabilities Nam Nguyen (Mar 31)
- Re: Re: sox: patches for old vulnerabilities Steffen Nurpmeso (Mar 31)
- Re: Re: sox: patches for old vulnerabilities Steffen Nurpmeso (Mar 14)