Wednesday, November 11, 2020

Re: UPDATE: libsndfile 1.0.30 - CVE

On 11/11/2020 2:38 PM, Jan Stary wrote:
> On Oct 31 01:26:50, brad@comstyle.com wrote:
>> Here is an update to libsndfile 1.0.30.
> Thanks for the diff, and sorry for the delay.
> (Real life interferes quite a bit around here.)
>
> The port as updated by this diff basically works;
> please see comments inline.
>
> Jan
>
>> Index: Makefile
>> ===================================================================
>> RCS file: /cvs/ports/audio/libsndfile/Makefile,v
>> retrieving revision 1.33
>> diff -u -p -u -p -r1.33 Makefile
>> --- Makefile 12 Jul 2019 20:43:35 -0000 1.33
>> +++ Makefile 31 Oct 2020 05:07:55 -0000
>> @@ -2,31 +2,33 @@
>>
>> COMMENT= library to handle various audio file formats
>>
>> -DISTNAME= libsndfile-1.0.28
>> +DISTNAME= libsndfile-1.0.30
>> CATEGORIES= audio
>> +GH_ACCOUNT= libsndfile
>> +GH_PROJECT= libsndfile
>> +GH_TAGNAME= v1.0.30
> Right. No version after 1.0.28 seems to exist
> on the old HOMEPAGE.
>
>> HOMEPAGE= http://www.mega-nerd.com/libsndfile/
> I asked upstream to remove the page completely.
> It is and outdated version of the real thing at github.
>
>> MAINTAINER= Jan Stary <hans@stare.cz>
>> -SHARED_LIBS += sndfile 6.0 # .1.28
>> +
>> +SHARED_LIBS += sndfile 7.0 # .1.28
>>
>> # LGPLv2.1
>> PERMIT_PACKAGE= Yes
>>
>> -MASTER_SITES= ${HOMEPAGE}files/
>> +WANTLIB= c m sndio FLAC ogg opus vorbis vorbisenc
>>
>> -WANTLIB= c m sndio FLAC ogg vorbis vorbisenc
>> +MODULES= devel/cmake
> AFAIU, it still supports the autoconf build.
> Is there any specific reason you are switching to cmake?
> It seem to pull in a number of py3-* build dependencies,
> including stuff like py3-babel and py3-imagesize and ninja ...
>
> Much as I hate the autotools, it seems to be
> less of a burden then this cmake build.

The Python requirement which I was not aware of is there whether
using Autotools or CMake. I went looking to see where it came into
play and found this commit...

https://github.com/libsndfile/libsndfile/commit/3d8399dfde36827a9bff38a15392783f8a127fb6#diff-49473dca262eeab3b4a43002adb08b4db31020d190caaad1594b47f1d5daa810

From 3d8399dfde36827a9bff38a15392783f8a127fb6 Mon Sep 17 00:00:00 2001
From: evpobr <evpobr@gmail.com>
Date: Wed, 24 May 2017 11:16:54 +0500
Subject: [PATCH] Fix broken ABI

Unfortunately ABI was broken when symbols files were removed
in favour of new visibility control of exported functions.

Visibility control with -fvisibility works fine, but symbol
scripts had another feature - versioned symbols. And we lost it.

Since we can not make our symbols to be versioned  with the new
approach, it's decided to return everything back.

* CMake: Restore symbol files generation
* CMake: Python is required to build shared libraries
* Autotools: Restore symbol files generation

Closes: https://github.com/erikd/libsndfile/issues/268

No comments:

Post a Comment