[pkgsrc/trunk]: pkgsrc/audio/libvorbis libvorbis: updated to 1.3.7

[adam <adam%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/6085edff7eec
branches:  trunk
changeset: 435350:6085edff7eec
user:      adam <adam%pkgsrc.org@localhost>
date:      Mon Jul 06 15:32:47 2020 +0000

description:
libvorbis: updated to 1.3.7

libvorbis 1.3.7
* Fix CVE-2018-10393 - out-of-bounds read encoding very low sample rates.
* Fix CVE-2017-14160 - out-of-bounds read encoding very low sample rates.
* Fix handling invalid bytes per sample arguments.
* Fix handling invalid channel count arguments.
* Fix invalid free on seek failure.
* Fix negative shift reading blocksize.
* Fix accepting unreasonable float32 values.
* Fix tag comparison depending on locale.
* Fix unnecessarily linking libm.
* Fix memory leak in test_sharedbook.
* Update Visual Studio projects for ogg library filename change.
* Distribute CMake build files with the source package.
* Remove unnecessary configure --target switch.
* Add gitlab CI support.
* Add OSS-Fuzz support.
* Build system and integration updates.

diffstat:

 audio/libvorbis/Makefile                      |   5 ++---
 audio/libvorbis/distinfo                      |  12 +++++-------
 audio/libvorbis/patches/patch-lib_psy.c       |  19 -------------------
 audio/libvorbis/patches/patch-lib_vorbisenc.c |  14 --------------
 4 files changed, 7 insertions(+), 43 deletions(-)

diffs (71 lines):

diff -r 32b4927de2f0 -r 6085edff7eec audio/libvorbis/Makefile
--- a/audio/libvorbis/Makefile  Mon Jul 06 15:28:44 2020 +0000
+++ b/audio/libvorbis/Makefile  Mon Jul 06 15:32:47 2020 +0000
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.62 2018/08/06 13:25:38 snj Exp $
+# $NetBSD: Makefile,v 1.63 2020/07/06 15:32:47 adam Exp $
 
-DISTNAME=      libvorbis-1.3.6
-PKGREVISION=   1
+DISTNAME=      libvorbis-1.3.7
 CATEGORIES=    devel audio
 MASTER_SITES=  http://downloads.xiph.org/releases/vorbis/
 EXTRACT_SUFX=  .tar.xz
diff -r 32b4927de2f0 -r 6085edff7eec audio/libvorbis/distinfo
--- a/audio/libvorbis/distinfo  Mon Jul 06 15:28:44 2020 +0000
+++ b/audio/libvorbis/distinfo  Mon Jul 06 15:32:47 2020 +0000
@@ -1,8 +1,6 @@
-$NetBSD: distinfo,v 1.27 2018/08/06 13:25:38 snj Exp $
+$NetBSD: distinfo,v 1.28 2020/07/06 15:32:47 adam Exp $
 
-SHA1 (libvorbis-1.3.6.tar.xz) = 237e3d1c66452734fd9b32f494f44238b4f0185e
-RMD160 (libvorbis-1.3.6.tar.xz) = 80213c5a1506438a342588ae58097a1590b6657c
-SHA512 (libvorbis-1.3.6.tar.xz) = a5d990bb88db2501b16f8eaee9f2ecb599cefd7dab2134d16538d8905263a972157c7671867848c2a8a358bf5e5dbc7721205ece001032482f168be7bda4f132
-Size (libvorbis-1.3.6.tar.xz) = 1195388 bytes
-SHA1 (patch-lib_psy.c) = acbc6fd4e4e7710a05b6342c10270f085214a84f
-SHA1 (patch-lib_vorbisenc.c) = e65377b441c71e75e86064292dccfb86acf298b2
+SHA1 (libvorbis-1.3.7.tar.xz) = 0a2dd71a999656b8091506839e8007a61a8fda1f
+RMD160 (libvorbis-1.3.7.tar.xz) = d2740a2d0fb626685eaae47370e42f0b85db81b3
+SHA512 (libvorbis-1.3.7.tar.xz) = bbf5f11f623d959b3ba98d6b52806521b0b918b59b867f0658c153ea1013293364eead4987e9e71f8798021379310860a2e548fcf89d10caf23d45e41aba45cd
+Size (libvorbis-1.3.7.tar.xz) = 1203792 bytes
diff -r 32b4927de2f0 -r 6085edff7eec audio/libvorbis/patches/patch-lib_psy.c
--- a/audio/libvorbis/patches/patch-lib_psy.c   Mon Jul 06 15:28:44 2020 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,19 +0,0 @@
-$NetBSD: patch-lib_psy.c,v 1.1 2018/08/06 13:25:38 snj Exp $
-
-CVE-2017-14160: fix bounds check on very low sample rates.
-
-https://github.com/xiph/vorbis/commit/018ca26dece618457dd13585cad52941193c4a25#diff-3b415297c1f1559ee10baa1284561e46
-
---- lib/psy.c.orig     2018-08-06 06:10:59.234730587 -0700
-+++ lib/psy.c  2018-08-06 06:13:28.935699414 -0700
-@@ -602,8 +602,9 @@ static void bark_noise_hybridmp(int n,co
-   for (i = 0, x = 0.f;; i++, x += 1.f) {
- 
-     lo = b[i] >> 16;
--    if( lo>=0 ) break;
-     hi = b[i] & 0xffff;
-+    if( lo>=0 ) break;
-+    if( hi>=n ) break;
- 
-     tN = N[hi] + N[-lo];
-     tX = X[hi] - X[-lo];
diff -r 32b4927de2f0 -r 6085edff7eec audio/libvorbis/patches/patch-lib_vorbisenc.c
--- a/audio/libvorbis/patches/patch-lib_vorbisenc.c     Mon Jul 06 15:28:44 2020 +0000
+++ /dev/null   Thu Jan 01 00:00:00 1970 +0000
@@ -1,14 +0,0 @@
-$NetBSD: patch-lib_vorbisenc.c,v 1.1 2018/08/06 13:25:38 snj Exp $
-
-https://gitlab.xiph.org/xiph/vorbis/issues/2335
-
---- lib/vorbisenc.c.orig       2018-08-06 06:17:42.209959046 -0700
-+++ lib/vorbisenc.c    2018-08-06 06:18:01.425700460 -0700
-@@ -684,6 +684,7 @@ int vorbis_encode_setup_init(vorbis_info
-   highlevel_encode_setup *hi=&ci->hi;
- 
-   if(ci==NULL)return(OV_EINVAL);
-+  if(vi->channels<1||vi->channels>255)return(OV_EINVAL);
-   if(!hi->impulse_block_p)i0=1;
- 
-   /* too low/high an ATH floater is nonsensical, but doesn't break anything */