--- libvorbis-1.2.0.dfsg.orig/debian/libvorbisfile3.install +++ libvorbis-1.2.0.dfsg/debian/libvorbisfile3.install @@ -0,0 +1 @@ +debian/tmp/usr/lib/libvorbisfile.so.* --- libvorbis-1.2.0.dfsg.orig/debian/control +++ libvorbis-1.2.0.dfsg/debian/control @@ -0,0 +1,62 @@ +Source: libvorbis +Section: libs +Priority: optional +Maintainer: Debian Xiph.org Maintainers +Uploaders: Adeodato Simó , Clint Adams +Build-Depends: autotools-dev, debhelper, quilt, libogg-dev +Standards-Version: 3.7.3 +Vcs-Bzr: http://bzr.debian.org/bzr/pkg-xiph/libvorbis + +Package: libvorbis0a +Architecture: any +Section: libs +Depends: ${shlibs:Depends} +Conflicts: libvorbis0 +Replaces: libvorbis0 +Description: The Vorbis General Audio Compression Codec + Ogg Vorbis is a fully open, non-proprietary, patent-and-royalty-free, + general-purpose compressed audio format for audio and music at fixed + and variable bitrates from 16 to 128 kbps/channel. + . + The Vorbis library is the primary Ogg Vorbis library. + +Package: libvorbisenc2 +Architecture: any +Section: libs +Depends: ${shlibs:Depends} +Conflicts: libvorbis0 (<< 1.0.0) +Replaces: libvorbis0 (<< 1.0.0) +Description: The Vorbis General Audio Compression Codec + Ogg Vorbis is a fully open, non-proprietary, patent-and-royalty-free, + general-purpose compressed audio format for audio and music at fixed + and variable bitrates from 16 to 128 kbps/channel. + . + The Vorbisenc library provides a convenient API for setting up an encoding + environment using libvorbis. + +Package: libvorbisfile3 +Architecture: any +Section: libs +Depends: ${shlibs:Depends} +Conflicts: libvorbis0 (<< 1.0.0) +Replaces: libvorbis0 (<< 1.0.0) +Description: The Vorbis General Audio Compression Codec + Ogg Vorbis is a fully open, non-proprietary, patent-and-royalty-free, + general-purpose compressed audio format for audio and music at fixed + and variable bitrates from 16 to 128 kbps/channel. + . + The Vorbisfile library provides a convenient high-level API for decoding + and basic manipulation of all Vorbis I audio streams. + +Package: libvorbis-dev +Architecture: any +Section: libdevel +Depends: libogg-dev, libvorbis0a (= ${binary:Version}), libvorbisenc2 (= ${binary:Version}), libvorbisfile3 (= ${binary:Version}) +Description: The Vorbis General Audio Compression Codec (development files) + Ogg Vorbis is a fully open, non-proprietary, patent-and-royalty-free, + general-purpose compressed audio format for audio and music at fixed + and variable bitrates from 16 to 128 kbps/channel. + . + This package contains the header files and documentation needed to develop + applications with libvorbis. + --- libvorbis-1.2.0.dfsg.orig/debian/libvorbis-dev.examples +++ libvorbis-1.2.0.dfsg/debian/libvorbis-dev.examples @@ -0,0 +1,2 @@ +examples/*.c +examples/*.pl --- libvorbis-1.2.0.dfsg.orig/debian/rules +++ libvorbis-1.2.0.dfsg/debian/rules @@ -0,0 +1,117 @@ +#! /usr/bin/make -f + +include /usr/share/quilt/quilt.make + +### + +# Configure arguments + +confflags = --prefix=/usr --enable-static + +DEB_HOST_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE) +DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE) + +confflags += --build $(DEB_BUILD_GNU_TYPE) + +# Only specify --host when cross-compiling +ifneq ($(DEB_BUILD_GNU_TYPE), $(DEB_HOST_GNU_TYPE)) + confflags += --host $(DEB_HOST_GNU_TYPE) +endif + +### + +# Directory to make the build on + +objdir = $(CURDIR)/obj-$(DEB_HOST_GNU_TYPE) + +### + +# CFLAGS + +CFLAGS = -Wall -g + +ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS))) + CFLAGS += -O0 +else + CFLAGS += -O2 +endif + +### + +configure: configure-stamp +configure-stamp: $(QUILT_STAMPFN) + dh_testdir + + ln -sf /usr/share/misc/config.sub . + ln -sf /usr/share/misc/config.guess . + + -mkdir $(objdir) + cd $(objdir) && \ + env CFLAGS="$(CFLAGS)" ../configure $(confflags) + + touch $@ + +# + +build: build-stamp +build-stamp: configure-stamp + cd $(objdir) && \ + $(MAKE) + + touch $@ + +# + +clean: unpatch + dh_testdir + dh_testroot + + rm -f configure-stamp build-stamp install-stamp + rm -f config.guess config.sub + + # Remove build tree + rm -rf $(objdir) + + dh_clean + +# + +install: install-stamp +install-stamp: + dh_testdir + dh_testroot + dh_clean + dh_installdirs + cd $(objdir) && $(MAKE) install DESTDIR=$(CURDIR)/debian/tmp + dh_install --list-missing $(DH_INSTALL_EXCLUDE) + touch $@ + +# + +binary: binary-arch + +binary-arch: build install + dh_testdir + dh_testroot + dh_installchangelogs CHANGES + dh_installdocs + dh_installexamples + dh_installmime + dh_installman + dh_link + dh_strip + dh_compress + dh_fixperms + dh_makeshlibs -V -- -c4 + dh_installdeb + dh_shlibdeps -ldebian/libvorbis0a/usr/lib + dh_gencontrol + dh_md5sums + dh_builddeb + +binary-indep: + @echo "Nothing to do." + +# + +.PHONY: configure build clean install binary binary-arch binary-indep --- libvorbis-1.2.0.dfsg.orig/debian/watch +++ libvorbis-1.2.0.dfsg/debian/watch @@ -0,0 +1,2 @@ +version=3 +http://downloads.xiph.org/releases/vorbis/libvorbis-(.+)\.tar\.gz --- libvorbis-1.2.0.dfsg.orig/debian/changelog +++ libvorbis-1.2.0.dfsg/debian/changelog @@ -0,0 +1,214 @@ +libvorbis (1.2.0.dfsg-3.1~bpo40+1) etch-backports; urgency=low + + * Rebuild for etch-backports. + + -- Romain Beauxis Mon, 21 Jul 2008 21:24:50 +0200 + +libvorbis (1.2.0.dfsg-3.1) unstable; urgency=high + + * Non-maintainer upload by the security team + * Fix integer overflows (and possible DoS attacks) via crafted + OGG files (Closes: #482518) + Fixes: CVE-2008-1423, CVE-2008-1420, CVE-2008-1419 + + -- Steffen Joeris Mon, 26 May 2008 12:48:06 +0000 + +libvorbis (1.2.0.dfsg-3) unstable; urgency=low + + * Use dpkg-gensymbols, with symbol files obtained from Mole (stripping + debian revision and .dfsg suffix). + + * Install upstream CHANGES file as changelog.gz. (Closes: #302037) + + * Bump debian/compat to 5, and Standards-Version to 3.7.3 (no changes + needed). + + * Use quilt.make in debian/rules. + + -- Adeodato Simó Thu, 27 Dec 2007 14:33:45 +0100 + +libvorbis (1.2.0.dfsg-2) unstable; urgency=high + + * Bump shlibs for libvorbis0a due to new vorbis_synthesis_idheader header. + (Closes: #436083) + + -- Adeodato Simó Tue, 14 Aug 2007 20:55:54 +0200 + +libvorbis (1.2.0.dfsg-1) unstable; urgency=low + + [ Adeodato Simó ] + * Use ${binary:Version} instead of ${Source-Version}. + + [ Clint Adams ] + * New upstream release. + - Remove upstream_r13198-fix_segfault_in_ov_time_seek.diff . + * Bump shlibs for libvorbisfile3 to >= 1.2.0 due to new ov_fopen + function. + + -- Clint Adams Fri, 27 Jul 2007 02:57:44 -0400 + +libvorbis (1.1.2.dfsg-2) unstable; urgency=low + + * Bump to Standards-Version 3.7.2. + * Add upstream_r13198-fix_segfault_in_ov_time_seek.diff. closes: #281995. + + -- Clint Adams Fri, 29 Jun 2007 09:46:12 -0400 + +libvorbis (1.1.2.dfsg-1.2) unstable; urgency=high + + * Fix shlibs files for libvorbisenc and libvorbisfile, which were broken + by my first NMU to have dependencies for libvorbis0a. Closes: #395048 + + -- Joey Hess Tue, 24 Oct 2006 19:55:19 -0400 + +libvorbis (1.1.2.dfsg-1.1) unstable; urgency=low + + * NMU + * Remove draft RFC files, as they are not under a free license. + Closes: #390660 + * Repackage the source package without these files. + * Add README.Source documenting how the upstream source is repackaged. + * Modify dh_makeshlibs call to avoid generating a shlibs file that has + an unncessarily tight versioned dependency on this new pseudo-version + of libvorbis. + + -- Joey Hess Sun, 15 Oct 2006 17:21:37 -0400 + +libvorbis (1.1.2-1) unstable; urgency=low + + * Switch maintenance to the Debian Xiph.org Maintainers (alioth/pkg-xiph). + + * New upstream release packaged. (Closes: #327586) + + * Move HTML documentation from /usr/share/doc/libvorbis-dev itself to an + html/ subdirectory of it. + + * Update debian/control: + + drop unnecessary build-dependency on devscripts. + + drop version restriction on debhelper and libogg-dev build-dependencies, + since they're already satisfied with stable. + + * Overhaul debian/rules, and switch to quilt for patch management. + + * Add debian/compat file, instead of exporting DH_COMPAT. + + * Update download URL in debian/copyright. + + * Add debian/watch file. + + * Bumped Standards-Version to 3.6.2 (no changes required). + + -- Adeodato Simó Thu, 26 Jan 2006 01:35:39 +0100 + +libvorbis (1.1.0-1) unstable; urgency=low + + * New upstream. + + -- Christopher L Cheney Thu, 17 Mar 2005 21:30:00 -0600 + +libvorbis (1.0.1-1) unstable; urgency=low + + * New upstream. + * Improved descriptions. (Closes: #166649) + * Updated DEB_BUILD_OPTIONS support. (Closes: #188464) + + -- Christopher L Cheney Tue, 9 Dec 2003 01:00:00 -0600 + +libvorbis (1.0.0-3) unstable; urgency=low + + * Add libvorbis0 conflict to libvorbis0a. + + -- Christopher L Cheney Wed, 12 Mar 2003 17:00:00 -0600 + +libvorbis (1.0.0-2) unstable; urgency=low + + * Rename libvorbis0 -> libvorbis0a to keep packages from upgrading to it + by mistake. (Closes: #156227, #156365, #161961, #171548, #172466, + #172469, #178756) + * GNU config automated update: config.sub (20020621 to 20030103), + config.guess (20020529 to 20030110) + + -- Christopher L Cheney Sat, 8 Mar 2003 13:00:00 -0600 + +libvorbis (1.0.0-1) unstable; urgency=low + + * New upstream. + * Split libvorbis package into libvorbis libvorbisenc libvorbisfile due to + shared object major versions going out of sync. + + -- Christopher L Cheney Fri, 19 Jul 2002 09:00:00 -0500 + +libvorbis (1.0rc3-1) unstable; urgency=low + + * New upstream. (Closes: #121995, #123472) + * added autotools target (config.* updater) to rules + + -- Christopher L Cheney Mon, 24 Dec 2001 11:00:00 -0600 + +libvorbis (1.0rc2-1) unstable; urgency=low + + * New upstream. + + -- Christopher L Cheney Sun, 12 Aug 2001 22:00:00 -0500 + +libvorbis (1.0rc1-1) unstable; urgency=low + + * New upstream. (Closes: #84977, #95330) + * Upstream says lame at fault. See bug details. (Closes: #98010) + * Fixed versioned depends. + * Changed clean method to distclean. + + -- Christopher L Cheney Sun, 17 Jun 2001 20:00:00 -0500 + +libvorbis (1.0beta4-1) unstable; urgency=low + + * New upstream. + * Appears to be fixed, can't reproduce bug (closes: #78848) + + -- Christopher L Cheney Mon, 26 Feb 2001 08:00:00 -0600 + +libvorbis (1.0beta3-3) unstable; urgency=low + + * Fixed Build-Depends libogg-dev version dependency. + * Fixed Sections. + * Updated to Standards-Version to 3.5.1.0 + + -- Christopher L Cheney Sat, 17 Feb 2001 18:14:53 -0600 + +libvorbis (1.0beta3-2) unstable; urgency=low + + * Added dependency for libogg-dev (closes: #78262) + * Added dependency for libogg-dev (closes: #81432) + * Corrected development library package name (closes: #82464) + + -- Christopher L Cheney Sat, 3 Feb 2001 13:29:30 -0600 + +libvorbis (1.0beta3-1) unstable; urgency=low + + * New Maintainer. + * Upstream source was reorganized. + * Package split according to the upstream reorganization. + + -- Christopher L Cheney Tue, 31 Oct 2000 15:08:22 -0600 + +vorbis (1.0beta2-1) unstable; urgency=low + + * New upstream version. Closes: #67326, #68416 + * Changed xmms-vorbis to Architechture: any. Closes: #67395 + * Added Build-deps. Closes: #66628 + * Moved vorbize to vorbis-tools along with oggenc and vorbiscomment + + -- Michael Beattie Wed, 9 Aug 2000 00:30:15 +1200 + +vorbis (1.0beta1-1) unstable; urgency=low + + * First Beta, Ready for debian release. + + -- Michael Beattie Fri, 30 Jun 2000 19:26:59 +1200 + +vorbis (0.0-1) unstable; urgency=low + + * Initial Release. + * Initial package, not placed in archive. + + -- Michael Beattie Mon, 26 Jun 2000 18:59:56 +1200 --- libvorbis-1.2.0.dfsg.orig/debian/libvorbis0a.symbols +++ libvorbis-1.2.0.dfsg/debian/libvorbis0a.symbols @@ -0,0 +1,133 @@ +libvorbis.so.0 libvorbis0a #MINVER# + _analysis_output@Base 1.1.2 + _analysis_output_always@Base 1.1.2 + _best@Base 1.1.2 + _book_maptype1_quantvals@Base 1.1.2 + _book_unquantize@Base 1.1.2 + _float32_pack@Base 1.1.2 + _float32_unpack@Base 1.1.2 + _floor_P@Base 1.1.2 + _ilog@Base 1.1.2 + _make_words@Base 1.1.2 + _mapping_P@Base 1.1.2 + _residue_P@Base 1.1.2 + _ve_envelope_clear@Base 1.1.2 + _ve_envelope_init@Base 1.1.2 + _ve_envelope_mark@Base 1.1.2 + _ve_envelope_search@Base 1.1.2 + _ve_envelope_shift@Base 1.1.2 + _vi_gpsy_free@Base 1.1.2 + _vi_psy_free@Base 1.1.2 + _vorbis_apply_window@Base 1.1.2 + _vorbis_block_alloc@Base 1.1.2 + _vorbis_block_ripcord@Base 1.1.2 + _vorbis_window_get@Base 1.1.2 + _vp_ampmax_decay@Base 1.1.2 + _vp_couple@Base 1.1.2 + _vp_global_free@Base 1.1.2 + _vp_global_look@Base 1.1.2 + _vp_noise_normalize@Base 1.1.2 + _vp_noise_normalize_sort@Base 1.1.2 + _vp_noisemask@Base 1.1.2 + _vp_offset_and_mix@Base 1.1.2 + _vp_psy_clear@Base 1.1.2 + _vp_psy_init@Base 1.1.2 + _vp_quantize_couple_memo@Base 1.1.2 + _vp_quantize_couple_sort@Base 1.1.2 + _vp_remove_floor@Base 1.1.2 + _vp_tonemask@Base 1.1.2 + analysis_noisy@Base 1.1.2 + drft_backward@Base 1.1.2 + drft_clear@Base 1.1.2 + drft_forward@Base 1.1.2 + drft_init@Base 1.1.2 + floor0_exportbundle@Base 1.1.2 + floor1_encode@Base 1.1.2 + floor1_exportbundle@Base 1.1.2 + floor1_fit@Base 1.1.2 + floor1_interpolate_fit@Base 1.1.2 + hf_reduction@Base 1.1.2 + mapping0_exportbundle@Base 1.1.2 + mdct_backward@Base 1.1.2 + mdct_clear@Base 1.1.2 + mdct_forward@Base 1.1.2 + mdct_init@Base 1.1.2 + res0_free_info@Base 1.1.2 + res0_free_look@Base 1.1.2 + res0_inverse@Base 1.1.2 + res0_look@Base 1.1.2 + res0_pack@Base 1.1.2 + res0_unpack@Base 1.1.2 + res1_class@Base 1.1.2 + res1_forward@Base 1.1.2 + res1_inverse@Base 1.1.2 + res2_class@Base 1.1.2 + res2_forward@Base 1.1.2 + res2_inverse@Base 1.1.2 + residue0_exportbundle@Base 1.1.2 + residue1_exportbundle@Base 1.1.2 + residue2_exportbundle@Base 1.1.2 + vorbis_analysis@Base 1.1.2 + vorbis_analysis_blockout@Base 1.1.2 + vorbis_analysis_buffer@Base 1.1.2 + vorbis_analysis_headerout@Base 1.1.2 + vorbis_analysis_init@Base 1.1.2 + vorbis_analysis_wrote@Base 1.1.2 + vorbis_bitrate_addblock@Base 1.1.2 + vorbis_bitrate_clear@Base 1.1.2 + vorbis_bitrate_flushpacket@Base 1.1.2 + vorbis_bitrate_init@Base 1.1.2 + vorbis_bitrate_managed@Base 1.1.2 + vorbis_block_clear@Base 1.1.2 + vorbis_block_init@Base 1.1.2 + vorbis_book_clear@Base 1.1.2 + vorbis_book_codelen@Base 1.1.2 + vorbis_book_codeword@Base 1.1.2 + vorbis_book_decode@Base 1.1.2 + vorbis_book_decodev_add@Base 1.1.2 + vorbis_book_decodev_set@Base 1.1.2 + vorbis_book_decodevs_add@Base 1.1.2 + vorbis_book_decodevv_add@Base 1.1.2 + vorbis_book_encode@Base 1.1.2 + vorbis_book_encodev@Base 1.1.2 + vorbis_book_errorv@Base 1.1.2 + vorbis_book_init_decode@Base 1.1.2 + vorbis_book_init_encode@Base 1.1.2 + vorbis_comment_add@Base 1.1.2 + vorbis_comment_add_tag@Base 1.1.2 + vorbis_comment_clear@Base 1.1.2 + vorbis_comment_init@Base 1.1.2 + vorbis_comment_query@Base 1.1.2 + vorbis_comment_query_count@Base 1.1.2 + vorbis_commentheader_out@Base 1.1.2 + vorbis_coslook@Base 1.1.2 + vorbis_dsp_clear@Base 1.1.2 + vorbis_fromdBlook@Base 1.1.2 + vorbis_granule_time@Base 1.1.2 + vorbis_info_blocksize@Base 1.1.2 + vorbis_info_clear@Base 1.1.2 + vorbis_info_init@Base 1.1.2 + vorbis_invsq2explook@Base 1.1.2 + vorbis_invsqlook@Base 1.1.2 + vorbis_lpc_from_data@Base 1.1.2 + vorbis_lpc_predict@Base 1.1.2 + vorbis_lpc_to_lsp@Base 1.1.2 + vorbis_lsp_to_curve@Base 1.1.2 + vorbis_packet_blocksize@Base 1.1.2 + vorbis_staticbook_clear@Base 1.1.2 + vorbis_staticbook_destroy@Base 1.1.2 + vorbis_staticbook_pack@Base 1.1.2 + vorbis_staticbook_unpack@Base 1.1.2 + vorbis_synthesis@Base 1.1.2 + vorbis_synthesis_blockin@Base 1.1.2 + vorbis_synthesis_halfrate@Base 1.1.2 + vorbis_synthesis_halfrate_p@Base 1.1.2 + vorbis_synthesis_headerin@Base 1.1.2 + vorbis_synthesis_idheader@Base 1.2.0 + vorbis_synthesis_init@Base 1.1.2 + vorbis_synthesis_lapout@Base 1.1.2 + vorbis_synthesis_pcmout@Base 1.1.2 + vorbis_synthesis_read@Base 1.1.2 + vorbis_synthesis_restart@Base 1.1.2 + vorbis_synthesis_trackonly@Base 1.1.2 + vorbis_window@Base 1.1.2 --- libvorbis-1.2.0.dfsg.orig/debian/libvorbisenc2.install +++ libvorbis-1.2.0.dfsg/debian/libvorbisenc2.install @@ -0,0 +1 @@ +debian/tmp/usr/lib/libvorbisenc.so.* --- libvorbis-1.2.0.dfsg.orig/debian/libvorbis-dev.install +++ libvorbis-1.2.0.dfsg/debian/libvorbis-dev.install @@ -0,0 +1,17 @@ +debian/tmp/usr/include/vorbis/codec.h +debian/tmp/usr/include/vorbis/vorbisenc.h +debian/tmp/usr/include/vorbis/vorbisfile.h +debian/tmp/usr/lib/libvorbis.a +debian/tmp/usr/lib/libvorbis.la +debian/tmp/usr/lib/libvorbis.so +debian/tmp/usr/lib/libvorbisenc.a +debian/tmp/usr/lib/libvorbisenc.la +debian/tmp/usr/lib/libvorbisenc.so +debian/tmp/usr/lib/libvorbisfile.a +debian/tmp/usr/lib/libvorbisfile.la +debian/tmp/usr/lib/libvorbisfile.so +debian/tmp/usr/lib/pkgconfig/vorbis.pc +debian/tmp/usr/lib/pkgconfig/vorbisenc.pc +debian/tmp/usr/lib/pkgconfig/vorbisfile.pc +debian/tmp/usr/share/aclocal/vorbis.m4 +debian/tmp/usr/share/doc/libvorbis-*/* usr/share/doc/libvorbis-dev/html --- libvorbis-1.2.0.dfsg.orig/debian/compat +++ libvorbis-1.2.0.dfsg/debian/compat @@ -0,0 +1 @@ +5 --- libvorbis-1.2.0.dfsg.orig/debian/libvorbisfile3.symbols +++ libvorbis-1.2.0.dfsg/debian/libvorbisfile3.symbols @@ -0,0 +1,36 @@ +libvorbisfile.so.3 libvorbisfile3 #MINVER# + ov_bitrate@Base 1.1.2 + ov_bitrate_instant@Base 1.1.2 + ov_clear@Base 1.1.2 + ov_comment@Base 1.1.2 + ov_crosslap@Base 1.1.2 + ov_fopen@Base 1.2.0 + ov_halfrate@Base 1.1.2 + ov_halfrate_p@Base 1.1.2 + ov_info@Base 1.1.2 + ov_open@Base 1.1.2 + ov_open_callbacks@Base 1.1.2 + ov_pcm_seek@Base 1.1.2 + ov_pcm_seek_lap@Base 1.1.2 + ov_pcm_seek_page@Base 1.1.2 + ov_pcm_seek_page_lap@Base 1.1.2 + ov_pcm_tell@Base 1.1.2 + ov_pcm_total@Base 1.1.2 + ov_raw_seek@Base 1.1.2 + ov_raw_seek_lap@Base 1.1.2 + ov_raw_tell@Base 1.1.2 + ov_raw_total@Base 1.1.2 + ov_read@Base 1.1.2 + ov_read_float@Base 1.1.2 + ov_seekable@Base 1.1.2 + ov_serialnumber@Base 1.1.2 + ov_streams@Base 1.1.2 + ov_test@Base 1.1.2 + ov_test_callbacks@Base 1.1.2 + ov_test_open@Base 1.1.2 + ov_time_seek@Base 1.1.2 + ov_time_seek_lap@Base 1.1.2 + ov_time_seek_page@Base 1.1.2 + ov_time_seek_page_lap@Base 1.1.2 + ov_time_tell@Base 1.1.2 + ov_time_total@Base 1.1.2 --- libvorbis-1.2.0.dfsg.orig/debian/libvorbis0a.install +++ libvorbis-1.2.0.dfsg/debian/libvorbis0a.install @@ -0,0 +1 @@ +debian/tmp/usr/lib/libvorbis.so.* --- libvorbis-1.2.0.dfsg.orig/debian/patches/CVE-2008-1423+CVE-2008-1419.patch +++ libvorbis-1.2.0.dfsg/debian/patches/CVE-2008-1423+CVE-2008-1419.patch @@ -0,0 +1,20 @@ +--- ../old/libvorbis-1.2.0.dfsg/lib/codebook.c 2007-07-24 00:09:47.000000000 +0000 ++++ libvorbis-1.2.0.dfsg/lib/codebook.c 2008-05-23 08:18:46.000000000 +0000 +@@ -158,6 +158,8 @@ + s->dim=oggpack_read(opb,16); + s->entries=oggpack_read(opb,24); + if(s->entries==-1)goto _eofout; ++ ++ if(_ilog(s->dim)+_ilog(s->entries)>24)goto _eofout; + + /* codeword ordering.... length ordered or unordered? */ + switch((int)oggpack_read(opb,1)){ +@@ -225,7 +227,7 @@ + int quantvals=0; + switch(s->maptype){ + case 1: +- quantvals=_book_maptype1_quantvals(s); ++ quantvals=(s->dim==0?0:_book_maptype1_quantvals(s)); + break; + case 2: + quantvals=s->entries*s->dim; --- libvorbis-1.2.0.dfsg.orig/debian/patches/CVE-2008-1420.patch +++ libvorbis-1.2.0.dfsg/debian/patches/CVE-2008-1420.patch @@ -0,0 +1,46 @@ +--- ../old/libvorbis-1.2.0.dfsg/lib/misc.h 2007-07-24 00:09:47.000000000 +0000 ++++ libvorbis-1.2.0.dfsg/lib/misc.h 2008-05-23 08:29:23.000000000 +0000 +@@ -29,8 +29,9 @@ + #ifdef DEBUG_MALLOC + + #define _VDBG_GRAPHFILE "malloc.m" +-extern void *_VDBG_malloc(void *ptr,long bytes,char *file,long line); +-extern void _VDBG_free(void *ptr,char *file,long line); ++#undef _VDBG_GRAPHFILE ++void *_VDBG_malloc(void *ptr,long bytes,char *file,long line); ++void _VDBG_free(void *ptr,char *file,long line); + + #ifndef MISC_C + #undef _ogg_malloc +--- ../old/libvorbis-1.2.0.dfsg/lib/res0.c 2007-07-24 00:09:47.000000000 +0000 ++++ libvorbis-1.2.0.dfsg/lib/res0.c 2008-05-23 08:22:57.000000000 +0000 +@@ -223,6 +223,20 @@ + for(j=0;jbooklist[j]>=ci->books)goto errout; + ++ /* verify the phrasebook is not specifying an impossible or ++ inconsistent partitioning scheme. */ ++ { ++ int entries = ci->book_param[info->groupbook]->entries; ++ int dim = ci->book_param[info->groupbook]->dim; ++ int partvals = 1; ++ while(dim>0){ ++ partvals *= info->partitions; ++ if(partvals > entries) goto errout; ++ dim--; ++ } ++ if(partvals != entries) goto errout; ++ } ++ + return(info); + errout: + res0_free_info(info); +@@ -263,7 +277,7 @@ + } + } + +- look->partvals=rint(pow((float)look->parts,(float)dim)); ++ look->partvals=look->phrasebook->entries; + look->stages=maxstage; + look->decodemap=_ogg_malloc(look->partvals*sizeof(*look->decodemap)); + for(j=0;jpartvals;j++){ --- libvorbis-1.2.0.dfsg.orig/debian/patches/series +++ libvorbis-1.2.0.dfsg/debian/patches/series @@ -0,0 +1,3 @@ +local-remove_nonfree_docs.diff +CVE-2008-1420.patch +CVE-2008-1423+CVE-2008-1419.patch --- libvorbis-1.2.0.dfsg.orig/debian/patches/local-remove_nonfree_docs.diff +++ libvorbis-1.2.0.dfsg/debian/patches/local-remove_nonfree_docs.diff @@ -0,0 +1,55 @@ +--- libvorbis-1.2.0.dfsg.orig/doc/Makefile.am ++++ libvorbis-1.2.0.dfsg/doc/Makefile.am +@@ -6,8 +6,6 @@ + + ### all of the static docs, commited to SVN and included as is + static_docs = \ +- draft-ietf-avt-rtp-vorbis-06.xml \ +- draft-ietf-avt-rtp-vorbis-06.txt \ + eightphase.png \ + evenlsp.png \ + floor1_inverse_dB_table.html \ +@@ -100,10 +98,6 @@ + $(BUILDDIR)/Vorbis_I_spec.xml: $(doc_sources) + @mkdir -p $(BUILDDIR) + @for file in $(doc_sources); do cp $(srcdir)/$$file $(BUILDDIR); done +-# translate the draft rtp.txt to .xml in the BUILDDIR +-$(BUILDDIR)/draft-rtp.xml: draft-ietf-avt-rtp-vorbis-05.txt +- cat $< | sed 's/ //g' > $@ +-# cat $< | sed 's/ //g' | sed 's//\>/g' > $@ + + # explicit rules for generating docs + if BUILD_DOCS +--- libvorbis-1.2.0.dfsg.orig/doc/Makefile.in ++++ libvorbis-1.2.0.dfsg/doc/Makefile.in +@@ -201,8 +201,6 @@ + + ### all of the static docs, commited to SVN and included as is + static_docs = \ +- draft-ietf-avt-rtp-vorbis-06.xml \ +- draft-ietf-avt-rtp-vorbis-06.txt \ + eightphase.png \ + evenlsp.png \ + floor1_inverse_dB_table.html \ +@@ -628,10 +626,6 @@ + $(BUILDDIR)/Vorbis_I_spec.xml: $(doc_sources) + @mkdir -p $(BUILDDIR) + @for file in $(doc_sources); do cp $(srcdir)/$$file $(BUILDDIR); done +-# translate the draft rtp.txt to .xml in the BUILDDIR +-$(BUILDDIR)/draft-rtp.xml: draft-ietf-avt-rtp-vorbis-05.txt +- cat $< | sed 's/ //g' > $@ +-# cat $< | sed 's/ //g' | sed 's//\>/g' > $@ + + # explicit rules for generating docs + @BUILD_DOCS_TRUE@Vorbis_I_spec.html: $(SPEC_PNG_BUILD) $(BUILDDIR)/Vorbis_I_spec.xml +--- libvorbis-1.2.0.dfsg.orig/doc/index.html ++++ libvorbis-1.2.0.dfsg/doc/index.html +@@ -84,8 +84,6 @@ +
  • Vorbis I specification [html] + [pdf]
    • +
  • Vorbis comment header specification
    • +-
  • Embedding Vorbis encoded +-audio in an RTP payload format
    • + + +

    Ogg Vorbis programming documents

    --- libvorbis-1.2.0.dfsg.orig/debian/copyright +++ libvorbis-1.2.0.dfsg/debian/copyright @@ -0,0 +1,40 @@ +This package was debianized by Christopher L Cheney on +Tue, 31 Oct 2000 15:08:22 -0600. + +It was downloaded from http://www.xiph.org/downloads/: + + URL: + +Upstream Author: Monty + +Copyright: + +Copyright (c) 2002, Xiph.org Foundation + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: + +- Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + +- Redistributions in binary form must reproduce the above copyright +notice, this list of conditions and the following disclaimer in the +documentation and/or other materials provided with the distribution. + +- Neither the name of the Xiph.org Foundation nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR +CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, +EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR +PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF +LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING +NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS +SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + --- libvorbis-1.2.0.dfsg.orig/debian/README.Source +++ libvorbis-1.2.0.dfsg/debian/README.Source @@ -0,0 +1,8 @@ +The upstream source package is modified as follows, and repacked as the +"dfsg" version: + +remove doc/draft-kerr-avt-vorbis-rtp-03.txt +remove doc/draft-kerr-avt-vorbis-rtp-03.xml + +These files are a draft RFC that is not licensed under a +DFSG-free license, so cannot be included in Debian. --- libvorbis-1.2.0.dfsg.orig/debian/libvorbisenc2.symbols +++ libvorbis-1.2.0.dfsg/debian/libvorbisenc2.symbols @@ -0,0 +1,23 @@ +libvorbisenc.so.2 libvorbisenc2 #MINVER# + ve_setup_11_stereo@Base 1.1.2 + ve_setup_11_uncoupled@Base 1.1.2 + ve_setup_16_stereo@Base 1.1.2 + ve_setup_16_uncoupled@Base 1.1.2 + ve_setup_22_stereo@Base 1.1.2 + ve_setup_22_uncoupled@Base 1.1.2 + ve_setup_32_stereo@Base 1.1.2 + ve_setup_32_uncoupled@Base 1.1.2 + ve_setup_44_stereo@Base 1.1.2 + ve_setup_44_uncoupled@Base 1.1.2 + ve_setup_8_stereo@Base 1.1.2 + ve_setup_8_uncoupled@Base 1.1.2 + ve_setup_XX_stereo@Base 1.1.2 + ve_setup_XX_uncoupled@Base 1.1.2 + ve_setup_X_stereo@Base 1.1.2 + ve_setup_X_uncoupled@Base 1.1.2 + vorbis_encode_ctl@Base 1.1.2 + vorbis_encode_init@Base 1.1.2 + vorbis_encode_init_vbr@Base 1.1.2 + vorbis_encode_setup_init@Base 1.1.2 + vorbis_encode_setup_managed@Base 1.1.2 + vorbis_encode_setup_vbr@Base 1.1.2