rpms/xine-lib/F-7 xine-lib-1.1.12-CVE-2008-1878.patch, NONE, 1.1 xine-lib.spec, 1.25, 1.26

[Rex Dieter (rdieter)]

Author: rdieter

Update of /cvs/pkgs/rpms/xine-lib/F-7
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv9708

Modified Files:
	xine-lib.spec 
Added Files:
	xine-lib-1.1.12-CVE-2008-1878.patch 
Log Message:
* Thu Apr 24 2008 Rex Dieter <rdieter at fedoraproject.org> - 1.1.11.1-1.2
- CVE-2008-1878 (#443054)


xine-lib-1.1.12-CVE-2008-1878.patch:

--- NEW FILE xine-lib-1.1.12-CVE-2008-1878.patch ---
diff -up xine-lib-1.1.12/src/demuxers/demux_nsf.c.CVE-2008-1878 xine-lib-1.1.12/src/demuxers/demux_nsf.c
--- xine-lib-1.1.12/src/demuxers/demux_nsf.c.CVE-2008-1878	2008-03-28 09:24:50.000000000 -0500
+++ xine-lib-1.1.12/src/demuxers/demux_nsf.c	2008-04-24 06:52:45.000000000 -0500
@@ -106,9 +106,9 @@ static int open_nsf_file(demux_nsf_t *th
 
   this->total_songs = header[6];
   this->current_song = header[7];
-  this->title = strdup(&header[0x0E]);
-  this->artist = strdup(&header[0x2E]);
-  this->copyright = strdup(&header[0x4E]);
+  this->title = strndup((char*)&header[0x0E], 0x20);
+  this->artist = strndup((char*)&header[0x2E], 0x20);
+  this->copyright = strndup((char*)&header[0x4E], 0x20); 
 
   this->filesize = this->input->get_length(this->input);
 


Index: xine-lib.spec
===================================================================
RCS file: /cvs/pkgs/rpms/xine-lib/F-7/xine-lib.spec,v
retrieving revision 1.25
retrieving revision 1.26
diff -u -r1.25 -r1.26
--- xine-lib.spec	10 Apr 2008 04:30:10 -0000	1.25
+++ xine-lib.spec	24 Apr 2008 13:40:56 -0000	1.26
@@ -46,6 +46,7 @@
 Patch0:         %{name}-%{version}-autotools.patch.bz2
 Patch1:         %{name}-1.1.4-optflags.patch
 Patch6:         %{name}-1.1.1-deepbind-939.patch
+Patch7:         %{name}-1.1.12-CVE-2008-1878.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 # upstream patches
@@ -172,6 +173,7 @@
 touch -r m4/optimizations.m4.stamp m4/optimizations.m4
 # Patch6 needed at least when compiling with external ffmpeg, #939.
 %patch6 -p1 -b .deepbind
+%patch7 -p1 -b .CVE-2008-1878
 
 %patch101 -p1 -b .mkv
 %patch102 -p1 -b .qt
@@ -393,6 +395,9 @@
 
 
 %changelog
+* Thu Apr 24 2008 Rex Dieter <rdieter at fedoraproject.org> - 1.1.11.1-1.2
+- CVE-2008-1878 (#443054)
+
 * Wed Apr  9 2008 Ville Skyttä <ville.skytta at iki.fi> - 1.1.11.1-1.1
 - Apply upstream fixes for Quicktime (#441705) and Matroska regressions
   introduced in 1.1.11.1.