Thomas Perale 9c9c531d0b package/libmad: add patch for CVE-2017-837{2, 3, 4} ...

The commit [1] introduced fixes for the following CVEs:

- CVE-2017-8372: The mad_layer_III function in layer3.c in Underbit MAD
  libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause
  a denial of service (assertion failure and application exit) via a
  crafted audio file.
- CVE-2017-8373: The mad_layer_III function in layer3.c in Underbit MAD
  libmad 0.15.1b allows remote attackers to cause a denial of service
  (heap-based buffer overflow and application crash) or possibly have
  unspecified other impact via a crafted audio file.
- CVE-2017-8374: The mad_bit_skip function in bit.c in Underbit MAD
  libmad 0.15.1b allows remote attackers to cause a denial of service
  (heap-based buffer over-read and application crash) via a crafted
  audio file.

In commit [2], the patches ended up not being applied anymore because
the APPLY_PATCHES step was called before the patch content exists.

This commit import the fixes in Buildroot.

[1] 858df3643f package/libmad: switch to debian to fix CVEs
[2] b21184a877 package/libmad: update the patches to be applied with fuzz 0

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

2026-05-29 11:15:32 +02:00

..

0001-mips-h-constraint-removal.patch

…

0002-configure-ac-automake-foreign.patch

…

0003-drop-GCC-fforce-mem-option.patch

…

0004-md_size.patch

…

0005-length-check.patch

…

Config.in

…

libmad.hash

…

libmad.mk

…

mad.pc

…