diff -Nru lame-3.99.5+repack1/debian/changelog lame-3.99.5+repack1/debian/changelog --- lame-3.99.5+repack1/debian/changelog 2015-02-09 21:46:41.000000000 +0000 +++ lame-3.99.5+repack1/debian/changelog 2015-02-25 20:03:47.000000000 +0000 @@ -1,8 +1,18 @@ -lame (3.99.5+repack1-6~ppa1) utopic; urgency=low +lame (3.99.5+repack1-7~ppa1) utopic; urgency=low * Backported from Debian unstable. - -- Nate Muench Mon, 09 Feb 2015 15:46:13 -0600 + -- Nate Muench Wed, 25 Feb 2015 14:03:31 -0600 + +lame (3.99.5+repack1-7) unstable; urgency=medium + + * Extend Maks Naumov's patch to also include a sanity check for + a valid amount of input channels (Closes: #778703). + * Fix decision if sample rate ratio is an integer value or not + (Closes: #778529). + * Thanks to Henri Salo for the bug reports and the fuzzed samples! + + -- Fabian Greffrath Tue, 24 Feb 2015 09:03:07 +0100 lame (3.99.5+repack1-6) unstable; urgency=high diff -Nru lame-3.99.5+repack1/debian/patches/0001-Add-check-for-invalid-input-sample-rate.patch lame-3.99.5+repack1/debian/patches/0001-Add-check-for-invalid-input-sample-rate.patch --- lame-3.99.5+repack1/debian/patches/0001-Add-check-for-invalid-input-sample-rate.patch 2015-02-06 08:24:34.000000000 +0000 +++ lame-3.99.5+repack1/debian/patches/0001-Add-check-for-invalid-input-sample-rate.patch 2015-02-19 06:18:28.000000000 +0000 @@ -14,7 +14,7 @@ } #endif -+ if (gfp->samplerate_in < 0) { ++ if (gfp->samplerate_in < 0 || gfp->num_channels < 0) { + freegfc(gfc); + gfp->internal_flags = NULL; + return -1; diff -Nru lame-3.99.5+repack1/debian/patches/int_resample_ratio.patch lame-3.99.5+repack1/debian/patches/int_resample_ratio.patch --- lame-3.99.5+repack1/debian/patches/int_resample_ratio.patch 1970-01-01 00:00:00.000000000 +0000 +++ lame-3.99.5+repack1/debian/patches/int_resample_ratio.patch 2015-02-24 06:29:29.000000000 +0000 @@ -0,0 +1,29 @@ +Subject: Fix decision if sample rate ratio is an integer value or not + If the sample rate of the input file is sufficiently close to an + integer multiple of the output sample rate, the value of the intratio + variable is calculated incorrectly. This leads to further values + being miscalculated up to the joff variable which is used as an index + to dereference the esv->blackfilt array. This leads top an overflow + and causes a segmentation fault. +Author: Fabian Greffrath +Bug-Debian: https://bugs.debian.org/778529 + +--- a/libmp3lame/util.c ++++ b/libmp3lame/util.c +@@ -26,6 +26,7 @@ + # include + #endif + ++#include + #include "lame.h" + #include "machine.h" + #include "encoder.h" +@@ -544,7 +545,7 @@ fill_buffer_resample(lame_internal_flags + if (bpc > BPC) + bpc = BPC; + +- intratio = (fabs(resample_ratio - floor(.5 + resample_ratio)) < .0001); ++ intratio = (fabs(resample_ratio - floor(.5 + resample_ratio)) < FLT_EPSILON); + fcn = 1.00 / resample_ratio; + if (fcn > 1.00) + fcn = 1.00; diff -Nru lame-3.99.5+repack1/debian/patches/series lame-3.99.5+repack1/debian/patches/series --- lame-3.99.5+repack1/debian/patches/series 2015-02-09 06:00:07.000000000 +0000 +++ lame-3.99.5+repack1/debian/patches/series 2015-02-18 10:35:11.000000000 +0000 @@ -5,3 +5,4 @@ msse.patch 0001-Add-check-for-invalid-input-sample-rate.patch bits_per_sample.patch +int_resample_ratio.patch