media-sound/vorbis-tools: applied buffer overflow fix

Bug: https://bugs.gentoo.org/918549
Signed-off-by: Miroslav Šulc <fordfrog@gentoo.org>

2 files changed, 34 insertions, 2 deletions

diff --git a/media-sound/vorbis-tools/files/vorbis-tools-1.4.2-docdir.patch b/media-sound/vorbis-tools/files/vorbis-tools-1.4.2-docdir.patch
index faec14fe65c6..3dc0bd1892f8 100644
--- a/media-sound/vorbis-tools/files/vorbis-tools-1.4.2-docdir.patch
+++ b/media-sound/vorbis-tools/files/vorbis-tools-1.4.2-docdir.patch
@@ -1,8 +1,8 @@
 Thanks-to: Chris Mayo
 https://bugs.gentoo.org/533774
 
---- a/configure	2021-01-21 10:14:17.000000000 +0100
-+++ b/configure	2021-01-23 14:24:06.178883282 +0100
+--- a/configure
++++ b/configure
 @@ -937,7 +937,7 @@
  runstatedir='${localstatedir}/run'
  includedir='${prefix}/include'
diff --git a/media-sound/vorbis-tools/files/vorbis-tools-1.4.2-fix-buffer-overflow.patch b/media-sound/vorbis-tools/files/vorbis-tools-1.4.2-fix-buffer-overflow.patch
new file mode 100644
index 000000000000..20d4b65e2630
--- /dev/null
+++ b/media-sound/vorbis-tools/files/vorbis-tools-1.4.2-fix-buffer-overflow.patch
@@ -0,0 +1,32 @@
+fix from https://gitlab.xiph.org/xiph/vorbis-tools/-/merge_requests/7
+
+ diff --git a/oggenc/platform.c b/oggenc/platform.c
+ index 6d9f4ef..b66e47a 100644
+ --- a/oggenc/platform.c
+ +++ b/oggenc/platform.c
+ @@ -136,18 +136,22 @@ int create_directories(char *fn, int isutf8)
+  {
+      char *end, *start;
+      struct stat statbuf;
+ -    char *segment = malloc(strlen(fn)+1);
+ +    const size_t fn_len = strlen(fn);
+ +    char *segment = malloc(fn_len+1);
+  #ifdef _WIN32
+      wchar_t seg[MAX_PATH+1];
+  #endif
+  
+      start = fn;
+  #ifdef _WIN32
+ -    if(strlen(fn) >= 3 && isalpha(fn[0]) && fn[1]==':')
+ +    // Strip drive prefix
+ +    if(fn_len >= 3 && isalpha(fn[0]) && fn[1]==':') {
+ + 
+          start = start+2;
+  #endif
+  
+ -    while((end = strpbrk(start+1, PATH_SEPS)) != NULL)
+ +    // Loop through path segments, creating directories if necessary
+ +    while((end = strpbrk(start + strspn(start, PATH_SEPS), PATH_SEPS)) != NULL)
+      {
+          int rv;
+          memcpy(segment, fn, end-fn);