From 2238a89fde08d1c41c8fdade2ff75f2dc0218dc5 Mon Sep 17 00:00:00 2001 From: hdliu Date: Fri, 24 Oct 2025 11:06:54 +0800 Subject: [PATCH] Fix CVE-2025-50950 Signed-off-by: hdliu --- audiofile-fix-CVE-2025-50950.patch | 28 ++++++++++++++++++++++++++++ audiofile.spec | 8 ++++++-- 2 files changed, 34 insertions(+), 2 deletions(-) create mode 100644 audiofile-fix-CVE-2025-50950.patch diff --git a/audiofile-fix-CVE-2025-50950.patch b/audiofile-fix-CVE-2025-50950.patch new file mode 100644 index 0000000..58e54fb --- /dev/null +++ b/audiofile-fix-CVE-2025-50950.patch @@ -0,0 +1,28 @@ +From c372fb2470e9d2a9f2942337538b56b6f6df78d0 Mon Sep 17 00:00:00 2001 +From: xiaoxiaoafeifei +Date: Mon, 28 Oct 2024 00:00:00 +0000 +Subject: [PATCH] fix null pointer dereference + +Signed-off-by: xiaoxiaoafeifei +--- + libaudiofile/modules/ModuleState.cpp | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/libaudiofile/modules/ModuleState.cpp b/libaudiofile/modules/ModuleState.cpp +index 0c29d7a..deed7bb 100644 +--- a/libaudiofile/modules/ModuleState.cpp ++++ b/libaudiofile/modules/ModuleState.cpp +@@ -118,6 +118,10 @@ status ModuleState::setup(AFfilehandle file, Track *track) + return AF_FAIL; + } + ++ ++ if (!m_fileModule) ++ return AF_FAIL; ++ + if (arrange(file, track) == AF_FAIL) + return AF_FAIL; + +-- +2.33.0 + diff --git a/audiofile.spec b/audiofile.spec index b41acf7..7a626ac 100644 --- a/audiofile.spec +++ b/audiofile.spec @@ -1,6 +1,6 @@ Name: audiofile Version: 0.3.6 -Release: 29 +Release: 30 Summary: Library for reading and writing audio files in many common formats License: LGPLv2+ and GPLv2+ URL: http://audiofile.68k.org/ @@ -13,7 +13,8 @@ Patch4: backport-CVE-2017-6829.patch Patch5: backport-CVE-2017-6831.patch Patch6: backport-CVE-2017-6838.patch Patch7: backport-CVE-2017-6839.patch -Patch8:backport-CVE-2022-24599.patch +Patch8: backport-CVE-2022-24599.patch +Patch9: audiofile-fix-CVE-2025-50950.patch BuildRequires: gcc-c++ libtool alsa-lib-devel flac-devel chrpath @@ -83,6 +84,9 @@ chrpath --delete %{buildroot}%{_bindir}/sfconvert %{_mandir}/man3/* %changelog +* Fri Oct 24 2025 hdliu - 0.3.6-30 +- Fix CVE-2025-50950 + * Fri Jan 10 2025 pengjian - 0.3.6-29 - enhances error checking and boundary verification in memory allocation to fix potential security vulnerabilities during audio file analysis. -- Gitee