Update milkytracker to 1.03.00.

This commit is contained in:
fcambus 2020-12-10 14:12:51 +00:00
parent f3e3983780
commit 4745729093
8 changed files with 6 additions and 200 deletions

View File

@ -1,13 +1,12 @@
# $OpenBSD: Makefile,v 1.26 2020/09/10 07:25:23 fcambus Exp $
# $OpenBSD: Makefile,v 1.27 2020/12/10 14:12:51 fcambus Exp $
COMMENT = Fasttracker II inspired MOD tracker
GH_ACCOUNT = milkytracker
GH_PROJECT = MilkyTracker
GH_TAGNAME = v1.02.00
GH_TAGNAME = v1.03.00
PKGNAME = ${DISTNAME:L}
REVISION = 7
CATEGORIES = audio

View File

@ -1,2 +1,2 @@
SHA256 (MilkyTracker-1.02.00.tar.gz) = a8tudO4zPoMRN0NaJcDy89puFGKGTe7J5pPvfSOhYCM=
SIZE (MilkyTracker-1.02.00.tar.gz) = 3753882
SHA256 (MilkyTracker-1.03.00.tar.gz) = ctU1fjAzgLUjg7ZrUflEp3zXfis7/rIn2HzA5yqykvc=
SIZE (MilkyTracker-1.03.00.tar.gz) = 3705395

View File

@ -1,24 +0,0 @@
$OpenBSD: patch-src_milkyplay_LoaderS3M_cpp,v 1.1 2019/11/17 19:01:53 fcambus Exp $
Fix for CVE-2019-14464.
- Heap-based buffer overflow in XMFile::read()
Upstream commit fd607a3439fcdd0992e5efded3c16fc79c804e34.
Index: src/milkyplay/LoaderS3M.cpp
--- src/milkyplay/LoaderS3M.cpp.orig
+++ src/milkyplay/LoaderS3M.cpp
@@ -340,7 +340,11 @@ mp_sint32 LoaderS3M::load(XMFileBase& f, XModule* modu
return MP_OUT_OF_MEMORY;
header->insnum = f.readWord(); // number of instruments
- header->patnum = f.readWord(); // number of patterns
+ if (header->insnum > MP_MAXINS)
+ return MP_LOADER_FAILED;
+ header->patnum = f.readWord(); // number of patterns
+ if (header->patnum > 256)
+ return MP_LOADER_FAILED;
mp_sint32 flags = f.readWord(); // st3 flags

View File

@ -1,90 +0,0 @@
$OpenBSD: patch-src_milkyplay_LoaderXM_cpp,v 1.1 2019/11/17 19:01:53 fcambus Exp $
Fixes for CVE-2019-14496 and CVE-2019-14497.
- Stack-based buffer overflow in LoaderXM::load()
- Heap-based buffer overflow in ModuleEditor::convertInstrument()
Upstream commit ea7772a3fae0a9dd0a322e8fec441d15843703b7.
Index: src/milkyplay/LoaderXM.cpp
--- src/milkyplay/LoaderXM.cpp.orig
+++ src/milkyplay/LoaderXM.cpp
@@ -63,8 +63,8 @@ const char* LoaderXM::identifyModule(const mp_ubyte* b
mp_sint32 LoaderXM::load(XMFileBase& f, XModule* module)
{
mp_ubyte insData[230];
- mp_sint32 smpReloc[96];
- mp_ubyte nbu[96];
+ mp_sint32 smpReloc[MP_MAXINSSAMPS];
+ mp_ubyte nbu[MP_MAXINSSAMPS];
mp_uint32 fileSize = 0;
module->cleanUp();
@@ -117,6 +117,8 @@ mp_sint32 LoaderXM::load(XMFileBase& f, XModule* modul
memcpy(header->ord, hdrBuff+16, 256);
if(header->ordnum > MP_MAXORDERS)
header->ordnum = MP_MAXORDERS;
+ if(header->insnum > MP_MAXINS)
+ return MP_LOADER_FAILED;
delete[] hdrBuff;
@@ -143,7 +145,7 @@ mp_sint32 LoaderXM::load(XMFileBase& f, XModule* modul
f.read(&instr[y].type,1,1);
mp_uword numSamples = 0;
f.readWords(&numSamples,1);
- if(numSamples > 96)
+ if(numSamples > MP_MAXINSSAMPS)
return MP_LOADER_FAILED;
instr[y].samp = numSamples;
@@ -169,8 +171,8 @@ mp_sint32 LoaderXM::load(XMFileBase& f, XModule* modul
if (instr[y].samp) {
mp_ubyte* insDataPtr = insData;
- memcpy(nbu, insDataPtr, 96);
- insDataPtr+=96;
+ memcpy(nbu, insDataPtr, MP_MAXINSSAMPS);
+ insDataPtr+=MP_MAXINSSAMPS;
TEnvelope venv;
TEnvelope penv;
@@ -285,7 +287,7 @@ mp_sint32 LoaderXM::load(XMFileBase& f, XModule* modul
instr[y].samp = g;
- for (sc = 0; sc < 96; sc++) {
+ for (sc = 0; sc < MP_MAXINSSAMPS; sc++) {
if (smpReloc[nbu[sc]] == -1)
instr[y].snum[sc] = -1;
else
@@ -491,6 +493,8 @@ mp_sint32 LoaderXM::load(XMFileBase& f, XModule* modul
f.read(&instr[y].type,1,1);
f.readWords(&instr[y].samp,1);
}
+ if (instr[y].samp > MP_MAXINSSAMPS)
+ return MP_LOADER_FAILED;
//printf("%i, %i\n", instr[y].size, instr[y].samp);
@@ -532,8 +536,8 @@ mp_sint32 LoaderXM::load(XMFileBase& f, XModule* modul
//f.read(&nbu,1,96);
- memcpy(nbu, insDataPtr, 96);
- insDataPtr+=96;
+ memcpy(nbu, insDataPtr, MP_MAXINSSAMPS);
+ insDataPtr+=MP_MAXINSSAMPS;
TEnvelope venv;
TEnvelope penv;
@@ -650,7 +654,7 @@ mp_sint32 LoaderXM::load(XMFileBase& f, XModule* modul
instr[y].samp = g;
- for (sc = 0; sc < 96; sc++) {
+ for (sc = 0; sc < MP_MAXINSSAMPS; sc++) {
if (smpReloc[nbu[sc]] == -1)
instr[y].snum[sc] = -1;
else

View File

@ -1,21 +0,0 @@
$OpenBSD: patch-src_milkyplay_XModule_h,v 1.1 2019/11/17 19:01:53 fcambus Exp $
Fixes for CVE-2019-14496 and CVE-2019-14497.
- Stack-based buffer overflow in LoaderXM::load()
- Heap-based buffer overflow in ModuleEditor::convertInstrument()
Upstream commit ea7772a3fae0a9dd0a322e8fec441d15843703b7.
Index: src/milkyplay/XModule.h
--- src/milkyplay/XModule.h.orig
+++ src/milkyplay/XModule.h
@@ -40,6 +40,8 @@
#define MP_MAXTEXT 32
#define MP_MAXORDERS 256
+#define MP_MAXINS 255
+#define MP_MAXINSSAMPS 96
struct TXMHeader
{

View File

@ -1,26 +0,0 @@
$OpenBSD: patch-src_ppui_fastfill_h,v 1.1 2020/04/28 22:35:24 cwen Exp $
powerpc fix for "error: invalid operand for instruction" in asm code
see https://github.com/milkytracker/MilkyTracker/pull/210
Index: src/ppui/fastfill.h
--- src/ppui/fastfill.h.orig
+++ src/ppui/fastfill.h
@@ -34,7 +34,7 @@ static __attribute__((noinline)) void fill_dword(pp_ui
static inline void fill_dword(pp_uint32* buff, pp_uint32 dw, pp_uint32 len)
#endif
{
-#if defined(__ppc__) && defined(__GNUC__)
+#if defined(__ppc__) && defined(__GNUC__) && !defined(__clang__)
// PPC assembly FTW!!1!
// r3 = buff
// r4 = dw
@@ -94,7 +94,7 @@ static __attribute__((noinline)) void fill_dword_verti
static inline void fill_dword_vertical(pp_uint32* buff, pp_uint32 dw, pp_uint32 len, pp_uint32 pitch)
#endif
{
-#if defined(__ppc__) && defined(__GNUC__)
+#if defined(__ppc__) && defined(__GNUC__) && !defined(__clang__)
asm volatile("nop\n" // align loop start to 16 byte boundary
"nop\n" // same
"nop\n" // same

View File

@ -1,14 +0,0 @@
$OpenBSD: patch-src_tracker_EQConstants_cpp,v 1.1 2018/04/08 19:20:50 fcambus Exp $
Index: src/tracker/EQConstants.cpp
--- src/tracker/EQConstants.cpp.orig
+++ src/tracker/EQConstants.cpp
@@ -23,7 +23,7 @@
#include "EQConstants.h"
#include "math.h"
-#define p(e) ldexp(0x10558, e-4*4)
+#define p(e) ldexp(66904.0f, e-4*4)
const float EQConstants::EQ3bands[3] =
{

View File

@ -1,26 +1,8 @@
$OpenBSD: patch-src_tracker_sdl_SDL_Main_cpp,v 1.4 2018/04/08 19:20:50 fcambus Exp $
$OpenBSD: patch-src_tracker_sdl_SDL_Main_cpp,v 1.5 2020/12/10 14:12:51 fcambus Exp $
Index: src/tracker/sdl/SDL_Main.cpp
--- src/tracker/sdl/SDL_Main.cpp.orig
+++ src/tracker/sdl/SDL_Main.cpp
@@ -609,7 +609,7 @@ void translateKeyDownEvent(const SDL_Event& event)
printf ("DEBUG: Key pressed: VK: %d, SC: %d, Scancode: %d\n", toVK(keysym), toSC(keysym), keysym.sym);
#endif
- pp_uint16 chr[3] = {toVK(keysym), toSC(keysym), keysym.sym};
+ pp_uint16 chr[3] = {toVK(keysym), toSC(keysym), static_cast<pp_uint16> (keysym.sym)};
PPEvent myEvent(eKeyDown, &chr, sizeof(chr));
RaiseEventSerialized(&myEvent);
@@ -621,7 +621,7 @@ void translateKeyUpEvent(const SDL_Event& event)
preTranslateKey(keysym);
- pp_uint16 chr[3] = {toVK(keysym), toSC(keysym), keysym.sym};
+ pp_uint16 chr[3] = {toVK(keysym), toSC(keysym), static_cast<pp_uint16> (keysym.sym)};
PPEvent myEvent(eKeyUp, &chr, sizeof(chr));
RaiseEventSerialized(&myEvent);
@@ -669,7 +669,7 @@ void processSDLUserEvents(const SDL_UserEvent& event)
@@ -670,7 +670,7 @@ void processSDLUserEvents(const SDL_UserEvent& event)
{
union {
void *ptr;