From bcea03f7a02462f7dacf089aef0fdd5c1d9cb776 Mon Sep 17 00:00:00 2001 From: hdliu Date: Fri, 24 Oct 2025 10:11:03 +0800 Subject: [PATCH] Fix CVE-2025-50950 Signed-off-by: hdliu --- audiofile-fix-CVE-2025-50950.patch | 28 ++++++++++++++++++++++++++++ audiofile.spec | 6 +++++- 2 files changed, 33 insertions(+), 1 deletion(-) create mode 100644 audiofile-fix-CVE-2025-50950.patch diff --git a/audiofile-fix-CVE-2025-50950.patch b/audiofile-fix-CVE-2025-50950.patch new file mode 100644 index 0000000..58e54fb --- /dev/null +++ b/audiofile-fix-CVE-2025-50950.patch @@ -0,0 +1,28 @@ +From c372fb2470e9d2a9f2942337538b56b6f6df78d0 Mon Sep 17 00:00:00 2001 +From: xiaoxiaoafeifei +Date: Mon, 28 Oct 2024 00:00:00 +0000 +Subject: [PATCH] fix null pointer dereference + +Signed-off-by: xiaoxiaoafeifei +--- + libaudiofile/modules/ModuleState.cpp | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/libaudiofile/modules/ModuleState.cpp b/libaudiofile/modules/ModuleState.cpp +index 0c29d7a..deed7bb 100644 +--- a/libaudiofile/modules/ModuleState.cpp ++++ b/libaudiofile/modules/ModuleState.cpp +@@ -118,6 +118,10 @@ status ModuleState::setup(AFfilehandle file, Track *track) + return AF_FAIL; + } + ++ ++ if (!m_fileModule) ++ return AF_FAIL; ++ + if (arrange(file, track) == AF_FAIL) + return AF_FAIL; + +-- +2.33.0 + diff --git a/audiofile.spec b/audiofile.spec index 67368dd..5c26dd0 100644 --- a/audiofile.spec +++ b/audiofile.spec @@ -1,6 +1,6 @@ Name: audiofile Version: 0.3.6 -Release: 28 +Release: 29 Summary: Library for reading and writing audio files in many common formats License: LGPLv2+ and GPLv2+ URL: http://audiofile.68k.org/ @@ -13,6 +13,7 @@ Patch4: backport-CVE-2017-6829.patch Patch5: backport-CVE-2017-6831.patch Patch6: backport-CVE-2017-6838.patch Patch7: backport-CVE-2017-6839.patch +Patch8: audiofile-fix-CVE-2025-50950.patch BuildRequires: gcc-c++ libtool alsa-lib-devel flac-devel chrpath @@ -82,6 +83,9 @@ chrpath --delete %{buildroot}%{_bindir}/sfconvert %{_mandir}/man3/* %changelog +* Fri Oct 24 2025 hdliu - 0.3.6-29 +- Fix CVE-2025-50950 + * Tue Nov 15 2022 dillon chen - 0.3.6-28 - Remove check when flac >= 1.3.4 -- Gitee