user/sox: move to legacy/

This package has numerous CVEs and does not currently
build on our pmmx target. It is not required by any
other packages at the moment.

See also: #961.

1 files changed, 40 insertions, 0 deletions

diff --git a/legacy/sox/CVE-2017-15371.patch b/legacy/sox/CVE-2017-15371.patch
new file mode 100644
index 000000000..7b38943f2
--- /dev/null
+++ b/legacy/sox/CVE-2017-15371.patch
@@ -0,0 +1,40 @@
+From 968c689ad2c4269a1a853434d99aa7ebf0c01354 Mon Sep 17 00:00:00 2001
+From: Mans Rullgard <mans@mansr.com>
+Date: Sun, 5 Nov 2017 15:57:48 +0000
+Subject: [PATCH] flac: fix crash on corrupt metadata (CVE-2017-15371)
+
+---
+ src/flac.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/src/flac.c b/src/flac.c
+index 0d7829ec..07f45c1b 100644
+--- a/src/flac.c
++++ b/src/flac.c
+@@ -119,9 +119,10 @@ static void decoder_metadata_callback(FLAC__StreamDecoder const * const flac, FL
+     p->total_samples = metadata->data.stream_info.total_samples;
+   }
+   else if (metadata->type == FLAC__METADATA_TYPE_VORBIS_COMMENT) {
++    const FLAC__StreamMetadata_VorbisComment *vc = &metadata->data.vorbis_comment;
+     size_t i;
+ 
+-    if (metadata->data.vorbis_comment.num_comments == 0)
++    if (vc->num_comments == 0)
+       return;
+ 
+     if (ft->oob.comments != NULL) {
+@@ -129,8 +130,9 @@ static void decoder_metadata_callback(FLAC__StreamDecoder const * const flac, FL
+       return;
+     }
+ 
+-    for (i = 0; i < metadata->data.vorbis_comment.num_comments; ++i)
+-      sox_append_comment(&ft->oob.comments, (char const *) metadata->data.vorbis_comment.comments[i].entry);
++    for (i = 0; i < vc->num_comments; ++i)
++      if (vc->comments[i].entry)
++        sox_append_comment(&ft->oob.comments, (char const *) vc->comments[i].entry);
+   }
+ }
+ 
+-- 
+2.25.0
+