[Buildroot] [PATCH] package/libsndfile: add upstream post-1.0.28 security fixes

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > Fixes the following security vulnerabilities:
 > CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero error exists in the
 > function double64_init() in double64.c, which may lead to DoS when playing a
 > crafted audio file

 > CVE-2017-17456: The function d2alaw_array() in alaw.c of libsndfile
 > 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address
 > 0x000000000000), a different vulnerability than CVE-2017-14245

 > CVE-2017-17457: The function d2ulaw_array() in ulaw.c of libsndfile
 > 1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address
 > 0x000000000000), a different vulnerability than CVE-2017-14246

 > CVE-2018-13139: A stack-based buffer overflow in psf_memset in common.c in
 > libsndfile 1.0.28 allows remote attackers to cause a denial of service
 > (application crash) or possibly have unspecified other impact via a crafted
 > audio file.  The vulnerability can be triggered by the executable
 > sndfile-deinterleave

 > CVE-2018-19661: An issue was discovered in libsndfile 1.0.28.  There is a
 > buffer over-read in the function i2ulaw_array in ulaw.c that will lead to a
 > denial of service

 > CVE-2018-19662: An issue was discovered in libsndfile 1.0.28.  There is a
 > buffer over-read in the function i2alaw_array in alaw.c that will lead to a
 > denial of service

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed, thanks.

-- 
Bye, Peter Korsgaard