Fix: fix CVE-2022-33065 CVE-2024-50612 CVE-2021-4156

debian/changelog

@@ -1,3 +1,9 @@
+libsndfile (1.0.31-2deepin2) unstable; urgency=medium
+
+  * fix CVE-2022-33065 CVE-2024-50612 CVE-2021-4156
+
+ -- zengwei <[email protected]>  Tue, 23 Dec 2025 16:48:07 +0800
+
 libsndfile (1.0.31-2deepin1) unstable; urgency=medium
 
   * feat: add sw64 support.

debian/patches/CVE-2021-4156.patch

@@ -0,0 +1,24 @@
+From: yuan <[email protected]>
+Date: Tue, 20 Apr 2021 16:16:32 +0800
+Subject: flac: Fix improper buffer reusing (#732)
+
+---
+ src/flac.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/flac.c b/src/flac.c
+index 64d0172..e332045 100644
+--- a/src/flac.c
++++ b/src/flac.c
+@@ -948,7 +948,11 @@ flac_read_loop (SF_PRIVATE *psf, unsigned len)
+ 	/* Decode some more. */
+ 	while (pflac->pos < pflac->len)
+ 	{	if (FLAC__stream_decoder_process_single (pflac->fsd) == 0)
++		{	psf_log_printf (psf, "FLAC__stream_decoder_process_single returned false\n") ;
++			/* Current frame is busted, so NULL the pointer. */
++			pflac->frame = NULL ;
+ 			break ;
++			} ;
+ 		state = FLAC__stream_decoder_get_state (pflac->fsd) ;
+ 		if (state >= FLAC__STREAM_DECODER_END_OF_STREAM)
+ 		{	psf_log_printf (psf, "FLAC__stream_decoder_get_state returned %s\n", FLAC__StreamDecoderStateString [state]) ;

debian/patches/CVE-2022-33065.patch

@@ -0,0 +1,16 @@
+From 0754562e13d2e63a248a1c82f90b30bc0ffe307c Mon Sep 17 00:00:00 2001
+From: Alex Stewart <[email protected]>
+Date: Tue, 10 Oct 2023 16:10:34 -0400
+Subject: [PATCH] mat4/mat5: fix int overflow in dataend calculation
+
+--- libsndfile-1.2.0.orig/src/mat4.c
++++ libsndfile-1.2.0/src/mat4.c
+@@ -320,7 +320,7 @@ mat4_read_header (SF_PRIVATE *psf)
+ 				psf->filelength - psf->dataoffset, psf->sf.channels * psf->sf.frames * psf->bytewidth) ;
+ 		}
+ 	else if ((psf->filelength - psf->dataoffset) > psf->sf.channels * psf->sf.frames * psf->bytewidth)
+-		psf->dataend = psf->dataoffset + rows * cols * psf->bytewidth ;
++		psf->dataend = psf->dataoffset + (sf_count_t) rows * (sf_count_t) cols * psf->bytewidth ;
+
+ 	psf->datalength = psf->filelength - psf->dataoffset - psf->dataend ;
+