libid3tag: patch CVE-2017-11550 and CVE-2017-11551

[periklis]

Motivation for this change

cc #47122

Fixes:

• CVE-2017-11550
• CVE-2017-11551

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Fits CONTRIBUTING.md.

---

[periklis]

cc @ckauhaus

[fpletz]

@GrahamcOfBorg build libid3tag minidlna

[GrahamcOfBorg]

Success on x86_64-darwin (full log)

Attempted: libid3tag

The following builds were skipped because they don't evaluate on x86_64-darwin: minidlna

Partial log (click to expand)

make[1]: Leaving directory '/private/tmp/nix-build-libid3tag-0.15.1b.drv-0/libid3tag-0.15.1b'
post-installation fixup
Patching '/nix/store/dy83qdmpjl6wzg6h3mv5nf6m7najqyl2-libid3tag-0.15.1b-dev/lib/pkgconfig/id3tag.pc' includedir to output /nix/store/dy83qdmpjl6wzg6h3mv5nf6m7najqyl2-libid3tag-0.15.1b-dev
strip is /nix/store/g5r4apl0za012ffs6ladinwa5w0m1l3k-cctools-binutils-darwin/bin/strip
stripping (with command strip and flags -S) in /nix/store/1awcapb7dvbbvvx9j5h4vnbyrbzdfb2p-libid3tag-0.15.1b/lib
patching script interpreter paths in /nix/store/1awcapb7dvbbvvx9j5h4vnbyrbzdfb2p-libid3tag-0.15.1b
strip is /nix/store/g5r4apl0za012ffs6ladinwa5w0m1l3k-cctools-binutils-darwin/bin/strip
stripping (with command strip and flags -S) in /nix/store/dy83qdmpjl6wzg6h3mv5nf6m7najqyl2-libid3tag-0.15.1b-dev/lib
patching script interpreter paths in /nix/store/dy83qdmpjl6wzg6h3mv5nf6m7najqyl2-libid3tag-0.15.1b-dev
/nix/store/1awcapb7dvbbvvx9j5h4vnbyrbzdfb2p-libid3tag-0.15.1b

[GrahamcOfBorg]

Success on x86_64-linux (full log)

Attempted: libid3tag, minidlna

Partial log (click to expand)

shrinking RPATHs of ELF executables and libraries in /nix/store/krsjr7ri7nrxslm3gs7bm52451nv1yz6-minidlna-1.2.1
shrinking /nix/store/krsjr7ri7nrxslm3gs7bm52451nv1yz6-minidlna-1.2.1/sbin/minidlnad
gzipping man pages under /nix/store/krsjr7ri7nrxslm3gs7bm52451nv1yz6-minidlna-1.2.1/share/man/
strip is /nix/store/vcc4svb8gy29g4pam2zja6llkbcwsyiq-binutils-2.30/bin/strip
stripping (with command strip and flags -S) in /nix/store/krsjr7ri7nrxslm3gs7bm52451nv1yz6-minidlna-1.2.1/sbin
patching script interpreter paths in /nix/store/krsjr7ri7nrxslm3gs7bm52451nv1yz6-minidlna-1.2.1
checking for references to /build in /nix/store/krsjr7ri7nrxslm3gs7bm52451nv1yz6-minidlna-1.2.1...
moving /nix/store/krsjr7ri7nrxslm3gs7bm52451nv1yz6-minidlna-1.2.1/sbin/* to /nix/store/krsjr7ri7nrxslm3gs7bm52451nv1yz6-minidlna-1.2.1/bin
/nix/store/k49j5cwihrmkkhl9izscbwin2agijqcp-libid3tag-0.15.1b
/nix/store/krsjr7ri7nrxslm3gs7bm52451nv1yz6-minidlna-1.2.1

[GrahamcOfBorg]

Success on aarch64-linux (full log)

Attempted: libid3tag, minidlna

Partial log (click to expand)

shrinking RPATHs of ELF executables and libraries in /nix/store/wp2shvysdh1ngv5faqjacn1y3i4psw69-minidlna-1.2.1
shrinking /nix/store/wp2shvysdh1ngv5faqjacn1y3i4psw69-minidlna-1.2.1/sbin/minidlnad
gzipping man pages under /nix/store/wp2shvysdh1ngv5faqjacn1y3i4psw69-minidlna-1.2.1/share/man/
strip is /nix/store/p9akxn2sfy4wkhqdqa3li97pc6jaz3r1-binutils-2.30/bin/strip
stripping (with command strip and flags -S) in /nix/store/wp2shvysdh1ngv5faqjacn1y3i4psw69-minidlna-1.2.1/sbin
patching script interpreter paths in /nix/store/wp2shvysdh1ngv5faqjacn1y3i4psw69-minidlna-1.2.1
checking for references to /build in /nix/store/wp2shvysdh1ngv5faqjacn1y3i4psw69-minidlna-1.2.1...
moving /nix/store/wp2shvysdh1ngv5faqjacn1y3i4psw69-minidlna-1.2.1/sbin/* to /nix/store/wp2shvysdh1ngv5faqjacn1y3i4psw69-minidlna-1.2.1/bin
/nix/store/vhsid9736vi5af84cjilx17lz1vsik0v-libid3tag-0.15.1b
/nix/store/wp2shvysdh1ngv5faqjacn1y3i4psw69-minidlna-1.2.1

[ckauhaus]

Tried on Ubuntu (works)

Tried to compile easytag with it and manipulated some mp3 files (works)

+1

@Fuuzetsu