gnu: libmad: Apply fixes for ARMv7 Thumb, etc.

* gnu/packages/patches/libmad-armv7-thumb-pt1.patch,
  gnu/packages/patches/libmad-armv7-thumb-pt2.patch,
  gnu/packages/patches/libmad-frame-length.patch: New files.
* gnu-system.am (dist_patch_DATA): Add them.
* gnu/packages/mp3.scm (libmad)[source]: Add patches.

5 files changed, 259 insertions, 1 deletions

diff --git a/gnu-system.am b/gnu-system.am
index 2c361f2f1a..6302d22377 100644
--- a/gnu-system.am
+++ b/gnu-system.am
@@ -489,6 +489,9 @@ dist_patch_DATA =						\
   gnu/packages/patches/libcanberra-sound-theme-freedesktop.patch \
   gnu/packages/patches/libevent-dns-tests.patch			\
   gnu/packages/patches/liboop-mips64-deplibs-fix.patch		\
+  gnu/packages/patches/libmad-armv7-thumb-pt1.patch		\
+  gnu/packages/patches/libmad-armv7-thumb-pt2.patch		\
+  gnu/packages/patches/libmad-frame-length.patch		\
   gnu/packages/patches/libmad-mips-newgcc.patch			\
   gnu/packages/patches/libtheora-config-guess.patch		\
   gnu/packages/patches/libtiff-CVE-2012-4564.patch		\
diff --git a/gnu/packages/mp3.scm b/gnu/packages/mp3.scm
index 163e075f18..77eae65584 100644
--- a/gnu/packages/mp3.scm
+++ b/gnu/packages/mp3.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2014, 2015 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -52,7 +53,10 @@
             (sha256
              (base32
               "14460zhacxhswnzb36qfpd1f2wbk10qvksvm6wyq5hpvdgnw7ymv"))
-            (patches (list (search-patch "libmad-mips-newgcc.patch")))))
+            (patches (map search-patch '("libmad-armv7-thumb-pt1.patch"
+                                         "libmad-armv7-thumb-pt2.patch"
+                                         "libmad-frame-length.patch"
+                                         "libmad-mips-newgcc.patch")))))
    (build-system gnu-build-system)
    (arguments
     `(#:phases
diff --git a/gnu/packages/patches/libmad-armv7-thumb-pt1.patch b/gnu/packages/patches/libmad-armv7-thumb-pt1.patch
new file mode 100644
index 0000000000..86339ddad8
--- /dev/null
+++ b/gnu/packages/patches/libmad-armv7-thumb-pt1.patch
@@ -0,0 +1,16 @@
+Copied from Debian.
+
+From: Konstantinos Margaritis <markos@debian.org>
+Subject: use "adr" instead of "add" to make code ready for thumb2
+
+--- ./imdct_l_arm.S.orig	2010-02-25 13:25:23.000000000 +0100
++++ ./imdct_l_arm.S	2010-02-25 13:27:26.000000000 +0100
+@@ -468,7 +468,7 @@
+ 
+     @----
+ 
+-    add     r2, pc, #(imdct36_long_karray-.-8)  @ r2 = base address of Knn array (PIC safe ?)
++    adr     r2, imdct36_long_karray
+ 
+ 
+ loop:
diff --git a/gnu/packages/patches/libmad-armv7-thumb-pt2.patch b/gnu/packages/patches/libmad-armv7-thumb-pt2.patch
new file mode 100644
index 0000000000..bb450967e6
--- /dev/null
+++ b/gnu/packages/patches/libmad-armv7-thumb-pt2.patch
@@ -0,0 +1,36 @@
+Copied from Debian.
+
+From: Dave Martin
+Subject: "rsc" doesnt exist anymore in thumb2
+
+diff --git a/fixed.h b/fixed.h
+index 4b58abf..ba4bc26 100644
+--- a/fixed.h
++++ b/fixed.h
+@@ -275,12 +275,25 @@ mad_fixed_t mad_f_mul_inline(mad_fixed_t x, mad_fixed_t y)
+ 	 : "+r" (lo), "+r" (hi)  \
+ 	 : "%r" (x), "r" (y))
+ 
++#ifdef __thumb__
++/* In Thumb-2, the RSB-immediate instruction is only allowed with a zero
++	operand.  If needed this code can also support Thumb-1 
++	(simply append "s" to the end of the second two instructions). */
++#  define MAD_F_MLN(hi, lo)  \
++    asm ("rsbs        %0, %0, #0\n\t"  \
++	 "sbc   %1, %1, %1\n\t"  \
++	 "sub   %1, %1, %2"  \
++	 : "+&r" (lo), "=&r" (hi)  \
++	 : "r" (hi)  \
++	 : "cc")
++#else /* ! __thumb__ */
+ #  define MAD_F_MLN(hi, lo)  \
+     asm ("rsbs	%0, %2, #0\n\t"  \
+ 	 "rsc	%1, %3, #0"  \
+-	 : "=r" (lo), "=r" (hi)  \
++	 : "=&r" (lo), "=r" (hi)  \
+ 	 : "0" (lo), "1" (hi)  \
+ 	 : "cc")
++#endif /* __thumb__ */
+ 
+ #  define mad_f_scale64(hi, lo)  \
+     ({ mad_fixed_t __result;  \
diff --git a/gnu/packages/patches/libmad-frame-length.patch b/gnu/packages/patches/libmad-frame-length.patch
new file mode 100644
index 0000000000..3434eba577
--- /dev/null
+++ b/gnu/packages/patches/libmad-frame-length.patch
@@ -0,0 +1,199 @@
+Copied from Debian.
+
+; You can calculate where the next frame will start depending on things
+; like the bitrate. See mad_header_decode().  It seems that when decoding
+; the frame you can go past that boundary.  This attempts to catch those cases,
+; but might not catch all of them.
+; For more info see http://bugs.debian.org/508133
+Index: libmad-0.15.1b/layer12.c
+===================================================================
+--- libmad-0.15.1b.orig/layer12.c	2008-12-23 21:38:07.000000000 +0100
++++ libmad-0.15.1b/layer12.c	2008-12-23 21:38:12.000000000 +0100
+@@ -134,6 +134,12 @@
+   for (sb = 0; sb < bound; ++sb) {
+     for (ch = 0; ch < nch; ++ch) {
+       nb = mad_bit_read(&stream->ptr, 4);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+ 
+       if (nb == 15) {
+ 	stream->error = MAD_ERROR_BADBITALLOC;
+@@ -146,6 +152,12 @@
+ 
+   for (sb = bound; sb < 32; ++sb) {
+     nb = mad_bit_read(&stream->ptr, 4);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+ 
+     if (nb == 15) {
+       stream->error = MAD_ERROR_BADBITALLOC;
+@@ -162,6 +174,12 @@
+     for (ch = 0; ch < nch; ++ch) {
+       if (allocation[ch][sb]) {
+ 	scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+ 
+ # if defined(OPT_STRICT)
+ 	/*
+@@ -187,6 +205,12 @@
+ 	frame->sbsample[ch][s][sb] = nb ?
+ 	  mad_f_mul(I_sample(&stream->ptr, nb),
+ 		    sf_table[scalefactor[ch][sb]]) : 0;
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+       }
+     }
+ 
+@@ -195,6 +219,12 @@
+ 	mad_fixed_t sample;
+ 
+ 	sample = I_sample(&stream->ptr, nb);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+ 
+ 	for (ch = 0; ch < nch; ++ch) {
+ 	  frame->sbsample[ch][s][sb] =
+@@ -403,7 +433,15 @@
+     nbal = bitalloc_table[offsets[sb]].nbal;
+ 
+     for (ch = 0; ch < nch; ++ch)
++    {
+       allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
++    }
+   }
+ 
+   for (sb = bound; sb < sblimit; ++sb) {
+@@ -411,6 +449,13 @@
+ 
+     allocation[0][sb] =
+     allocation[1][sb] = mad_bit_read(&stream->ptr, nbal);
++
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+   }
+ 
+   /* decode scalefactor selection info */
+@@ -419,6 +464,12 @@
+     for (ch = 0; ch < nch; ++ch) {
+       if (allocation[ch][sb])
+ 	scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+     }
+   }
+ 
+@@ -442,6 +493,12 @@
+     for (ch = 0; ch < nch; ++ch) {
+       if (allocation[ch][sb]) {
+ 	scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+ 
+ 	switch (scfsi[ch][sb]) {
+ 	case 2:
+@@ -452,11 +509,23 @@
+ 
+ 	case 0:
+ 	  scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6);
++		if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++		{
++			stream->error = MAD_ERROR_LOSTSYNC;
++			stream->sync = 0;
++			return -1;
++		}
+ 	  /* fall through */
+ 
+ 	case 1:
+ 	case 3:
+ 	  scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6);
++		if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++		{
++			stream->error = MAD_ERROR_LOSTSYNC;
++			stream->sync = 0;
++			return -1;
++		}
+ 	}
+ 
+ 	if (scfsi[ch][sb] & 1)
+@@ -488,6 +557,12 @@
+ 	  index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
+ 
+ 	  II_samples(&stream->ptr, &qc_table[index], samples);
++		if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++		{
++			stream->error = MAD_ERROR_LOSTSYNC;
++			stream->sync = 0;
++			return -1;
++		}
+ 
+ 	  for (s = 0; s < 3; ++s) {
+ 	    frame->sbsample[ch][3 * gr + s][sb] =
+@@ -506,6 +581,12 @@
+ 	index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
+ 
+ 	II_samples(&stream->ptr, &qc_table[index], samples);
++	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++	{
++		stream->error = MAD_ERROR_LOSTSYNC;
++		stream->sync = 0;
++		return -1;
++	}
+ 
+ 	for (ch = 0; ch < nch; ++ch) {
+ 	  for (s = 0; s < 3; ++s) {
+Index: libmad-0.15.1b/layer3.c
+===================================================================
+--- libmad-0.15.1b.orig/layer3.c	2008-12-23 21:38:07.000000000 +0100
++++ libmad-0.15.1b/layer3.c	2008-12-23 21:38:12.000000000 +0100
+@@ -2608,6 +2608,12 @@
+     next_md_begin = 0;
+ 
+   md_len = si.main_data_begin + frame_space - next_md_begin;
++  if (md_len + MAD_BUFFER_GUARD > MAD_BUFFER_MDLEN)
++  {
++	stream->error = MAD_ERROR_LOSTSYNC;
++	stream->sync = 0;
++	return -1;
++  }
+ 
+   frame_used = 0;
+