gnu: Add audiofile.

Patches should fix all CVEs reported by `guix lint`:
CVE-2015-7747; CVE-2017-6827, CVE-2017-6828, CVE-2017-6829,
CVE-2017-6830, CVE-2017-6831, CVE-2017-6832, CVE-2017-6833,
CVE-2017-6834, CVE-2017-6835, CVE-2017-6836, CVE-2017-6837,
CVE-2017-6838, CVE-2017-6839; CVE-2018-13440; CVE-2018-17095

Since the patches do not reference to CVEs, it's a bit hard to tell which
patch actually closes which CVE.  Debian reports all these to be closed by
the patches below and NixPkgs provides references.

* gnu/packages/audio.scm (audiofile): New variable.
* gnu/packages/patches/audiofile-fix-datatypes-in-tests.patch,
  gnu/packages/patches/audiofile-fix-sign-conversion.patch,
  gnu/packages/patches/audiofile-CVE-2015-7747.patch,
  gnu/packages/patches/audiofile-CVE-2018-13440.patch,
  gnu/packages/patches/audiofile-CVE-2018-17095.patch,
  gnu/packages/patches/audiofile-Check-the-number-of-coefficients.patch,
  gnu/packages/patches/audiofile-Fail-on-error-in-parseFormat.patch,
  gnu/packages/patches/audiofile-Fix-index-overflow-in-IMA.cpp.patch,
  gnu/packages/patches/audiofile-Fix-multiply-overflow-sfconvert.patch,
  gnu/packages/patches/audiofile-Fix-overflow-in-MSADPCM-decodeSam.patch,
  gnu/packages/patches/audiofile-division-by-zero-BlockCodec-runPull.patch,
  gnu/packages/patches/audiofile-hurd.patch,
  gnu/packages/patches/audiofile-signature-of-multiplyCheckOverflow.patch:
  New files.
* gnu/local.mk: Add them.

1 files changed, 49 insertions, 0 deletions

diff --git a/gnu/packages/audio.scm b/gnu/packages/audio.scm
index 87d6947657..76c59f33cc 100644
--- a/gnu/packages/audio.scm
+++ b/gnu/packages/audio.scm
@@ -26,6 +26,7 @@
 ;;; Copyright © 2019 Alexandros Theodotou <alex@zrythm.org>
 ;;; Copyright © 2019 Christopher Lemmer Webber <cwebber@dustycloud.org>
 ;;; Copyright © 2019 Jan Wielkiewicz <tona_kosmicznego_smiecia@interia.pl>
+;;; Copyright © 2019 Hartmt Goebel <h.goebel@crazy-compilers.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -467,6 +468,54 @@ and editing digital audio.  It features digital effects and spectrum analysis
 tools.")
     (license license:gpl2+)))
 
+(define-public audiofile
+  (package
+    (name "audiofile")
+    (version "0.3.6")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "https://audiofile.68k.org/audiofile-" version ".tar.gz"))
+       (sha256
+        (base32 "0rb927zknk9kmhprd8rdr4azql4gn2dp75a36iazx2xhkbqhvind"))
+       (patches
+        ;; CVE references according to nixpgs
+        (search-patches
+         "audiofile-fix-datatypes-in-tests.patch"
+         "audiofile-fix-sign-conversion.patch"
+         "audiofile-hurd.patch"
+         "audiofile-CVE-2015-7747.patch"
+         ;; CVE-2017-6829:
+         "audiofile-Fix-index-overflow-in-IMA.cpp.patch"
+         ;; CVE-2017-6827, CVE-2017-6828, CVE-2017-6832, CVE-2017-6835,
+         ;; CVE-2017-6837:
+         "audiofile-Check-the-number-of-coefficients.patch"
+         ;; CVE-2017-6839:
+         "audiofile-Fix-overflow-in-MSADPCM-decodeSam.patch"
+         ;; CVE-2017-6830, CVE-2017-6834, CVE-2017-6836, CVE-2017-6838:
+         "audiofile-Fix-multiply-overflow-sfconvert.patch"
+         "audiofile-signature-of-multiplyCheckOverflow.patch"
+         ;; CVE-2017-6831:
+         "audiofile-Fail-on-error-in-parseFormat.patch"
+         ;; CVE-2017-6833:
+         "audiofile-division-by-zero-BlockCodec-runPull.patch"
+         "audiofile-CVE-2018-13440.patch"
+         "audiofile-CVE-2018-17095.patch"))))
+    (build-system gnu-build-system)
+    (inputs
+     `(("alsa-lib" ,alsa-lib)))
+    (home-page "https://audiofile.68k.org/")
+    (synopsis "Library to handle various audio file formats")
+    (description "This is an open-source version of SGI's audiofile library.
+It provides a uniform programming interface for processing of audio data to
+and from audio files of many common formats.
+
+Currently supported file formats include AIFF/AIFF-C, WAVE, and NeXT/Sun
+.snd/.au, BICS, and raw data.  Supported compression formats are currently
+G.711 mu-law and A-law.")
+    (license license:lgpl2.1+)))
+
 (define-public autotalent
   (package
     (name "autotalent")