--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/components/sox/patches/9.CVE-2014-8145.patch Fri Jan 09 10:58:01 2015 -0800
@@ -0,0 +1,35 @@
+#
+# Fix CVE-2014-8145[0]:
+# two heap-based buffer overflows
+# Upstream changesets 7d3f38 and f39c57.
+# http://sourceforge.net/p/sox/code/ci/7d3f38007a1eeaf5ab7669aba0d2a7e4d3def57e/
+# http://sourceforge.net/p/sox/code/ci/f39c574bc423fd5b12bd6510264512f5d5366183/
+#
+
+--- a/src/sphere.c
++++ b/src/sphere.c
+@@ -47,6 +47,11 @@
+
+ /* Determine header size, and allocate a buffer large enough to hold it. */
+ sscanf(fldsval, "%lu", &header_size_ul);
++ if (header_size_ul < 16) {
++ lsx_fail_errno(ft, SOX_EHDR, "Error reading Sphere header");
++ return (SOX_EOF);
++ }
++
+ buf = lsx_malloc(header_size = header_size_ul);
+
+ /* Skip what we have read so far */
+
+
+--- a/src/wav.c
++++ b/src/wav.c
+@@ -166,7 +166,7 @@
+ /* work with partial blocks. Specs say it should be null */
+ /* padded but I guess this is better than trailing quiet. */
+ samplesThisBlock = lsx_ms_adpcm_samples_in((size_t)0, (size_t)ft->signal.channels, bytesRead, (size_t)0);
+- if (samplesThisBlock == 0)
++ if (samplesThisBlock == 0 || samplesThisBlock > wav->samplesPerBlock)
+ {
+ lsx_warn("Premature EOF on .wav input file");
+ return 0;