From: Markus Koschany <apo@debian.org>
Date: Thu, 2 Nov 2017 15:52:01 +0100
Subject: CVE-2017-15953

Bug-Debian: https://bugs.debian.org/880116
Origin: https://github.com/rydnr/nixpkgs/blob/5643fd19cf46ae516c69b625cd09f5a6a8774b6f/pkgs/tools/cd-dvd/bchunk/CVE-2017-15953.patch
---
 bchunk.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/bchunk.c b/bchunk.c
index 48c694b..733cfd1 100644
--- a/bchunk.c
+++ b/bchunk.c
@@ -18,6 +18,7 @@
   *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
   */
 
+#define _GNU_SOURCE
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -271,11 +272,10 @@ int writetrack(FILE *bf, struct track_t *track, char *bname)
 	int16_t i;
 	float fl;
 	
-	if (!(fname = malloc(strlen(bname) + 8))) {
-		fprintf(stderr, "main(): malloc() failed, out of memory\n");
+	if (asprintf(&fname, "%s%2.2d.%s", bname, track->num, track->extension) == -1) {
+		fprintf(stderr, "writetrack(): asprintf() failed, out of memory\n");
 		exit(4);
 	}
-	sprintf(fname, "%s%2.2d.%s", bname, track->num, track->extension);
 	
 	printf("%2d: %s ", track->num, fname);