fix CVE-2015-7805: Heap overflow vulnerability when parsing specially
crafted AIFF header
This commit is contained in:
Michal Hlavinka
parent
eabbff42cb
commit
08344da4ba
|
|
@ -0,0 +1,89 @@
|
|||
From d2a87385c1ca1d72918e9a2875d24f202a5093e8 Mon Sep 17 00:00:00 2001
|
||||
From: Erik de Castro Lopo <erikd@mega-nerd.com>
|
||||
Date: Sat, 7 Feb 2015 15:45:10 +1100
|
||||
Subject: [PATCH] src/common.c : Fix a header parsing bug.
|
||||
|
||||
When the file header is bigger that SF_HEADER_LEN, the code would seek
|
||||
instead of reading causing file parse errors.
|
||||
|
||||
The current header parsing and writing code *badly* needs a re-write.
|
||||
---
|
||||
src/common.c | 27 +++++++++++----------------
|
||||
1 file changed, 11 insertions(+), 16 deletions(-)
|
||||
|
||||
diff -up libsndfile-1.0.17/src/common.c.d2a87385c1ca1d72918e9a2875d24f202a5093e8 libsndfile-1.0.17/src/common.c
|
||||
--- libsndfile-1.0.17/src/common.c.d2a87385c1ca1d72918e9a2875d24f202a5093e8 2006-08-31 11:22:07.000000000 +0200
|
||||
+++ libsndfile-1.0.17/src/common.c 2015-11-06 20:47:43.080091853 +0100
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
-** Copyright (C) 1999-2006 Erik de Castro Lopo <erikd@mega-nerd.com>
|
||||
+** Copyright (C) 1999-2015 Erik de Castro Lopo <erikd@mega-nerd.com>
|
||||
**
|
||||
** This program is free software; you can redistribute it and/or modify
|
||||
** it under the terms of the GNU Lesser General Public License as published by
|
||||
@@ -800,21 +800,16 @@ header_read (SF_PRIVATE *psf, void *ptr,
|
||||
{ int count = 0 ;
|
||||
|
||||
if (psf->headindex >= SIGNED_SIZEOF (psf->header))
|
||||
- { memset (ptr, 0, SIGNED_SIZEOF (psf->header) - psf->headindex) ;
|
||||
-
|
||||
- /* This is the best that we can do. */
|
||||
- psf_fseek (psf, bytes, SEEK_CUR) ;
|
||||
- return bytes ;
|
||||
- } ;
|
||||
+ return psf_fread (ptr, 1, bytes, psf) ;
|
||||
|
||||
if (psf->headindex + bytes > SIGNED_SIZEOF (psf->header))
|
||||
{ int most ;
|
||||
|
||||
most = SIGNED_SIZEOF (psf->header) - psf->headindex ;
|
||||
psf_fread (psf->header + psf->headend, 1, most, psf) ;
|
||||
- memset ((char *) ptr + most, 0, bytes - most) ;
|
||||
-
|
||||
- psf_fseek (psf, bytes - most, SEEK_CUR) ;
|
||||
+ memcpy (ptr, psf->header + psf->headend, most) ;
|
||||
+ psf->headend = psf->headindex += most ;
|
||||
+ psf_fread ((char *) ptr + most, bytes - most, 1, psf) ;
|
||||
return bytes ;
|
||||
} ;
|
||||
|
||||
@@ -822,7 +817,7 @@ header_read (SF_PRIVATE *psf, void *ptr,
|
||||
{ count = psf_fread (psf->header + psf->headend, 1, bytes - (psf->headend - psf->headindex), psf) ;
|
||||
if (count != bytes - (int) (psf->headend - psf->headindex))
|
||||
{ psf_log_printf (psf, "Error : psf_fread returned short count.\n") ;
|
||||
- return 0 ;
|
||||
+ return count ;
|
||||
} ;
|
||||
psf->headend += count ;
|
||||
} ;
|
||||
@@ -836,7 +831,6 @@ header_read (SF_PRIVATE *psf, void *ptr,
|
||||
static void
|
||||
header_seek (SF_PRIVATE *psf, sf_count_t position, int whence)
|
||||
{
|
||||
-
|
||||
switch (whence)
|
||||
{ case SEEK_SET :
|
||||
if (position > SIGNED_SIZEOF (psf->header))
|
||||
@@ -885,8 +879,7 @@ header_seek (SF_PRIVATE *psf, sf_count_t
|
||||
|
||||
static int
|
||||
header_gets (SF_PRIVATE *psf, char *ptr, int bufsize)
|
||||
-{
|
||||
- int k ;
|
||||
+{ int k ;
|
||||
|
||||
for (k = 0 ; k < bufsize - 1 ; k++)
|
||||
{ if (psf->headindex < psf->headend)
|
||||
@@ -1073,8 +1066,10 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
|
||||
case 'j' :
|
||||
/* Get the seek position first. */
|
||||
count = va_arg (argptr, int) ;
|
||||
- header_seek (psf, count, SEEK_CUR) ;
|
||||
- byte_count += count ;
|
||||
+ if (count)
|
||||
+ { header_seek (psf, count, SEEK_CUR) ;
|
||||
+ byte_count += count ;
|
||||
+ } ;
|
||||
break ;
|
||||
|
||||
default :
|
||||
|
|
@ -1,7 +1,7 @@
|
|||
Summary: Library for reading and writing sound files
|
||||
Name: libsndfile
|
||||
Version: 1.0.17
|
||||
Release: 6%{?dist}
|
||||
Release: 7%{?dist}
|
||||
License: LGPL
|
||||
Group: System Environment/Libraries
|
||||
URL: http://www.mega-nerd.com/libsndfile/
|
||||
|
|
@ -24,6 +24,7 @@ Patch5: libsndfile-1.0.25-zerodivfix.patch
|
|||
|
||||
#from upstream, for libsndfile <= 1.0.25, rhbz#1178840
|
||||
Patch6: libsndfile-1.0.25-cve2014_9496.patch
|
||||
Patch7: libsndfile-1.0.25-d2a87385c1ca1d72918e9a2875d24f202a5093e8.patch
|
||||
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-buildroot-%(%{__id_u} -n)
|
||||
|
||||
|
|
@ -57,6 +58,7 @@ This package contains files needed to develop with libsndfile.
|
|||
%patch4 -p1
|
||||
%patch5 -p1 -b .zerodivfix
|
||||
%patch6 -p1 -b .cve2014_9496
|
||||
%patch7 -p1 -b .d2a87385c1ca1d72918e9a2875d24f202a5093e8
|
||||
|
||||
%build
|
||||
%configure --disable-dependency-tracking
|
||||
|
|
@ -104,6 +106,10 @@ rm -rf $RPM_BUILD_ROOT
|
|||
|
||||
|
||||
%changelog
|
||||
* Fri Nov 06 2015 Michal Hlavinka <mhlavink@redhat.com> - 1.0.17-7
|
||||
- fix CVE-2015-7805: Heap overflow vulnerability when parsing specially
|
||||
crafted AIFF header
|
||||
|
||||
* Tue Jan 13 2015 Michal Hlavinka <mhlavink@redhat.com> - 1.0.17-6
|
||||
- fix CVE-2014-9496: 2 buffer overruns in sd2_parse_rsrc_fork (#1178840)
|
||||
- division by zero leading to denial of service in psf_fwrite (#1177254)
|
||||
|
|
|
|||
Loading…
Reference in New Issue