57 lines
2.3 KiB
Diff
57 lines
2.3 KiB
Diff
diff -U0 libsndfile-1.0.17/ChangeLog.r1610 libsndfile-1.0.17/ChangeLog
|
|
--- libsndfile-1.0.17/ChangeLog.r1610 2006-08-31 11:39:36.000000000 +0200
|
|
+++ libsndfile-1.0.17/ChangeLog 2011-07-14 14:32:34.216206494 +0200
|
|
@@ -0,0 +1,6 @@
|
|
+2011-07-05 Erik de Castro Lopo <erikd AT mega-nerd DOT com>
|
|
+
|
|
+ * src/paf.c src/common.h src/sndfile.c
|
|
+ Fix for Secunia Advisory SA45125, heap overflow (heap gets overwritten with
|
|
+ byte value of 0) due to integer overflow if PAF file handler.
|
|
+
|
|
diff -up libsndfile-1.0.17/src/common.h.r1610 libsndfile-1.0.17/src/common.h
|
|
--- libsndfile-1.0.17/src/common.h.r1610 2006-08-31 11:22:07.000000000 +0200
|
|
+++ libsndfile-1.0.17/src/common.h 2011-07-14 14:29:38.309145864 +0200
|
|
@@ -454,6 +454,7 @@ enum
|
|
SFE_PAF_VERSION,
|
|
SFE_PAF_UNKNOWN_FORMAT,
|
|
SFE_PAF_SHORT_HEADER,
|
|
+ SFE_PAF_BAD_CHANNELS,
|
|
|
|
SFE_SVX_NO_FORM,
|
|
SFE_SVX_NO_BODY,
|
|
diff -up libsndfile-1.0.17/src/paf.c.r1610 libsndfile-1.0.17/src/paf.c
|
|
--- libsndfile-1.0.17/src/paf.c.r1610 2006-08-31 11:22:07.000000000 +0200
|
|
+++ libsndfile-1.0.17/src/paf.c 2011-07-14 14:29:38.309145864 +0200
|
|
@@ -163,6 +163,9 @@ paf_read_header (SF_PRIVATE *psf)
|
|
{ PAF_FMT paf_fmt ;
|
|
int marker ;
|
|
|
|
+ if (psf->filelength < PAF_HEADER_LENGTH)
|
|
+ return SFE_PAF_SHORT_HEADER ;
|
|
+
|
|
memset (&paf_fmt, 0, sizeof (paf_fmt)) ;
|
|
psf_binheader_readf (psf, "pm", 0, &marker) ;
|
|
|
|
@@ -199,8 +202,8 @@ paf_read_header (SF_PRIVATE *psf)
|
|
psf->endian = SF_ENDIAN_BIG ;
|
|
} ;
|
|
|
|
- if (psf->filelength < PAF_HEADER_LENGTH)
|
|
- return SFE_PAF_SHORT_HEADER ;
|
|
+ if (paf_fmt.channels > SF_MAX_CHANNELS)
|
|
+ return SFE_PAF_BAD_CHANNELS ;
|
|
|
|
psf->datalength = psf->filelength - psf->dataoffset ;
|
|
|
|
diff -up libsndfile-1.0.17/src/sndfile.c.r1610 libsndfile-1.0.17/src/sndfile.c
|
|
--- libsndfile-1.0.17/src/sndfile.c.r1610 2006-08-31 11:22:07.000000000 +0200
|
|
+++ libsndfile-1.0.17/src/sndfile.c 2011-07-14 14:29:38.311145864 +0200
|
|
@@ -146,6 +146,7 @@ ErrorStruct SndfileErrors [] =
|
|
{ SFE_PAF_VERSION , "Error in PAF file, bad version." },
|
|
{ SFE_PAF_UNKNOWN_FORMAT , "Error in PAF file, unknown format." },
|
|
{ SFE_PAF_SHORT_HEADER , "Error in PAF file. File shorter than minimal header." },
|
|
+ { SFE_PAF_BAD_CHANNELS , "Error in PAF file. Bad channel count." },
|
|
|
|
{ SFE_SVX_NO_FORM , "Error in 8SVX / 16SV file, no 'FORM' marker." },
|
|
{ SFE_SVX_NO_BODY , "Error in 8SVX / 16SV file, no 'BODY' marker." },
|