diff options
author | Andreas Sturmlechner <asturm@gentoo.org> | 2018-08-22 22:36:55 +0200 |
---|---|---|
committer | Andreas Sturmlechner <asturm@gentoo.org> | 2018-08-22 22:42:47 +0200 |
commit | 5e53d3522da5a2474983143001f72547b953666d (patch) | |
tree | 89e4e4b88baa8b99eac20406fc22d9e90e6e089c /media-sound/wavpack/files/wavpack-5.1.0-CVE-2018-7254.patch | |
parent | media-sound/wavpack: EAPI-7 bump (diff) | |
download | gentoo-5e53d3522da5a2474983143001f72547b953666d.tar.gz gentoo-5e53d3522da5a2474983143001f72547b953666d.tar.bz2 gentoo-5e53d3522da5a2474983143001f72547b953666d.zip |
media-sound/wavpack: Multiple security fixes
CVE-2018-7254,CVE-2018-7253, CVE-2018-6767, CVE-2018-10540,
CVE-2018-10539,CVE-2018-10538, CVE-2018-10537, CVE-2018-10536
Bug: https://bugs.gentoo.org/654532
Package-Manager: Portage-2.3.48, Repoman-2.3.10
Diffstat (limited to 'media-sound/wavpack/files/wavpack-5.1.0-CVE-2018-7254.patch')
-rw-r--r-- | media-sound/wavpack/files/wavpack-5.1.0-CVE-2018-7254.patch | 64 |
1 files changed, 64 insertions, 0 deletions
diff --git a/media-sound/wavpack/files/wavpack-5.1.0-CVE-2018-7254.patch b/media-sound/wavpack/files/wavpack-5.1.0-CVE-2018-7254.patch new file mode 100644 index 000000000000..f6e1cc42b134 --- /dev/null +++ b/media-sound/wavpack/files/wavpack-5.1.0-CVE-2018-7254.patch @@ -0,0 +1,64 @@ +From: David Bryant <david@wavpack.com> +Date: Sun, 11 Feb 2018 16:37:47 -0800 +Subject: issue #28, fix buffer overflows and bad allocs on corrupt CAF files + +--- + cli/caff.c | 30 +++++++++++++++++++++++------- + 1 file changed, 23 insertions(+), 7 deletions(-) + +diff --git a/cli/caff.c b/cli/caff.c +index ae57c4b..6248a71 100644 +--- a/cli/caff.c ++++ b/cli/caff.c +@@ -89,8 +89,8 @@ typedef struct + + #define CAFChannelDescriptionFormat "LLLLL" + +-static const char TMH_full [] = { 1,2,3,13,9,10,5,6,12,14,15,16,17,9,4,18,7,8,19,20,21 }; +-static const char TMH_std [] = { 1,2,3,11,8,9,5,6,10,12,13,14,15,7,4,16 }; ++static const char TMH_full [] = { 1,2,3,13,9,10,5,6,12,14,15,16,17,9,4,18,7,8,19,20,21,0 }; ++static const char TMH_std [] = { 1,2,3,11,8,9,5,6,10,12,13,14,15,7,4,16,0 }; + + static struct { + uint32_t mChannelLayoutTag; // Core Audio layout, 100 - 146 in high word, num channels in low word +@@ -274,10 +274,19 @@ int ParseCaffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpack + } + } + else if (!strncmp (caf_chunk_header.mChunkType, "chan", 4)) { +- CAFChannelLayout *caf_channel_layout = malloc ((size_t) caf_chunk_header.mChunkSize); ++ CAFChannelLayout *caf_channel_layout; + +- if (caf_chunk_header.mChunkSize < sizeof (CAFChannelLayout) || +- !DoReadFile (infile, caf_channel_layout, (uint32_t) caf_chunk_header.mChunkSize, &bcount) || ++ if (caf_chunk_header.mChunkSize < sizeof (CAFChannelLayout) || caf_chunk_header.mChunkSize > 1024) { ++ error_line ("this .CAF file has an invalid 'chan' chunk!"); ++ return WAVPACK_SOFT_ERROR; ++ } ++ ++ if (debug_logging_mode) ++ error_line ("'chan' chunk is %d bytes", (int) caf_chunk_header.mChunkSize); ++ ++ caf_channel_layout = malloc ((size_t) caf_chunk_header.mChunkSize); ++ ++ if (!DoReadFile (infile, caf_channel_layout, (uint32_t) caf_chunk_header.mChunkSize, &bcount) || + bcount != caf_chunk_header.mChunkSize) { + error_line ("%s is not a valid .CAF file!", infilename); + free (caf_channel_layout); +@@ -495,8 +504,15 @@ int ParseCaffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpack + } + else { // just copy unknown chunks to output file + +- int bytes_to_copy = (uint32_t) caf_chunk_header.mChunkSize; +- char *buff = malloc (bytes_to_copy); ++ uint32_t bytes_to_copy = (uint32_t) caf_chunk_header.mChunkSize; ++ char *buff; ++ ++ if (caf_chunk_header.mChunkSize < 0 || caf_chunk_header.mChunkSize > 1048576) { ++ error_line ("%s is not a valid .CAF file!", infilename); ++ return WAVPACK_SOFT_ERROR; ++ } ++ ++ buff = malloc (bytes_to_copy); + + if (debug_logging_mode) + error_line ("extra unknown chunk \"%c%c%c%c\" of %d bytes", |