packages/libsndfile
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix CVE-2024-50612

Browse Source 
(cherry picked from commit 2ed34dc9a3875f45a2dc0157e9a3fbc926412aef)
This commit is contained in:
zhangnaichuan 2024-12-31 10:08:27 +08:00 committed by openeuler-sync-bot
parent 52f019245b
commit f5604d9fa0
2 changed files with 399 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

394
backport-CVE-2024-50612.patch Normal file
View File

@ -0,0 +1,394 @@
From 274198fd95152b412ada49be059258ec0efca272 Mon Sep 17 00:00:00 2001
From: Arthur Taylor <art@ified.ca>
Date: Fri, 15 Nov 2024 19:46:53 -0800
Subject: [PATCH 1/3] src/ogg: better error checking for vorbis. Fixes #1035
---
src/ogg.c | 12 ++--
src/ogg_opus.c | 17 +++--
src/ogg_vorbis.c | 164 +++++++++++++++++++++++++++--------------------
3 files changed, 111 insertions(+), 82 deletions(-)
diff --git a/src/ogg.c b/src/ogg.c
index 7a4a167..c6e76e3 100644
--- a/src/ogg.c
+++ b/src/ogg.c
@@ -209,12 +209,16 @@ ogg_read_first_page (SF_PRIVATE *psf, OGG_PRIVATE *odata)
int
ogg_write_page (SF_PRIVATE *psf, ogg_page *page)
-{ int bytes ;
+{ int n ;
- bytes = psf_fwrite (page->header, 1, page->header_len, psf) ;
- bytes += psf_fwrite (page->body, 1, page->body_len, psf) ;
+ n = psf_fwrite (page->header, 1, page->header_len, psf) ;
+ if (n == page->header_len)
+ n += psf_fwrite (page->body, 1, page->body_len, psf) ;
- return bytes == page->header_len + page->body_len ;
+ if (n != page->body_len + page->header_len)
+ return -1 ;
+
+ return n ;
} /* ogg_write_page */
sf_count_t
diff --git a/src/ogg_opus.c b/src/ogg_opus.c
index 9be6e91..004c906 100644
--- a/src/ogg_opus.c
+++ b/src/ogg_opus.c
@@ -815,15 +815,16 @@ ogg_opus_write_header (SF_PRIVATE *psf, int UNUSED (calc_length))
/* The first page MUST only contain the header, so flush it out now */
ogg_stream_packetin (&odata->ostream, &op) ;
- for ( ; (nn = ogg_stream_flush (&odata->ostream, &odata->opage)) ; )
- { if (! (nn = ogg_write_page (psf, &odata->opage)))
+ while (ogg_stream_flush (&odata->ostream, &odata->opage))
+ { nn = ogg_write_page (psf, &odata->opage) ;
+ if (nn < 0)
{ psf_log_printf (psf, "Opus : Failed to write header!\n") ;
if (psf->error)
return psf->error ;
return SFE_INTERNAL ;
} ;
psf->dataoffset += nn ;
- }
+ } ;
/*
** Metadata Tags (manditory)
@@ -838,15 +839,16 @@ ogg_opus_write_header (SF_PRIVATE *psf, int UNUSED (calc_length))
vorbiscomment_write_tags (psf, &op, &opustags_ident, opus_get_version_string (), - (OGG_OPUS_COMMENT_PAD)) ;
op.packetno = 2 ;
ogg_stream_packetin (&odata->ostream, &op) ;
- for ( ; (nn = ogg_stream_flush (&odata->ostream, &odata->opage)) ; )
- { if (! (nn = ogg_write_page (psf, &odata->opage)))
+ while (ogg_stream_flush (&odata->ostream, &odata->opage))
+ { nn = ogg_write_page (psf, &odata->opage) ;
+ if (nn < 0)
{ psf_log_printf (psf, "Opus : Failed to write comments!\n") ;
if (psf->error)
return psf->error ;
return SFE_INTERNAL ;
} ;
psf->dataoffset += nn ;
- }
+ } ;
return 0 ;
} /* ogg_opus_write_header */
@@ -1124,7 +1126,8 @@ ogg_opus_write_out (SF_PRIVATE *psf, OGG_PRIVATE *odata, OPUS_PRIVATE *oopus)
*/
oopus->u.encode.last_segments -= odata->opage.header [26] ;
oopus->pg_pos = oopus->pkt_pos ;
- ogg_write_page (psf, &odata->opage) ;
+ if (ogg_write_page (psf, &odata->opage) < 0)
+ return -1 ;
}
else
break ;
diff --git a/src/ogg_vorbis.c b/src/ogg_vorbis.c
index 5f53651..ef1f121 100644
--- a/src/ogg_vorbis.c
+++ b/src/ogg_vorbis.c
@@ -78,25 +78,6 @@
#include "ogg.h"
-typedef int convert_func (SF_PRIVATE *psf, int, void *, int, int, float **) ;
-
-static int vorbis_read_header (SF_PRIVATE *psf) ;
-static int vorbis_write_header (SF_PRIVATE *psf, int calc_length) ;
-static int vorbis_close (SF_PRIVATE *psf) ;
-static int vorbis_command (SF_PRIVATE *psf, int command, void *data, int datasize) ;
-static int vorbis_byterate (SF_PRIVATE *psf) ;
-static sf_count_t vorbis_calculate_page_duration (SF_PRIVATE *psf) ;
-static sf_count_t vorbis_seek (SF_PRIVATE *psf, int mode, sf_count_t offset) ;
-static sf_count_t vorbis_read_s (SF_PRIVATE *psf, short *ptr, sf_count_t len) ;
-static sf_count_t vorbis_read_i (SF_PRIVATE *psf, int *ptr, sf_count_t len) ;
-static sf_count_t vorbis_read_f (SF_PRIVATE *psf, float *ptr, sf_count_t len) ;
-static sf_count_t vorbis_read_d (SF_PRIVATE *psf, double *ptr, sf_count_t len) ;
-static sf_count_t vorbis_write_s (SF_PRIVATE *psf, const short *ptr, sf_count_t len) ;
-static sf_count_t vorbis_write_i (SF_PRIVATE *psf, const int *ptr, sf_count_t len) ;
-static sf_count_t vorbis_write_f (SF_PRIVATE *psf, const float *ptr, sf_count_t len) ;
-static sf_count_t vorbis_write_d (SF_PRIVATE *psf, const double *ptr, sf_count_t len) ;
-static sf_count_t vorbis_read_sample (SF_PRIVATE *psf, void *ptr, sf_count_t lens, convert_func *transfn) ;
-static int vorbis_rnull (SF_PRIVATE *psf, int samples, void *vptr, int off , int channels, float **pcm) ;
typedef struct
{ int id ;
@@ -143,6 +124,43 @@ typedef struct
sf_count_t last_page ;
} VORBIS_PRIVATE ;
+typedef int convert_func (SF_PRIVATE *psf, int, void *, int, int, float **) ;
+
+static int vorbis_read_header (SF_PRIVATE *psf) ;
+static int vorbis_write_header (SF_PRIVATE *psf, int calc_length) ;
+static int vorbis_close (SF_PRIVATE *psf) ;
+static int vorbis_command (SF_PRIVATE *psf, int command, void *data, int datasize) ;
+static int vorbis_byterate (SF_PRIVATE *psf) ;
+static sf_count_t vorbis_calculate_page_duration (SF_PRIVATE *psf) ;
+static sf_count_t vorbis_seek (SF_PRIVATE *psf, int mode, sf_count_t offset) ;
+static sf_count_t vorbis_read_s (SF_PRIVATE *psf, short *ptr, sf_count_t len) ;
+static sf_count_t vorbis_read_i (SF_PRIVATE *psf, int *ptr, sf_count_t len) ;
+static sf_count_t vorbis_read_f (SF_PRIVATE *psf, float *ptr, sf_count_t len) ;
+static sf_count_t vorbis_read_d (SF_PRIVATE *psf, double *ptr, sf_count_t len) ;
+static sf_count_t vorbis_write_s (SF_PRIVATE *psf, const short *ptr, sf_count_t len) ;
+static sf_count_t vorbis_write_i (SF_PRIVATE *psf, const int *ptr, sf_count_t len) ;
+static sf_count_t vorbis_write_f (SF_PRIVATE *psf, const float *ptr, sf_count_t len) ;
+static sf_count_t vorbis_write_d (SF_PRIVATE *psf, const double *ptr, sf_count_t len) ;
+static sf_count_t vorbis_read_sample (SF_PRIVATE *psf, void *ptr, sf_count_t lens, convert_func *transfn) ;
+static int vorbis_write_samples (SF_PRIVATE *psf, OGG_PRIVATE *odata, VORBIS_PRIVATE *vdata, int in_frames) ;
+static int vorbis_rnull (SF_PRIVATE *psf, int samples, void *vptr, int off , int channels, float **pcm) ;
+static void vorbis_log_error (SF_PRIVATE *psf, int error) ;
+
+
+static void
+vorbis_log_error(SF_PRIVATE *psf, int error) {
+ switch (error)
+ { case 0: return;
+ case OV_EIMPL: psf->error = SFE_UNIMPLEMENTED ; break ;
+ case OV_ENOTVORBIS: psf->error = SFE_MALFORMED_FILE ; break ;
+ case OV_EBADHEADER: psf->error = SFE_MALFORMED_FILE ; break ;
+ case OV_EVERSION: psf->error = SFE_UNSUPPORTED_ENCODING ; break ;
+ case OV_EFAULT:
+ case OV_EINVAL:
+ default: psf->error = SFE_INTERNAL ;
+ } ;
+} ;
+
static int
vorbis_read_header (SF_PRIVATE *psf)
{ OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
@@ -386,7 +405,6 @@ vorbis_write_header (SF_PRIVATE *psf, int UNUSED (calc_length))
{ ogg_packet header ;
ogg_packet header_comm ;
ogg_packet header_code ;
- int result ;
vorbis_analysis_headerout (&vdata->vdsp, &vdata->vcomment, &header, &header_comm, &header_code) ;
ogg_stream_packetin (&odata->ostream, &header) ; /* automatically placed in its own page */
@@ -396,9 +414,9 @@ vorbis_write_header (SF_PRIVATE *psf, int UNUSED (calc_length))
/* This ensures the actual
* audio data will start on a new page, as per spec
*/
- while ((result = ogg_stream_flush (&odata->ostream, &odata->opage)) != 0)
- { ogg_write_page (psf, &odata->opage) ;
- } ;
+ while (ogg_stream_flush (&odata->ostream, &odata->opage))
+ if (ogg_write_page (psf, &odata->opage) < 0)
+ return -1 ;
}
return 0 ;
@@ -408,6 +426,7 @@ static int
vorbis_close (SF_PRIVATE *psf)
{ OGG_PRIVATE* odata = psf->container_data ;
VORBIS_PRIVATE *vdata = psf->codec_data ;
+ int ret = 0 ;
if (odata == NULL || vdata == NULL)
return 0 ;
@@ -418,34 +437,14 @@ vorbis_close (SF_PRIVATE *psf)
if (psf->file.mode == SFM_WRITE)
{
if (psf->write_current <= 0)
- vorbis_write_header (psf, 0) ;
-
- vorbis_analysis_wrote (&vdata->vdsp, 0) ;
- while (vorbis_analysis_blockout (&vdata->vdsp, &vdata->vblock) == 1)
- {
-
- /* analysis, assume we want to use bitrate management */
- vorbis_analysis (&vdata->vblock, NULL) ;
- vorbis_bitrate_addblock (&vdata->vblock) ;
-
- while (vorbis_bitrate_flushpacket (&vdata->vdsp, &odata->opacket))
- { /* weld the packet into the bitstream */
- ogg_stream_packetin (&odata->ostream, &odata->opacket) ;
-
- /* write out pages (if any) */
- while (!odata->eos)
- { int result = ogg_stream_pageout (&odata->ostream, &odata->opage) ;
- if (result == 0) break ;
- ogg_write_page (psf, &odata->opage) ;
+ ret = vorbis_write_header (psf, 0) ;
- /* this could be set above, but for illustrative purposes, I do
- it here (to show that vorbis does know where the stream ends) */
-
- if (ogg_page_eos (&odata->opage)) odata->eos = 1 ;
- }
- }
- }
- }
+ if (ret == 0)
+ { /* A write of zero samples tells Vorbis the stream is done and to
+ flush. */
+ ret = vorbis_write_samples (psf, odata, vdata, 0) ;
+ } ;
+ } ;
/* ogg_page and ogg_packet structs always point to storage in
libvorbis. They are never freed or manipulated directly */
@@ -455,7 +454,7 @@ vorbis_close (SF_PRIVATE *psf)
vorbis_comment_clear (&vdata->vcomment) ;
vorbis_info_clear (&vdata->vinfo) ;
- return 0 ;
+ return ret ;
} /* vorbis_close */
int
@@ -686,33 +685,40 @@ vorbis_read_d (SF_PRIVATE *psf, double *ptr, sf_count_t lens)
/*==============================================================================
*/
-static void
+static int
vorbis_write_samples (SF_PRIVATE *psf, OGG_PRIVATE *odata, VORBIS_PRIVATE *vdata, int in_frames)
-{
- vorbis_analysis_wrote (&vdata->vdsp, in_frames) ;
+{ int ret ;
+
+ if ((ret = vorbis_analysis_wrote (&vdata->vdsp, in_frames)) != 0)
+ return ret ;
/*
** Vorbis does some data preanalysis, then divvies up blocks for
** more involved (potentially parallel) processing. Get a single
** block for encoding now.
*/
- while (vorbis_analysis_blockout (&vdata->vdsp, &vdata->vblock) == 1)
+ while ((ret = vorbis_analysis_blockout (&vdata->vdsp, &vdata->vblock)) == 1)
{
/* analysis, assume we want to use bitrate management */
- vorbis_analysis (&vdata->vblock, NULL) ;
- vorbis_bitrate_addblock (&vdata->vblock) ;
+ if ((ret = vorbis_analysis (&vdata->vblock, NULL)) != 0)
+ return ret ;
+ if ((ret = vorbis_bitrate_addblock (&vdata->vblock)) != 0)
+ return ret ;
- while (vorbis_bitrate_flushpacket (&vdata->vdsp, &odata->opacket))
+ while ((ret = vorbis_bitrate_flushpacket (&vdata->vdsp, &odata->opacket)) == 1)
{
/* weld the packet into the bitstream */
- ogg_stream_packetin (&odata->ostream, &odata->opacket) ;
+ if ((ret = ogg_stream_packetin (&odata->ostream, &odata->opacket)) != 0)
+ return ret ;
/* write out pages (if any) */
while (!odata->eos)
- { int result = ogg_stream_pageout (&odata->ostream, &odata->opage) ;
- if (result == 0)
+ { ret = ogg_stream_pageout (&odata->ostream, &odata->opage) ;
+ if (ret == 0)
break ;
- ogg_write_page (psf, &odata->opage) ;
+
+ if (ogg_write_page (psf, &odata->opage) < 0)
+ return -1 ;
/* This could be set above, but for illustrative purposes, I do
** it here (to show that vorbis does know where the stream ends) */
@@ -720,16 +726,20 @@ vorbis_write_samples (SF_PRIVATE *psf, OGG_PRIVATE *odata, VORBIS_PRIVATE *vdata
odata->eos = 1 ;
} ;
} ;
+ if (ret != 0)
+ return ret ;
} ;
-
+ if (ret != 0)
+ return ret ;
vdata->loc += in_frames ;
+ return 0 ;
} /* vorbis_write_data */
static sf_count_t
vorbis_write_s (SF_PRIVATE *psf, const short *ptr, sf_count_t lens)
{
- int i, m, j = 0 ;
+ int i, m, j = 0, ret ;
OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
VORBIS_PRIVATE *vdata = (VORBIS_PRIVATE *) psf->codec_data ;
int in_frames = lens / psf->sf.channels ;
@@ -738,14 +748,17 @@ vorbis_write_s (SF_PRIVATE *psf, const short *ptr, sf_count_t lens)
for (m = 0 ; m < psf->sf.channels ; m++)
buffer [m][i] = (float) (ptr [j++]) / 32767.0f ;
- vorbis_write_samples (psf, odata, vdata, in_frames) ;
+ if ((ret = vorbis_write_samples (psf, odata, vdata, in_frames)))
+ { vorbis_log_error (psf, ret) ;
+ return 0 ;
+ } ;
return lens ;
} /* vorbis_write_s */
static sf_count_t
vorbis_write_i (SF_PRIVATE *psf, const int *ptr, sf_count_t lens)
-{ int i, m, j = 0 ;
+{ int i, m, j = 0, ret ;
OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
VORBIS_PRIVATE *vdata = (VORBIS_PRIVATE *) psf->codec_data ;
int in_frames = lens / psf->sf.channels ;
@@ -754,14 +767,17 @@ vorbis_write_i (SF_PRIVATE *psf, const int *ptr, sf_count_t lens)
for (m = 0 ; m < psf->sf.channels ; m++)
buffer [m][i] = (float) (ptr [j++]) / 2147483647.0f ;
- vorbis_write_samples (psf, odata, vdata, in_frames) ;
+ if ((ret = vorbis_write_samples (psf, odata, vdata, in_frames)))
+ { vorbis_log_error (psf, ret) ;
+ return 0 ;
+ } ;
return lens ;
} /* vorbis_write_i */
static sf_count_t
vorbis_write_f (SF_PRIVATE *psf, const float *ptr, sf_count_t lens)
-{ int i, m, j = 0 ;
+{ int i, m, j = 0, ret ;
OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
VORBIS_PRIVATE *vdata = (VORBIS_PRIVATE *) psf->codec_data ;
int in_frames = lens / psf->sf.channels ;
@@ -770,14 +786,17 @@ vorbis_write_f (SF_PRIVATE *psf, const float *ptr, sf_count_t lens)
for (m = 0 ; m < psf->sf.channels ; m++)
buffer [m][i] = ptr [j++] ;
- vorbis_write_samples (psf, odata, vdata, in_frames) ;
+ if ((ret = vorbis_write_samples (psf, odata, vdata, in_frames)) != 0)
+ { vorbis_log_error (psf, ret) ;
+ return 0 ;
+ } ;
return lens ;
} /* vorbis_write_f */
static sf_count_t
vorbis_write_d (SF_PRIVATE *psf, const double *ptr, sf_count_t lens)
-{ int i, m, j = 0 ;
+{ int i, m, j = 0, ret ;
OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
VORBIS_PRIVATE *vdata = (VORBIS_PRIVATE *) psf->codec_data ;
int in_frames = lens / psf->sf.channels ;
@@ -786,7 +805,10 @@ vorbis_write_d (SF_PRIVATE *psf, const double *ptr, sf_count_t lens)
for (m = 0 ; m < psf->sf.channels ; m++)
buffer [m][i] = (float) ptr [j++] ;
- vorbis_write_samples (psf, odata, vdata, in_frames) ;
+ if ((ret = vorbis_write_samples (psf, odata, vdata, in_frames)) != 0)
+ { vorbis_log_error (psf, ret) ;
+ return 0 ;
+ } ;
return lens ;
} /* vorbis_write_d */
--
2.33.0

6
libsndfile.spec
View File

@ -1,6 +1,6 @@
Name: libsndfile
Version: 1.0.31
Release: 4
Release: 5
Summary: Library for reading and writing sound files
License: LGPLv2+ and GPLv2+ and BSD
URL: http://libsndfile.github.io/libsndfile
@ -14,6 +14,7 @@ BuildRequires: opus-devel
Patch1: 0001-CVE-2021-3246.patch
Patch2: 0002-CVE-2021-4156.patch
Patch3: 0001-mat4-mat5-fix-int-overflow-in-dataend-calculation.patch
Patch6001: backport-CVE-2024-50612.patch
%description
Libsndfile is a C library for reading and writing files containing
@ -118,6 +119,9 @@ LD_LIBRARY_PATH=$PWD/src/.libs make check
%{_mandir}/man1/sndfile-salvage.1*
%changelog
* Mon Dec 30 2024 zhangnaichuan <zhangnaichuan@huawei.com> - 1.0.31-5
- libsndfile:fix CVE-2024-50612
* Wed Nov 15 2023 EulerOSWander <314264452@qq.com> - 1.0.31-4
- libsndfile:fix CVE-2022-33065