packages/libsndfile
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

base: packages:9673ba04e37fa9d2e3ae7966e4d384fde2f0982f
Branches Tags
packages:main
..
compare: packages:51aae2af94e2e9971d6f8c04b2d56c33bf2c33dc
Branches Tags
packages:main

No commits in common. "9673ba04e37fa9d2e3ae7966e4d384fde2f0982f" and "51aae2af94e2e9971d6f8c04b2d56c33bf2c33dc" have entirely different histories.
9673ba04e3 ... 51aae2af94

18 changed files with 571 additions and 486 deletions
Show Stats Expand all files Collapse all files

43
0001-mat4-mat5-fix-int-overflow-in-dataend-calculation.patch
View File

@ -1,43 +0,0 @@
From 0754562e13d2e63a248a1c82f90b30bc0ffe307c Mon Sep 17 00:00:00 2001
From: Alex Stewart <alex.stewart@ni.com>
Date: Tue, 10 Oct 2023 16:10:34 -0400
Subject: [PATCH] mat4/mat5: fix int overflow in dataend calculation
The clang sanitizer warns of a possible signed integer overflow when
calculating the `dataend` value in `mat4_read_header()`.
```
src/mat4.c:323:41: runtime error: signed integer overflow: 205 * -100663296 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:41 in
src/mat4.c:323:48: runtime error: signed integer overflow: 838860800 * 4 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:48 in
```
Cast the offending `rows` and `cols` ints to `sf_count_t` (the type of
`dataend` before performing the calculation, to avoid the issue.
CVE: CVE-2022-33065
Fixes: https://github.com/libsndfile/libsndfile/issues/789
Fixes: https://github.com/libsndfile/libsndfile/issues/833
Signed-off-by: Alex Stewart <alex.stewart@ni.com>
---
src/mat4.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/mat4.c b/src/mat4.c
index 0b1b414b..575683ba 100644
--- a/src/mat4.c
+++ b/src/mat4.c
@@ -320,7 +320,7 @@ mat4_read_header (SF_PRIVATE *psf)
psf->filelength - psf->dataoffset, psf->sf.channels * psf->sf.frames * psf->bytewidth) ;
}
else if ((psf->filelength - psf->dataoffset) > psf->sf.channels * psf->sf.frames * psf->bytewidth)
- psf->dataend = psf->dataoffset + rows * cols * psf->bytewidth ;
+ psf->dataend = psf->dataoffset + (sf_count_t) rows * (sf_count_t) cols * psf->bytewidth ;
psf->datalength = psf->filelength - psf->dataoffset - psf->dataend ;
--
2.33.0

25
0002-CVE-2021-4156.patch
View File

@ -1,25 +0,0 @@
From ced91d7b971be6173b604154c39279ce90ad87cc Mon Sep 17 00:00:00 2001
From: yuan <ssspeed00@gmail.com>
Date: Tue, 20 Apr 2021 16:16:32 +0800
Subject: [PATCH] flac: Fix improper buffer reusing (#732)
---
src/flac.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/flac.c b/src/flac.c
index 64d0172e6..e33204505 100644
--- a/src/flac.c
+++ b/src/flac.c
@@ -948,7 +948,11 @@ flac_read_loop (SF_PRIVATE *psf, unsigned len)
/* Decode some more. */
while (pflac->pos < pflac->len)
{ if (FLAC__stream_decoder_process_single (pflac->fsd) == 0)
+ { psf_log_printf (psf, "FLAC__stream_decoder_process_single returned false\n") ;
+ /* Current frame is busted, so NULL the pointer. */
+ pflac->frame = NULL ;
break ;
+ } ;
state = FLAC__stream_decoder_get_state (pflac->fsd) ;
if (state >= FLAC__STREAM_DECODER_END_OF_STREAM)
{ psf_log_printf (psf, "FLAC__stream_decoder_get_state returned %s\n", FLAC__StreamDecoderStateString [state]) ;

0
0001-CVE-2021-3246.patch → backport-CVE-2021-3246.patch
View File

394
backport-CVE-2024-50612.patch
View File

@ -1,394 +0,0 @@
From 274198fd95152b412ada49be059258ec0efca272 Mon Sep 17 00:00:00 2001
From: Arthur Taylor <art@ified.ca>
Date: Fri, 15 Nov 2024 19:46:53 -0800
Subject: [PATCH 1/3] src/ogg: better error checking for vorbis. Fixes #1035
---
src/ogg.c | 12 ++--
src/ogg_opus.c | 17 +++--
src/ogg_vorbis.c | 164 +++++++++++++++++++++++++++--------------------
3 files changed, 111 insertions(+), 82 deletions(-)
diff --git a/src/ogg.c b/src/ogg.c
index 7a4a167..c6e76e3 100644
--- a/src/ogg.c
+++ b/src/ogg.c
@@ -209,12 +209,16 @@ ogg_read_first_page (SF_PRIVATE *psf, OGG_PRIVATE *odata)
int
ogg_write_page (SF_PRIVATE *psf, ogg_page *page)
-{ int bytes ;
+{ int n ;
- bytes = psf_fwrite (page->header, 1, page->header_len, psf) ;
- bytes += psf_fwrite (page->body, 1, page->body_len, psf) ;
+ n = psf_fwrite (page->header, 1, page->header_len, psf) ;
+ if (n == page->header_len)
+ n += psf_fwrite (page->body, 1, page->body_len, psf) ;
- return bytes == page->header_len + page->body_len ;
+ if (n != page->body_len + page->header_len)
+ return -1 ;
+
+ return n ;
} /* ogg_write_page */
sf_count_t
diff --git a/src/ogg_opus.c b/src/ogg_opus.c
index 9be6e91..004c906 100644
--- a/src/ogg_opus.c
+++ b/src/ogg_opus.c
@@ -815,15 +815,16 @@ ogg_opus_write_header (SF_PRIVATE *psf, int UNUSED (calc_length))
/* The first page MUST only contain the header, so flush it out now */
ogg_stream_packetin (&odata->ostream, &op) ;
- for ( ; (nn = ogg_stream_flush (&odata->ostream, &odata->opage)) ; )
- { if (! (nn = ogg_write_page (psf, &odata->opage)))
+ while (ogg_stream_flush (&odata->ostream, &odata->opage))
+ { nn = ogg_write_page (psf, &odata->opage) ;
+ if (nn < 0)
{ psf_log_printf (psf, "Opus : Failed to write header!\n") ;
if (psf->error)
return psf->error ;
return SFE_INTERNAL ;
} ;
psf->dataoffset += nn ;
- }
+ } ;
/*
** Metadata Tags (manditory)
@@ -838,15 +839,16 @@ ogg_opus_write_header (SF_PRIVATE *psf, int UNUSED (calc_length))
vorbiscomment_write_tags (psf, &op, &opustags_ident, opus_get_version_string (), - (OGG_OPUS_COMMENT_PAD)) ;
op.packetno = 2 ;
ogg_stream_packetin (&odata->ostream, &op) ;
- for ( ; (nn = ogg_stream_flush (&odata->ostream, &odata->opage)) ; )
- { if (! (nn = ogg_write_page (psf, &odata->opage)))
+ while (ogg_stream_flush (&odata->ostream, &odata->opage))
+ { nn = ogg_write_page (psf, &odata->opage) ;
+ if (nn < 0)
{ psf_log_printf (psf, "Opus : Failed to write comments!\n") ;
if (psf->error)
return psf->error ;
return SFE_INTERNAL ;
} ;
psf->dataoffset += nn ;
- }
+ } ;
return 0 ;
} /* ogg_opus_write_header */
@@ -1124,7 +1126,8 @@ ogg_opus_write_out (SF_PRIVATE *psf, OGG_PRIVATE *odata, OPUS_PRIVATE *oopus)
*/
oopus->u.encode.last_segments -= odata->opage.header [26] ;
oopus->pg_pos = oopus->pkt_pos ;
- ogg_write_page (psf, &odata->opage) ;
+ if (ogg_write_page (psf, &odata->opage) < 0)
+ return -1 ;
}
else
break ;
diff --git a/src/ogg_vorbis.c b/src/ogg_vorbis.c
index 5f53651..ef1f121 100644
--- a/src/ogg_vorbis.c
+++ b/src/ogg_vorbis.c
@@ -78,25 +78,6 @@
#include "ogg.h"
-typedef int convert_func (SF_PRIVATE *psf, int, void *, int, int, float **) ;
-
-static int vorbis_read_header (SF_PRIVATE *psf) ;
-static int vorbis_write_header (SF_PRIVATE *psf, int calc_length) ;
-static int vorbis_close (SF_PRIVATE *psf) ;
-static int vorbis_command (SF_PRIVATE *psf, int command, void *data, int datasize) ;
-static int vorbis_byterate (SF_PRIVATE *psf) ;
-static sf_count_t vorbis_calculate_page_duration (SF_PRIVATE *psf) ;
-static sf_count_t vorbis_seek (SF_PRIVATE *psf, int mode, sf_count_t offset) ;
-static sf_count_t vorbis_read_s (SF_PRIVATE *psf, short *ptr, sf_count_t len) ;
-static sf_count_t vorbis_read_i (SF_PRIVATE *psf, int *ptr, sf_count_t len) ;
-static sf_count_t vorbis_read_f (SF_PRIVATE *psf, float *ptr, sf_count_t len) ;
-static sf_count_t vorbis_read_d (SF_PRIVATE *psf, double *ptr, sf_count_t len) ;
-static sf_count_t vorbis_write_s (SF_PRIVATE *psf, const short *ptr, sf_count_t len) ;
-static sf_count_t vorbis_write_i (SF_PRIVATE *psf, const int *ptr, sf_count_t len) ;
-static sf_count_t vorbis_write_f (SF_PRIVATE *psf, const float *ptr, sf_count_t len) ;
-static sf_count_t vorbis_write_d (SF_PRIVATE *psf, const double *ptr, sf_count_t len) ;
-static sf_count_t vorbis_read_sample (SF_PRIVATE *psf, void *ptr, sf_count_t lens, convert_func *transfn) ;
-static int vorbis_rnull (SF_PRIVATE *psf, int samples, void *vptr, int off , int channels, float **pcm) ;
typedef struct
{ int id ;
@@ -143,6 +124,43 @@ typedef struct
sf_count_t last_page ;
} VORBIS_PRIVATE ;
+typedef int convert_func (SF_PRIVATE *psf, int, void *, int, int, float **) ;
+
+static int vorbis_read_header (SF_PRIVATE *psf) ;
+static int vorbis_write_header (SF_PRIVATE *psf, int calc_length) ;
+static int vorbis_close (SF_PRIVATE *psf) ;
+static int vorbis_command (SF_PRIVATE *psf, int command, void *data, int datasize) ;
+static int vorbis_byterate (SF_PRIVATE *psf) ;
+static sf_count_t vorbis_calculate_page_duration (SF_PRIVATE *psf) ;
+static sf_count_t vorbis_seek (SF_PRIVATE *psf, int mode, sf_count_t offset) ;
+static sf_count_t vorbis_read_s (SF_PRIVATE *psf, short *ptr, sf_count_t len) ;
+static sf_count_t vorbis_read_i (SF_PRIVATE *psf, int *ptr, sf_count_t len) ;
+static sf_count_t vorbis_read_f (SF_PRIVATE *psf, float *ptr, sf_count_t len) ;
+static sf_count_t vorbis_read_d (SF_PRIVATE *psf, double *ptr, sf_count_t len) ;
+static sf_count_t vorbis_write_s (SF_PRIVATE *psf, const short *ptr, sf_count_t len) ;
+static sf_count_t vorbis_write_i (SF_PRIVATE *psf, const int *ptr, sf_count_t len) ;
+static sf_count_t vorbis_write_f (SF_PRIVATE *psf, const float *ptr, sf_count_t len) ;
+static sf_count_t vorbis_write_d (SF_PRIVATE *psf, const double *ptr, sf_count_t len) ;
+static sf_count_t vorbis_read_sample (SF_PRIVATE *psf, void *ptr, sf_count_t lens, convert_func *transfn) ;
+static int vorbis_write_samples (SF_PRIVATE *psf, OGG_PRIVATE *odata, VORBIS_PRIVATE *vdata, int in_frames) ;
+static int vorbis_rnull (SF_PRIVATE *psf, int samples, void *vptr, int off , int channels, float **pcm) ;
+static void vorbis_log_error (SF_PRIVATE *psf, int error) ;
+
+
+static void
+vorbis_log_error(SF_PRIVATE *psf, int error) {
+ switch (error)
+ { case 0: return;
+ case OV_EIMPL: psf->error = SFE_UNIMPLEMENTED ; break ;
+ case OV_ENOTVORBIS: psf->error = SFE_MALFORMED_FILE ; break ;
+ case OV_EBADHEADER: psf->error = SFE_MALFORMED_FILE ; break ;
+ case OV_EVERSION: psf->error = SFE_UNSUPPORTED_ENCODING ; break ;
+ case OV_EFAULT:
+ case OV_EINVAL:
+ default: psf->error = SFE_INTERNAL ;
+ } ;
+} ;
+
static int
vorbis_read_header (SF_PRIVATE *psf)
{ OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
@@ -386,7 +405,6 @@ vorbis_write_header (SF_PRIVATE *psf, int UNUSED (calc_length))
{ ogg_packet header ;
ogg_packet header_comm ;
ogg_packet header_code ;
- int result ;
vorbis_analysis_headerout (&vdata->vdsp, &vdata->vcomment, &header, &header_comm, &header_code) ;
ogg_stream_packetin (&odata->ostream, &header) ; /* automatically placed in its own page */
@@ -396,9 +414,9 @@ vorbis_write_header (SF_PRIVATE *psf, int UNUSED (calc_length))
/* This ensures the actual
* audio data will start on a new page, as per spec
*/
- while ((result = ogg_stream_flush (&odata->ostream, &odata->opage)) != 0)
- { ogg_write_page (psf, &odata->opage) ;
- } ;
+ while (ogg_stream_flush (&odata->ostream, &odata->opage))
+ if (ogg_write_page (psf, &odata->opage) < 0)
+ return -1 ;
}
return 0 ;
@@ -408,6 +426,7 @@ static int
vorbis_close (SF_PRIVATE *psf)
{ OGG_PRIVATE* odata = psf->container_data ;
VORBIS_PRIVATE *vdata = psf->codec_data ;
+ int ret = 0 ;
if (odata == NULL || vdata == NULL)
return 0 ;
@@ -418,34 +437,14 @@ vorbis_close (SF_PRIVATE *psf)
if (psf->file.mode == SFM_WRITE)
{
if (psf->write_current <= 0)
- vorbis_write_header (psf, 0) ;
-
- vorbis_analysis_wrote (&vdata->vdsp, 0) ;
- while (vorbis_analysis_blockout (&vdata->vdsp, &vdata->vblock) == 1)
- {
-
- /* analysis, assume we want to use bitrate management */
- vorbis_analysis (&vdata->vblock, NULL) ;
- vorbis_bitrate_addblock (&vdata->vblock) ;
-
- while (vorbis_bitrate_flushpacket (&vdata->vdsp, &odata->opacket))
- { /* weld the packet into the bitstream */
- ogg_stream_packetin (&odata->ostream, &odata->opacket) ;
-
- /* write out pages (if any) */
- while (!odata->eos)
- { int result = ogg_stream_pageout (&odata->ostream, &odata->opage) ;
- if (result == 0) break ;
- ogg_write_page (psf, &odata->opage) ;
+ ret = vorbis_write_header (psf, 0) ;
- /* this could be set above, but for illustrative purposes, I do
- it here (to show that vorbis does know where the stream ends) */
-
- if (ogg_page_eos (&odata->opage)) odata->eos = 1 ;
- }
- }
- }
- }
+ if (ret == 0)
+ { /* A write of zero samples tells Vorbis the stream is done and to
+ flush. */
+ ret = vorbis_write_samples (psf, odata, vdata, 0) ;
+ } ;
+ } ;
/* ogg_page and ogg_packet structs always point to storage in
libvorbis. They are never freed or manipulated directly */
@@ -455,7 +454,7 @@ vorbis_close (SF_PRIVATE *psf)
vorbis_comment_clear (&vdata->vcomment) ;
vorbis_info_clear (&vdata->vinfo) ;
- return 0 ;
+ return ret ;
} /* vorbis_close */
int
@@ -686,33 +685,40 @@ vorbis_read_d (SF_PRIVATE *psf, double *ptr, sf_count_t lens)
/*==============================================================================
*/
-static void
+static int
vorbis_write_samples (SF_PRIVATE *psf, OGG_PRIVATE *odata, VORBIS_PRIVATE *vdata, int in_frames)
-{
- vorbis_analysis_wrote (&vdata->vdsp, in_frames) ;
+{ int ret ;
+
+ if ((ret = vorbis_analysis_wrote (&vdata->vdsp, in_frames)) != 0)
+ return ret ;
/*
** Vorbis does some data preanalysis, then divvies up blocks for
** more involved (potentially parallel) processing. Get a single
** block for encoding now.
*/
- while (vorbis_analysis_blockout (&vdata->vdsp, &vdata->vblock) == 1)
+ while ((ret = vorbis_analysis_blockout (&vdata->vdsp, &vdata->vblock)) == 1)
{
/* analysis, assume we want to use bitrate management */
- vorbis_analysis (&vdata->vblock, NULL) ;
- vorbis_bitrate_addblock (&vdata->vblock) ;
+ if ((ret = vorbis_analysis (&vdata->vblock, NULL)) != 0)
+ return ret ;
+ if ((ret = vorbis_bitrate_addblock (&vdata->vblock)) != 0)
+ return ret ;
- while (vorbis_bitrate_flushpacket (&vdata->vdsp, &odata->opacket))
+ while ((ret = vorbis_bitrate_flushpacket (&vdata->vdsp, &odata->opacket)) == 1)
{
/* weld the packet into the bitstream */
- ogg_stream_packetin (&odata->ostream, &odata->opacket) ;
+ if ((ret = ogg_stream_packetin (&odata->ostream, &odata->opacket)) != 0)
+ return ret ;
/* write out pages (if any) */
while (!odata->eos)
- { int result = ogg_stream_pageout (&odata->ostream, &odata->opage) ;
- if (result == 0)
+ { ret = ogg_stream_pageout (&odata->ostream, &odata->opage) ;
+ if (ret == 0)
break ;
- ogg_write_page (psf, &odata->opage) ;
+
+ if (ogg_write_page (psf, &odata->opage) < 0)
+ return -1 ;
/* This could be set above, but for illustrative purposes, I do
** it here (to show that vorbis does know where the stream ends) */
@@ -720,16 +726,20 @@ vorbis_write_samples (SF_PRIVATE *psf, OGG_PRIVATE *odata, VORBIS_PRIVATE *vdata
odata->eos = 1 ;
} ;
} ;
+ if (ret != 0)
+ return ret ;
} ;
-
+ if (ret != 0)
+ return ret ;
vdata->loc += in_frames ;
+ return 0 ;
} /* vorbis_write_data */
static sf_count_t
vorbis_write_s (SF_PRIVATE *psf, const short *ptr, sf_count_t lens)
{
- int i, m, j = 0 ;
+ int i, m, j = 0, ret ;
OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
VORBIS_PRIVATE *vdata = (VORBIS_PRIVATE *) psf->codec_data ;
int in_frames = lens / psf->sf.channels ;
@@ -738,14 +748,17 @@ vorbis_write_s (SF_PRIVATE *psf, const short *ptr, sf_count_t lens)
for (m = 0 ; m < psf->sf.channels ; m++)
buffer [m][i] = (float) (ptr [j++]) / 32767.0f ;
- vorbis_write_samples (psf, odata, vdata, in_frames) ;
+ if ((ret = vorbis_write_samples (psf, odata, vdata, in_frames)))
+ { vorbis_log_error (psf, ret) ;
+ return 0 ;
+ } ;
return lens ;
} /* vorbis_write_s */
static sf_count_t
vorbis_write_i (SF_PRIVATE *psf, const int *ptr, sf_count_t lens)
-{ int i, m, j = 0 ;
+{ int i, m, j = 0, ret ;
OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
VORBIS_PRIVATE *vdata = (VORBIS_PRIVATE *) psf->codec_data ;
int in_frames = lens / psf->sf.channels ;
@@ -754,14 +767,17 @@ vorbis_write_i (SF_PRIVATE *psf, const int *ptr, sf_count_t lens)
for (m = 0 ; m < psf->sf.channels ; m++)
buffer [m][i] = (float) (ptr [j++]) / 2147483647.0f ;
- vorbis_write_samples (psf, odata, vdata, in_frames) ;
+ if ((ret = vorbis_write_samples (psf, odata, vdata, in_frames)))
+ { vorbis_log_error (psf, ret) ;
+ return 0 ;
+ } ;
return lens ;
} /* vorbis_write_i */
static sf_count_t
vorbis_write_f (SF_PRIVATE *psf, const float *ptr, sf_count_t lens)
-{ int i, m, j = 0 ;
+{ int i, m, j = 0, ret ;
OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
VORBIS_PRIVATE *vdata = (VORBIS_PRIVATE *) psf->codec_data ;
int in_frames = lens / psf->sf.channels ;
@@ -770,14 +786,17 @@ vorbis_write_f (SF_PRIVATE *psf, const float *ptr, sf_count_t lens)
for (m = 0 ; m < psf->sf.channels ; m++)
buffer [m][i] = ptr [j++] ;
- vorbis_write_samples (psf, odata, vdata, in_frames) ;
+ if ((ret = vorbis_write_samples (psf, odata, vdata, in_frames)) != 0)
+ { vorbis_log_error (psf, ret) ;
+ return 0 ;
+ } ;
return lens ;
} /* vorbis_write_f */
static sf_count_t
vorbis_write_d (SF_PRIVATE *psf, const double *ptr, sf_count_t lens)
-{ int i, m, j = 0 ;
+{ int i, m, j = 0, ret ;
OGG_PRIVATE *odata = (OGG_PRIVATE *) psf->container_data ;
VORBIS_PRIVATE *vdata = (VORBIS_PRIVATE *) psf->codec_data ;
int in_frames = lens / psf->sf.channels ;
@@ -786,7 +805,10 @@ vorbis_write_d (SF_PRIVATE *psf, const double *ptr, sf_count_t lens)
for (m = 0 ; m < psf->sf.channels ; m++)
buffer [m][i] = (float) ptr [j++] ;
- vorbis_write_samples (psf, odata, vdata, in_frames) ;
+ if ((ret = vorbis_write_samples (psf, odata, vdata, in_frames)) != 0)
+ { vorbis_log_error (psf, ret) ;
+ return 0 ;
+ } ;
return lens ;
} /* vorbis_write_d */
--
2.33.0

25
libsndfile-1.0.25-zerodivfix.patch Normal file
View File

@ -0,0 +1,25 @@
From 725c7dbb95bfaf8b4bb7b04820e3a00cceea9ce6 Mon Sep 17 00:00:00 2001
From: Erik de Castro Lopo <erikd@mega-nerd.com>
Date: Wed, 24 Dec 2014 21:02:35 +1100
Subject: [PATCH] src/file_io.c : Prevent potential divide-by-zero.
Closes: https://github.com/erikd/libsndfile/issues/92
---
src/file_io.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/src/file_io.c b/src/file_io.c
index 26d3d6d..6ccab78 100644
--- a/src/file_io.c
+++ b/src/file_io.c
@@ -1322,6 +1322,9 @@ psf_fwrite (const void *ptr, sf_count_t bytes, sf_count_t items, SF_PRIVATE *psf
{ sf_count_t total = 0 ;
ssize_t count ;
+ if (bytes == 0 || items == 0)
+ return 0 ;
+
if (psf->virtual_io)
return psf->vio.write (ptr, bytes*items, psf->vio_user_data) / bytes ;

39
libsndfile-1.0.28-CVE-2017-14634.patch Normal file
View File

@ -0,0 +1,39 @@
From 85c877d5072866aadbe8ed0c3e0590fbb5e16788 Mon Sep 17 00:00:00 2001
From: Fabian Greffrath <fabian@greffrath.com>
Date: Thu, 28 Sep 2017 12:15:04 +0200
Subject: [PATCH 1/1] double64_init: Check psf->sf.channels against upper bound
This prevents division by zero later in the code.
While the trivial case to catch this (i.e. sf.channels < 1) has already
been covered, a crafted file may report a number of channels that is
so high (i.e. > INT_MAX/sizeof(double)) that it "somehow" gets
miscalculated to zero (if this makes sense) in the determination of the
blockwidth. Since we only support a limited number of channels anyway,
make sure to check here as well.
CVE-2017-14634
Closes: https://github.com/erikd/libsndfile/issues/318
Signed-off-by: Erik de Castro Lopo <erikd@mega-nerd.com>
Signed-off-by: chenmaodong <chenmaodong@huawei.com>
---
src/double64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/double64.c b/src/double64.c
index b318ea8..78dfef7 100644
--- a/src/double64.c
+++ b/src/double64.c
@@ -91,7 +91,7 @@ int
double64_init (SF_PRIVATE *psf)
{ static int double64_caps ;
- if (psf->sf.channels < 1)
+ if (psf->sf.channels < 1 || psf->sf.channels > SF_MAX_CHANNELS)
{ psf_log_printf (psf, "double64_init : internal error : channels = %d\n", psf->sf.channels) ;
return SFE_INTERNAL ;
} ;
--
1.8.3.1

94
libsndfile-1.0.28-CVE-2017-17456-CVE-2017-17457-CVE-2018-19661-CVE-2018-19662.patch Normal file
View File

@ -0,0 +1,94 @@
From 585cc28a93be27d6938f276af0011401b9f7c0ca Mon Sep 17 00:00:00 2001
From: Hugo Lefeuvre <hle@owl.eu.com>
Date: Mon, 24 Dec 2018 06:43:48 +0100
Subject: [PATCH] a/ulaw: fix multiple buffer overflows (#432)
i2ulaw_array() and i2alaw_array() fail to handle ptr [count] = INT_MIN
properly, leading to buffer underflow. INT_MIN is a special value
since - INT_MIN cannot be represented as int.
In this case round - INT_MIN to INT_MAX and proceed as usual.
f2ulaw_array() and f2alaw_array() fail to handle ptr [count] = NaN
properly, leading to null pointer dereference.
In this case, arbitrarily set the buffer value to 0.
This commit fixes #429 (CVE-2018-19661 and CVE-2018-19662) and
fixes #344 (CVE-2017-17456 and CVE-2017-17457).
---
src/alaw.c | 9 +++++++--
src/ulaw.c | 9 +++++++--
2 files changed, 14 insertions(+), 4 deletions(-)
diff --git a/src/alaw.c b/src/alaw.c
index 063fd1a..4220224 100644
--- a/src/alaw.c
+++ b/src/alaw.c
@@ -19,6 +19,7 @@
#include "sfconfig.h"
#include <math.h>
+#include <limits.h>
#include "sndfile.h"
#include "common.h"
@@ -326,7 +327,9 @@ s2alaw_array (const short *ptr, int count, unsigned char *buffer)
static inline void
i2alaw_array (const int *ptr, int count, unsigned char *buffer)
{ while (--count >= 0)
- { if (ptr [count] >= 0)
+ { if (ptr [count] == INT_MIN)
+ buffer [count] = alaw_encode [INT_MAX >> (16 + 4)] ;
+ else if (ptr [count] >= 0)
buffer [count] = alaw_encode [ptr [count] >> (16 + 4)] ;
else
buffer [count] = 0x7F & alaw_encode [- ptr [count] >> (16 + 4)] ;
@@ -346,7 +349,9 @@ f2alaw_array (const float *ptr, int count, unsigned char *buffer, float normfact
static inline void
d2alaw_array (const double *ptr, int count, unsigned char *buffer, double normfact)
{ while (--count >= 0)
- { if (ptr [count] >= 0)
+ { if (!isfinite (ptr [count]))
+ buffer [count] = 0 ;
+ else if (ptr [count] >= 0)
buffer [count] = alaw_encode [lrint (normfact * ptr [count])] ;
else
buffer [count] = 0x7F & alaw_encode [- lrint (normfact * ptr [count])] ;
diff --git a/src/ulaw.c b/src/ulaw.c
index e50b4cb..b6070ad 100644
--- a/src/ulaw.c
+++ b/src/ulaw.c
@@ -19,6 +19,7 @@
#include "sfconfig.h"
#include <math.h>
+#include <limits.h>
#include "sndfile.h"
#include "common.h"
@@ -827,7 +828,9 @@ s2ulaw_array (const short *ptr, int count, unsigned char *buffer)
static inline void
i2ulaw_array (const int *ptr, int count, unsigned char *buffer)
{ while (--count >= 0)
- { if (ptr [count] >= 0)
+ { if (ptr [count] == INT_MIN)
+ buffer [count] = ulaw_encode [INT_MAX >> (16 + 2)] ;
+ else if (ptr [count] >= 0)
buffer [count] = ulaw_encode [ptr [count] >> (16 + 2)] ;
else
buffer [count] = 0x7F & ulaw_encode [-ptr [count] >> (16 + 2)] ;
@@ -847,7 +850,9 @@ f2ulaw_array (const float *ptr, int count, unsigned char *buffer, float normfact
static inline void
d2ulaw_array (const double *ptr, int count, unsigned char *buffer, double normfact)
{ while (--count >= 0)
- { if (ptr [count] >= 0)
+ { if (!isfinite (ptr [count]))
+ buffer [count] = 0 ;
+ else if (ptr [count] >= 0)
buffer [count] = ulaw_encode [lrint (normfact * ptr [count])] ;
else
buffer [count] = 0x7F & ulaw_encode [- lrint (normfact * ptr [count])] ;
--
2.19.1

54
libsndfile-1.0.28-CVE-2017-8362.patch Normal file
View File

@ -0,0 +1,54 @@
From ef1dbb2df1c0e741486646de40bd638a9c4cd808 Mon Sep 17 00:00:00 2001
From: Erik de Castro Lopo <erikd@mega-nerd.com>
Date: Fri, 14 Apr 2017 15:19:16 +1000
Subject: [PATCH 1/1] src/flac.c: Fix a buffer read overflow
A file (generated by a fuzzer) which increased the number of channels
from one frame to the next could cause a read beyond the end of the
buffer provided by libFLAC. Only option is to abort the read.
Closes: https://github.com/erikd/libsndfile/issues/231
Signed-off-by: chenmaodong <chenmaodong@huawei.com>
---
src/flac.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/src/flac.c b/src/flac.c
index 5a4f8c2..e4f9aaa 100644
--- a/src/flac.c
+++ b/src/flac.c
@@ -169,6 +169,14 @@ flac_buffer_copy (SF_PRIVATE *psf)
const int32_t* const *buffer = pflac->wbuffer ;
unsigned i = 0, j, offset, channels, len ;
+ if (psf->sf.channels != (int) frame->header.channels)
+ { psf_log_printf (psf, "Error: FLAC frame changed from %d to %d channels\n"
+ "Nothing to do but to error out.\n" ,
+ psf->sf.channels, frame->header.channels) ;
+ psf->error = SFE_FLAC_CHANNEL_COUNT_CHANGED ;
+ return 0 ;
+ } ;
+
/*
** frame->header.blocksize is variable and we're using a constant blocksize
** of FLAC__MAX_BLOCK_SIZE.
@@ -202,7 +210,6 @@ flac_buffer_copy (SF_PRIVATE *psf)
return 0 ;
} ;
-
len = SF_MIN (pflac->len, frame->header.blocksize) ;
if (pflac->remain % channels != 0)
@@ -436,7 +443,7 @@ sf_flac_meta_callback (const FLAC__StreamDecoder * UNUSED (decoder), const FLAC_
{ case FLAC__METADATA_TYPE_STREAMINFO :
if (psf->sf.channels > 0 && psf->sf.channels != (int) metadata->data.stream_info.channels)
{ psf_log_printf (psf, "Error: FLAC stream changed from %d to %d channels\n"
- "Nothing to be but to error out.\n" ,
+ "Nothing to do but to error out.\n" ,
psf->sf.channels, metadata->data.stream_info.channels) ;
psf->error = SFE_FLAC_CHANNEL_COUNT_CHANGED ;
return ;
--
1.8.3.1

17
libsndfile-1.0.28-CVE-2018-13139-CVE-2018-19432.patch Normal file
View File

@ -0,0 +1,17 @@
diff --git a/programs/sndfile-deinterleave.c b/programs/sndfile-deinterleave.c
index e27593e..721bee7 100644
--- a/programs/sndfile-deinterleave.c
+++ b/programs/sndfile-deinterleave.c
@@ -89,6 +89,12 @@ main (int argc, char **argv)
exit (1) ;
} ;
+ if (sfinfo.channels > MAX_CHANNELS)
+ { printf ("\nError : Input file '%s' has too many (%d) channels. Limit is %d.\n",
+ argv [1], sfinfo.channels, MAX_CHANNELS) ;
+ exit (1) ;
+ } ;
+
state.channels = sfinfo.channels ;
sfinfo.channels = 1 ;

45
libsndfile-1.0.28-CVE-2018-19758.patch Normal file
View File

@ -0,0 +1,45 @@
From 42132c543358cee9f7c3e9e9b15bb6c1063a608e Mon Sep 17 00:00:00 2001
From: Erik de Castro Lopo <erikd@mega-nerd.com>
Date: Tue, 1 Jan 2019 20:11:46 +1100
Subject: [PATCH 1/1] src/wav.c: Fix heap read overflow
This is CVE-2018-19758.
Closes: https://github.com/erikd/libsndfile/issues/435
Signed-off-by: chenmaodong <chenmaodong@huawei.com>
---
src/wav.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/wav.c b/src/wav.c
index 9d71aad..5c825f2 100644
--- a/src/wav.c
+++ b/src/wav.c
@@ -1,5 +1,5 @@
/*
-** Copyright (C) 1999-2016 Erik de Castro Lopo <erikd@mega-nerd.com>
+** Copyright (C) 1999-2019 Erik de Castro Lopo <erikd@mega-nerd.com>
** Copyright (C) 2004-2005 David Viens <davidv@plogue.com>
**
** This program is free software; you can redistribute it and/or modify
@@ -1146,6 +1146,8 @@ wav_write_header (SF_PRIVATE *psf, int calc_length)
psf_binheader_writef (psf, "44", 0, 0) ; /* SMTPE format */
psf_binheader_writef (psf, "44", psf->instrument->loop_count, 0) ;
+ /* Loop count is signed 16 bit number so we limit it range to something sensible. */
+ psf->instrument->loop_count &= 0x7fff ;
for (tmp = 0 ; tmp < psf->instrument->loop_count ; tmp++)
{ int type ;
@@ -1412,7 +1414,7 @@ wav_read_smpl_chunk (SF_PRIVATE *psf, uint32_t chunklen)
} ;
psf->instrument->basenote = note ;
- psf->instrument->detune = (int8_t)(pitch / (0x40000000 / 25.0) + 0.5) ;
+ psf->instrument->detune = (int8_t) (pitch / (0x40000000 / 25.0) + 0.5) ;
psf->instrument->gain = 1 ;
psf->instrument->velocity_lo = psf->instrument->key_lo = 0 ;
psf->instrument->velocity_hi = psf->instrument->key_hi = 127 ;
--
1.8.3.1

35
libsndfile-1.0.28-CVE-2019-3832.patch Normal file
View File

@ -0,0 +1,35 @@
From 6d7ce94c020cc720a6b28719d1a7879181790008 Mon Sep 17 00:00:00 2001
From: Emilio Pozuelo Monfort <pochu27@gmail.com>
Date: Tue, 5 Mar 2019 11:27:17 +0100
Subject: [PATCH 1/1] wav_write_header: don't read past the array end
If loop_count is bigger than the array, truncate it to the array
length (and not to 32k).
CVE-2019-3832
Signed-off-by: chenmaodong <chenmaodong@huawei.com>
---
src/wav.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/wav.c b/src/wav.c
index 5c825f2..104bd0a 100644
--- a/src/wav.c
+++ b/src/wav.c
@@ -1146,8 +1146,10 @@ wav_write_header (SF_PRIVATE *psf, int calc_length)
psf_binheader_writef (psf, "44", 0, 0) ; /* SMTPE format */
psf_binheader_writef (psf, "44", psf->instrument->loop_count, 0) ;
- /* Loop count is signed 16 bit number so we limit it range to something sensible. */
- psf->instrument->loop_count &= 0x7fff ;
+ /* Make sure we don't read past the loops array end. */
+ if (psf->instrument->loop_count > ARRAY_LEN (psf->instrument->loops))
+ psf->instrument->loop_count = ARRAY_LEN (psf->instrument->loops) ;
+
for (tmp = 0 ; tmp < psf->instrument->loop_count ; tmp++)
{ int type ;
--
1.8.3.1

88
libsndfile-1.0.28-cve2017_12562.patch Normal file
View File

@ -0,0 +1,88 @@
From cf7a8182c2642c50f1cf90dddea9ce96a8bad2e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rn=20Heusipp?= <osmanx@problemloesungsmaschine.de>
Date: Wed, 14 Jun 2017 12:25:40 +0200
Subject: [PATCH] src/common.c: Fix heap buffer overflows when writing strings
in binheader
Fixes the following problems:
1. Case 's' only enlarges the buffer by 16 bytes instead of size bytes.
2. psf_binheader_writef() enlarges the header buffer (if needed) prior to the
big switch statement by an amount (16 bytes) which is enough for all cases
where only a single value gets added. Cases 's', 'S', 'p' however
additionally write an arbitrary length block of data and again enlarge the
buffer to the required amount. However, the required space calculation does
not take into account the size of the length field which gets output before
the data.
3. Buffer size requirement calculation in case 'S' does not account for the
padding byte ("size += (size & 1) ;" happens after the calculation which
uses "size").
4. Case 'S' can overrun the header buffer by 1 byte when no padding is
involved
("memcpy (&(psf->header.ptr [psf->header.indx]), strptr, size + 1) ;" while
the buffer is only guaranteed to have "size" space available).
5. "psf->header.ptr [psf->header.indx] = 0 ;" in case 'S' always writes 1 byte
beyond the space which is guaranteed to be allocated in the header buffer.
6. Case 's' can overrun the provided source string by 1 byte if padding is
involved ("memcpy (&(psf->header.ptr [psf->header.indx]), strptr, size) ;"
where "size" is "strlen (strptr) + 1" (which includes the 0 terminator,
plus optionally another 1 which is padding and not guaranteed to be
readable via the source string pointer).
Closes: https://github.com/erikd/libsndfile/issues/292
---
src/common.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/src/common.c b/src/common.c
index 1a6204ca..6b2a2ee9 100644
--- a/src/common.c
+++ b/src/common.c
@@ -681,16 +681,16 @@ psf_binheader_writef (SF_PRIVATE *psf, const char *format, ...)
/* Write a C string (guaranteed to have a zero terminator). */
strptr = va_arg (argptr, char *) ;
size = strlen (strptr) + 1 ;
- size += (size & 1) ;
- if (psf->header.indx + (sf_count_t) size >= psf->header.len && psf_bump_header_allocation (psf, 16))
+ if (psf->header.indx + 4 + (sf_count_t) size + (sf_count_t) (size & 1) > psf->header.len && psf_bump_header_allocation (psf, 4 + size + (size & 1)))
return count ;
if (psf->rwf_endian == SF_ENDIAN_BIG)
- header_put_be_int (psf, size) ;
+ header_put_be_int (psf, size + (size & 1)) ;
else
- header_put_le_int (psf, size) ;
+ header_put_le_int (psf, size + (size & 1)) ;
memcpy (&(psf->header.ptr [psf->header.indx]), strptr, size) ;
+ size += (size & 1) ;
psf->header.indx += size ;
psf->header.ptr [psf->header.indx - 1] = 0 ;
count += 4 + size ;
@@ -703,16 +703,15 @@ psf_binheader_writef (SF_PRIVATE *psf, const char *format, ...)
*/
strptr = va_arg (argptr, char *) ;
size = strlen (strptr) ;
- if (psf->header.indx + (sf_count_t) size > psf->header.len && psf_bump_header_allocation (psf, size))
+ if (psf->header.indx + 4 + (sf_count_t) size + (sf_count_t) (size & 1) > psf->header.len && psf_bump_header_allocation (psf, 4 + size + (size & 1)))
return count ;
if (psf->rwf_endian == SF_ENDIAN_BIG)
header_put_be_int (psf, size) ;
else
header_put_le_int (psf, size) ;
- memcpy (&(psf->header.ptr [psf->header.indx]), strptr, size + 1) ;
+ memcpy (&(psf->header.ptr [psf->header.indx]), strptr, size + (size & 1)) ;
size += (size & 1) ;
psf->header.indx += size ;
- psf->header.ptr [psf->header.indx] = 0 ;
count += 4 + size ;
break ;
@@ -724,7 +723,7 @@ psf_binheader_writef (SF_PRIVATE *psf, const char *format, ...)
size = (size & 1) ? size : size + 1 ;
size = (size > 254) ? 254 : size ;
- if (psf->header.indx + (sf_count_t) size > psf->header.len && psf_bump_header_allocation (psf, size))
+ if (psf->header.indx + 1 + (sf_count_t) size > psf->header.len && psf_bump_header_allocation (psf, 1 + size))
return count ;
header_put_byte (psf, size) ;

64
libsndfile-1.0.28-flacbufovfl.patch Normal file
View File

@ -0,0 +1,64 @@
From fd0484aba8e51d16af1e3a880f9b8b857b385eb3 Mon Sep 17 00:00:00 2001
From: Erik de Castro Lopo <erikd@mega-nerd.com>
Date: Wed, 12 Apr 2017 19:45:30 +1000
Subject: [PATCH] FLAC: Fix a buffer read overrun
Buffer read overrun occurs when reading a FLAC file that switches
from 2 channels to one channel mid-stream. Only option is to
abort the read.
Closes: https://github.com/erikd/libsndfile/issues/230
---
src/common.h | 1 +
src/flac.c | 13 +++++++++++++
src/sndfile.c | 1 +
3 files changed, 15 insertions(+)
diff --git a/src/common.h b/src/common.h
index 0bd810c3..e2669b6a 100644
--- a/src/common.h
+++ b/src/common.h
@@ -725,6 +725,7 @@ enum
SFE_FLAC_INIT_DECODER,
SFE_FLAC_LOST_SYNC,
SFE_FLAC_BAD_SAMPLE_RATE,
+ SFE_FLAC_CHANNEL_COUNT_CHANGED,
SFE_FLAC_UNKOWN_ERROR,
SFE_WVE_NOT_WVE,
diff --git a/src/flac.c b/src/flac.c
index 84de0e26..986a7b8f 100644
--- a/src/flac.c
+++ b/src/flac.c
@@ -434,6 +434,19 @@ sf_flac_meta_callback (const FLAC__StreamDecoder * UNUSED (decoder), const FLAC_
switch (metadata->type)
{ case FLAC__METADATA_TYPE_STREAMINFO :
+ if (psf->sf.channels > 0 && psf->sf.channels != (int) metadata->data.stream_info.channels)
+ { psf_log_printf (psf, "Error: FLAC stream changed from %d to %d channels\n"
+ "Nothing to be but to error out.\n" ,
+ psf->sf.channels, metadata->data.stream_info.channels) ;
+ psf->error = SFE_FLAC_CHANNEL_COUNT_CHANGED ;
+ return ;
+ } ;
+
+ if (psf->sf.channels > 0 && psf->sf.samplerate != (int) metadata->data.stream_info.sample_rate)
+ { psf_log_printf (psf, "Warning: FLAC stream changed sample rates from %d to %d.\n"
+ "Carrying on as if nothing happened.",
+ psf->sf.samplerate, metadata->data.stream_info.sample_rate) ;
+ } ;
psf->sf.channels = metadata->data.stream_info.channels ;
psf->sf.samplerate = metadata->data.stream_info.sample_rate ;
psf->sf.frames = metadata->data.stream_info.total_samples ;
diff --git a/src/sndfile.c b/src/sndfile.c
index 41875610..e2a87be8 100644
--- a/src/sndfile.c
+++ b/src/sndfile.c
@@ -245,6 +245,7 @@ ErrorStruct SndfileErrors [] =
{ SFE_FLAC_INIT_DECODER , "Error : problem with initialization of the flac decoder." },
{ SFE_FLAC_LOST_SYNC , "Error : flac decoder lost sync." },
{ SFE_FLAC_BAD_SAMPLE_RATE, "Error : flac does not support this sample rate." },
+ { SFE_FLAC_CHANNEL_COUNT_CHANGED, "Error : flac channel changed mid stream." },
{ SFE_FLAC_UNKOWN_ERROR , "Error : unknown error in flac decoder." },
{ SFE_WVE_NOT_WVE , "Error : not a WVE file." },

67
libsndfile-1.0.28-src-wav.c-Fix-WAV-Sampler-Chunk-tune-parsing.patch Normal file
View File

@ -0,0 +1,67 @@
From 7ea3f9d8746000cc82c016d0b5d48452bb80e9fe Mon Sep 17 00:00:00 2001
From: Michael Panzlaff <michael.panzlaff@fau.de>
Date: Sat, 28 Apr 2018 23:21:34 +0200
Subject: [PATCH 1/1] src/wav.c: Fix WAV Sampler Chunk tune parsing
Fix parsing of instrument fine tuning instrument field. There is still
a possible rounding error involved which might require further
investigation at some stage.
Update the test as well.
Signed-off-by: chenmaodong <chenmaodong@huawei.com>
---
src/wav.c | 9 +++++----
tests/command_test.c | 1 -
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/src/wav.c b/src/wav.c
index dc97545..04bf844 100644
--- a/src/wav.c
+++ b/src/wav.c
@@ -1282,7 +1282,7 @@ static int
wav_read_smpl_chunk (SF_PRIVATE *psf, uint32_t chunklen)
{ char buffer [512] ;
uint32_t thisread, bytesread = 0, dword, sampler_data, loop_count ;
- uint32_t note, start, end, type = -1, count ;
+ uint32_t note, pitch, start, end, type = -1, count ;
int j, k ;
chunklen += (chunklen & 1) ;
@@ -1299,10 +1299,10 @@ wav_read_smpl_chunk (SF_PRIVATE *psf, uint32_t chunklen)
bytesread += psf_binheader_readf (psf, "4", &note) ;
psf_log_printf (psf, " Midi Note : %u\n", note) ;
- bytesread += psf_binheader_readf (psf, "4", &dword) ;
- if (dword != 0)
+ bytesread += psf_binheader_readf (psf, "4", &pitch) ;
+ if (pitch != 0)
{ snprintf (buffer, sizeof (buffer), "%f",
- (1.0 * 0x80000000) / ((uint32_t) dword)) ;
+ (1.0 * 0x80000000) / ((uint32_t) pitch)) ;
psf_log_printf (psf, " Pitch Fract. : %s\n", buffer) ;
}
else
@@ -1408,6 +1408,7 @@ wav_read_smpl_chunk (SF_PRIVATE *psf, uint32_t chunklen)
} ;
psf->instrument->basenote = note ;
+ psf->instrument->detune = (int8_t)(pitch / (0x40000000 / 25.0) + 0.5) ;
psf->instrument->gain = 1 ;
psf->instrument->velocity_lo = psf->instrument->key_lo = 0 ;
psf->instrument->velocity_hi = psf->instrument->key_hi = 127 ;
diff --git a/tests/command_test.c b/tests/command_test.c
index f879659..c3e7c86 100644
--- a/tests/command_test.c
+++ b/tests/command_test.c
@@ -768,7 +768,6 @@ instrument_test (const char *filename, int filetype)
** write_inst struct to hold the default value that the WAV
** module should hold.
*/
- write_inst.detune = 0 ;
write_inst.key_lo = write_inst.velocity_lo = 0 ;
write_inst.key_hi = write_inst.velocity_hi = 127 ;
write_inst.gain = 1 ;
--
1.8.3.1

BIN
libsndfile-1.0.28.tar.gz Normal file
View File

Binary file not shown.

25
libsndfile-1.0.29-cve2017_6892.patch Normal file
View File

@ -0,0 +1,25 @@
From f833c53cb596e9e1792949f762e0b33661822748 Mon Sep 17 00:00:00 2001
From: Erik de Castro Lopo <erikd@mega-nerd.com>
Date: Tue, 23 May 2017 20:15:24 +1000
Subject: [PATCH] src/aiff.c: Fix a buffer read overflow
Secunia Advisory SA76717.
Found by: Laurent Delosieres, Secunia Research at Flexera Software
---
src/aiff.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/aiff.c b/src/aiff.c
index 5b5f9f53..45864b76 100644
--- a/src/aiff.c
+++ b/src/aiff.c
@@ -1759,7 +1759,7 @@ aiff_read_chanmap (SF_PRIVATE * psf, unsigned dword)
psf_binheader_readf (psf, "j", dword - bytesread) ;
if (map_info->channel_map != NULL)
- { size_t chanmap_size = psf->sf.channels * sizeof (psf->channel_map [0]) ;
+ { size_t chanmap_size = SF_MIN (psf->sf.channels, layout_tag & 0xffff) * sizeof (psf->channel_map [0]) ;
free (psf->channel_map) ;

BIN
libsndfile-1.0.31.tar.bz2
View File

Binary file not shown.

42
libsndfile.spec
View File

@ -1,20 +1,27 @@
Name: libsndfile Name: libsndfile
Version: 1.0.31 Version: 1.0.28
Release: 5 Release: 19
Summary: Library for reading and writing sound files Summary: Library for reading and writing sound files
License: LGPLv2+ and GPLv2+ and BSD License: LGPLv2+ and GPLv2+ and BSD
URL: http://libsndfile.github.io/libsndfile URL: http://www.mega-nerd.com/libsndfile/
Source0: https://github.com/libsndfile/libsndfile/releases/download/%{version}/%{name}-%{version}.tar.bz2 Source0: http://www.mega-nerd.com/libsndfile/files/libsndfile-%{version}.tar.gz
BuildRequires: alsa-lib-devel gcc gcc-c++ flac-devel BuildRequires: alsa-lib-devel gcc gcc-c++ flac-devel
BuildRequires: libogg-devel libtool libvorbis-devel pkgconfig BuildRequires: libogg-devel libtool libvorbis-devel pkgconfig
BuildRequires: sqlite-devel BuildRequires: sqlite-devel
BuildRequires: opus-devel
Patch1: 0001-CVE-2021-3246.patch Patch0: libsndfile-1.0.25-zerodivfix.patch
Patch2: 0002-CVE-2021-4156.patch Patch1: libsndfile-1.0.28-flacbufovfl.patch
Patch3: 0001-mat4-mat5-fix-int-overflow-in-dataend-calculation.patch Patch2: libsndfile-1.0.29-cve2017_6892.patch
Patch6001: backport-CVE-2024-50612.patch Patch3: libsndfile-1.0.28-cve2017_12562.patch
Patch6000: libsndfile-1.0.28-CVE-2018-13139-CVE-2018-19432.patch
Patch6001: libsndfile-1.0.28-src-wav.c-Fix-WAV-Sampler-Chunk-tune-parsing.patch
Patch6002: libsndfile-1.0.28-CVE-2018-19758.patch
Patch6003: libsndfile-1.0.28-CVE-2019-3832.patch
Patch6004: libsndfile-1.0.28-CVE-2017-17456-CVE-2017-17457-CVE-2018-19661-CVE-2018-19662.patch
Patch6005: libsndfile-1.0.28-CVE-2017-14634.patch
Patch6006: libsndfile-1.0.28-CVE-2017-8362.patch
Patch6007: backport-CVE-2021-3246.patch
%description %description
Libsndfile is a C library for reading and writing files containing Libsndfile is a C library for reading and writing files containing
@ -95,7 +102,9 @@ LD_LIBRARY_PATH=$PWD/src/.libs make check
%{_bindir}/sndfile-metadata-get %{_bindir}/sndfile-metadata-get
%{_bindir}/sndfile-metadata-set %{_bindir}/sndfile-metadata-set
%{_bindir}/sndfile-play %{_bindir}/sndfile-play
%{_bindir}/sndfile-regtest
%{_bindir}/sndfile-salvage %{_bindir}/sndfile-salvage
%exclude %{_bindir}/sndfile-jackplay
%files devel %files devel
%{_includedir}/sndfile.h %{_includedir}/sndfile.h
@ -119,21 +128,6 @@ LD_LIBRARY_PATH=$PWD/src/.libs make check
%{_mandir}/man1/sndfile-salvage.1* %{_mandir}/man1/sndfile-salvage.1*
%changelog %changelog
* Mon Dec 30 2024 zhangnaichuan <zhangnaichuan@huawei.com> - 1.0.31-5
- libsndfile:fix CVE-2024-50612
* Wed Nov 15 2023 EulerOSWander <314264452@qq.com> - 1.0.31-4
- libsndfile:fix CVE-2022-33065
* Mon Sep 11 2023 penghaitao <htpengc@isoftstone.com> - 1.0.31-3
- Add opus-devel to satisfy configure requirements check
* Mon May 16 2022 zhouwenpei <zhouwenpei1@h-partners.com> - 1.0.31-2
- fix CVE-2021-4156
* Wed Dec 1 2021 zhouwenpei <zhouwenpei1@huawei.com> - 1.0.31-1
- update to 1.0.31
* Thu Sep 23 2021 zhouwenpei <zhouwenpei1@huawei.com> - 1.0.28-19 * Thu Sep 23 2021 zhouwenpei <zhouwenpei1@huawei.com> - 1.0.28-19
- fix CVE-2021-3246 - fix CVE-2021-3246