csound/csound-fix-CVE-2012-2107.patch

From 61d1df45ca9a52bab62892a3c3a13c41e6384505 Mon Sep 17 00:00:00 2001
From: John ffitch <jpff@codemist.co.uk>
Date: Tue, 6 Mar 2012 17:12:43 +0000
Subject: [PATCH] security in utilities

---
 util/lpci_main.c |   17 ++++++++++++++---
 util/pv_import.c |    4 ++++
 2 files changed, 18 insertions(+), 3 deletions(-)

--- a/util/lpci_main.c
+++ b/util/lpci_main.c
@@ -73,17 +73,28 @@ int main(int argc, char **argv)
             hdr.headersize, hdr.lpmagic, hdr.npoles, hdr.nvals,
             hdr.framrate, hdr.srate, hdr.duration);
     str = (char *)malloc(hdr.headersize-sizeof(LPHEADER)+4);
-    fread(&hdr, sizeof(char), hdr.headersize-sizeof(LPHEADER)+4, inf);
+    if (str==NULL) {
+      printf("memory allocation failure\n");
+      exit(1);
+    }
+    if (hdr.headersize-sizeof(LPHEADER)+4 !=
+        fread(&hdr, sizeof(char), hdr.headersize-sizeof(LPHEADER)+4, inf)) {
+      printf("Ill formed data\n");
+      exit(1);
+    }
     for (i=0; i<hdr.headersize-sizeof(LPHEADER)+4; i++)
       putc(str[i],outf);
     putc('\n', outf);
-    coef = (MYFLT *)malloc((hdr.npoles+hdr.nvals)*sizeof(MYFLT));
+    coef = (MYFLT *)malloc(hdr.npoles*sizeof(MYFLT));
     if (coef==NULL) {
       printf("memory allocation failure\n");
       exit(1);
     }
     for (i = 0; i<hdr.nvals; i++) {
-      fread(&coef[0], sizeof(MYFLT), hdr.npoles, inf);
+      if (hdr.npoles != fread(coef, sizeof(MYFLT), hdr.npoles, inf)) {
+        printf("Ill formed data\n");
+        exit(1);
+      }
       for (j=0; j<hdr.npoles; j++)
         fprintf(outf, "%f%c", coef[j], (j==hdr.npoles-1 ? '\n' : ','));
     }
--- a/util/pv_import.c
+++ b/util/pv_import.c
@@ -115,6 +115,10 @@ static int pv_import(CSOUND *csound, int
       float *frame =
         (float*) csound->Malloc(csound, data.nAnalysisBins*2*sizeof(float));
       int i;
+      if (frame==NULL) {
+        csound->Message(csound, Str("Memory failure\n"));
+        exit(1);
+      }
       for (i=1;;i++) {
         int j;
         for (j=0; j<data.nAnalysisBins*2; j++) {