libsndfile/libsndfile-CVE-2017-17457-ulaw-range-check.patch
Takashi Iwai c6561c05e5 Accepting request 615236 from home:tiwai:branches:multimedia:libs
- Use license file tag

- Fix potential overflow in d2alaw_array() (CVE-2017-17456,
  bsc#1071777):
  libsndfile-CVE-2017-17456-alaw-range-check.patch
- Fix potential overflow in d2ulaw_array() (CVE-2017-17457,
  bsc#1071767):
  libsndfile-CVE-2017-17457-ulaw-range-check.patch

OBS-URL: https://build.opensuse.org/request/show/615236
OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/libsndfile?expand=0&rev=66
2018-06-08 13:05:50 +00:00

56 lines
1.6 KiB
Diff

---
src/ulaw.c | 36 ++++++++++++++++++++++++++++--------
1 file changed, 28 insertions(+), 8 deletions(-)
--- a/src/ulaw.c
+++ b/src/ulaw.c
@@ -837,20 +837,40 @@ i2ulaw_array (const int *ptr, int count,
static inline void
f2ulaw_array (const float *ptr, int count, unsigned char *buffer, float normfact)
{ while (--count >= 0)
- { if (ptr [count] >= 0)
- buffer [count] = ulaw_encode [lrintf (normfact * ptr [count])] ;
- else
- buffer [count] = 0x7F & ulaw_encode [- lrintf (normfact * ptr [count])] ;
+ { int idx;
+ if (isnan (ptr [count])) {
+ buffer [count] = ulaw_encode [0];
+ } else if (ptr [count] >= 0) {
+ idx = lrint (normfact * ptr [count]);
+ if (idx > 8192)
+ idx = 8192;
+ buffer [count] = ulaw_encode [idx] ;
+ } else {
+ idx = -lrint (normfact * ptr [count]) ;
+ if (idx > 8192)
+ idx = 8192;
+ buffer [count] = 0x7F & ulaw_encode [idx] ;
+ }
} ;
} /* f2ulaw_array */
static inline void
d2ulaw_array (const double *ptr, int count, unsigned char *buffer, double normfact)
{ while (--count >= 0)
- { if (ptr [count] >= 0)
- buffer [count] = ulaw_encode [lrint (normfact * ptr [count])] ;
- else
- buffer [count] = 0x7F & ulaw_encode [- lrint (normfact * ptr [count])] ;
+ { int idx;
+ if (isnan (ptr [count])) {
+ buffer [count] = ulaw_encode [0];
+ } else if (ptr [count] >= 0) {
+ idx = lrint (normfact * ptr [count]);
+ if (idx > 8192)
+ idx = 8192;
+ buffer [count] = ulaw_encode [idx] ;
+ } else {
+ idx = -lrint (normfact * ptr [count]) ;
+ if (idx > 8192)
+ idx = 8192;
+ buffer [count] = 0x7F & ulaw_encode [idx] ;
+ }
} ;
} /* d2ulaw_array */