Dirk Mueller
020ed5f8a8
- Added patches:
* CVE-2017-11332.patch: Fixed the startread function in wav.c, which allowed
remote attackers to cause a DoS (divide-by-zero) via a crafted wav file.
(CVE-2017-11332 bsc#1081140)
* CVE-2017-11358.patch: Fixed the read_samples function in hcom.c, which
allowed remote attackers to cause a DoS (invalid memory read) via a crafted
hcom file. (CVE-2017-11358 bsc#1081141)
* CVE-2017-11359.patch: Fixed the wavwritehdr function in wav.c, which
allowed remote attackers to cause a DoS (divide-by-zero) when converting a
a crafted snd file to a wav file. (CVE-2017-11359 bsc#1081142)
* CVE-2017-15370.patch: Fixed a heap-based buffer overflow in the ImaExpandS
function of ima_rw.c, which allowed remote attackers to cause a DoS during
conversion of a crafted audio file. (CVE-2017-15370 bsc#1063439)
* CVE-2017-15371.patch: Fixed an assertion abort in the function
sox_append_comment() in formats.c, which allowed remote attackers to cause
a DoS during conversion of a crafted audio file. (CVE-2017-15371
bsc#1063450)
* CVE-2017-15372.patch: Fixed a stack-based buffer overflow in the
lsx_ms_adpcm_block_expand_i function of adpcm.c, which allowed remote
attackers to cause a DoS during conversion of a crafted audio file.
(CVE-2017-15372 bsc#1063456)
* CVE-2017-15642.patch: Fixed an Use-After-Free vulnerability in
lsx_aiffstartread in aiff.c, which could be triggered by an attacker by
providing a malformed AIFF file. (CVE-2017-15642 bsc#1064576)
* CVE-2017-18189.patch: Fixed a NULL pointer dereference triggered by a
corrupt header specifying zero channels in the startread function in
xa.c, which allowed remote attackers to cause a DoS (CVE-2017-18189
bsc#1081146).
- Removed sox-doublefree.patch
OBS-URL: https://build.opensuse.org/request/show/576951
OBS-URL: https://build.opensuse.org/package/show/multimedia:apps/sox?expand=0&rev=38
26 lines
1.0 KiB
Diff
26 lines
1.0 KiB
Diff
From ef3d8be0f80cbb650e4766b545d61e10d7a24c9e Mon Sep 17 00:00:00 2001
|
|
From: Mans Rullgard <mans@mansr.com>
|
|
Date: Sun, 5 Nov 2017 16:21:23 +0000
|
|
Subject: [PATCH] wav: ima_adpcm: fix buffer overflow on corrupt input
|
|
(CVE-2017-15370)
|
|
|
|
Add the same check bad block size as was done for MS adpcm in commit
|
|
f39c574b ("More checks for invalid MS ADPCM blocks").
|
|
---
|
|
src/wav.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/wav.c b/src/wav.c
|
|
index 5202556c..3e80e692 100644
|
|
--- a/src/wav.c
|
|
+++ b/src/wav.c
|
|
@@ -127,7 +127,7 @@ static unsigned short ImaAdpcmReadBlock(sox_format_t * ft)
|
|
/* work with partial blocks. Specs say it should be null */
|
|
/* padded but I guess this is better than trailing quiet. */
|
|
samplesThisBlock = lsx_ima_samples_in((size_t)0, (size_t)ft->signal.channels, bytesRead, (size_t) 0);
|
|
- if (samplesThisBlock == 0)
|
|
+ if (samplesThisBlock == 0 || samplesThisBlock > wav->samplesPerBlock)
|
|
{
|
|
lsx_warn("Premature EOF on .wav input file");
|
|
return 0;
|