forked from pool/libid3tag
8395e40781
- Added libid3tag-utf16.patch: Fixed id3_utf16_deserialize() in utf16.c, which previously misparsed ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until OOM leading to DoS. (CVE-2004-2779 bsc#1081959 CVE-2017-11551 bsc#1081961) - Added libid3tag-unknown-encoding.patch: Fixed the handling of unknown encodings when parsing ID3 tags. (CVE-2017-11550 bsc#1081962 CVE-2008-2109 bsc#387731) - Removed libid3tag-0.15.1b-fix_overflow.patch, since it is handled differently by libid3tag-utf16.patch already. OBS-URL: https://build.opensuse.org/request/show/578693 OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/libid3tag?expand=0&rev=18
43 lines
1.3 KiB
Diff
43 lines
1.3 KiB
Diff
References: https://sources.debian.org/src/libid3tag/0.15.1b-13/debian/patches/11_unknown_encoding.dpatch/
|
|
From: Karol Babioch <kbabioch@suse.com>
|
|
Date: Wed Feb 21 13:23:47 CET 2018
|
|
Upstream: dead
|
|
Subject: Fix unknown encoding when parsing ID3 tags
|
|
|
|
Fixes the handling of unknown encodings when parsing ID3 tags. (CVE-2017-11550 bsc#1081962 CVE-2008-2109 bsc#387731)
|
|
|
|
---
|
|
compat.gperf | 3 +++
|
|
parse.c | 4 ++++
|
|
2 files changed, 7 insertions(+)
|
|
|
|
Index: libid3tag-0.15.1b/compat.gperf
|
|
===================================================================
|
|
--- libid3tag-0.15.1b.orig/compat.gperf
|
|
+++ libid3tag-0.15.1b/compat.gperf
|
|
@@ -241,6 +241,9 @@ int id3_compat_fixup(struct id3_tag *tag
|
|
encoding = id3_parse_uint(&data, 1);
|
|
string = id3_parse_string(&data, end - data, encoding, 0);
|
|
|
|
+ if (!string)
|
|
+ continue;
|
|
+
|
|
if (id3_ucs4_length(string) < 4) {
|
|
free(string);
|
|
continue;
|
|
Index: libid3tag-0.15.1b/parse.c
|
|
===================================================================
|
|
--- libid3tag-0.15.1b.orig/parse.c
|
|
+++ libid3tag-0.15.1b/parse.c
|
|
@@ -165,6 +165,10 @@ id3_ucs4_t *id3_parse_string(id3_byte_t
|
|
case ID3_FIELD_TEXTENCODING_UTF_8:
|
|
ucs4 = id3_utf8_deserialize(ptr, length);
|
|
break;
|
|
+
|
|
+ default:
|
|
+ /* FIXME: Unknown encoding! Print warning? */
|
|
+ return NULL;
|
|
}
|
|
|
|
if (ucs4 && !full) {
|