rpms
/
audiofile
20
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge upstream pull requests #42,#43,#44 from Agostino Sarubbo to fix

Browse Source 
security issues.
epel9
Michael Schwendt 8 years ago
parent 74f0693a64
commit c604cfc957
4 changed files with 241 additions and 2 deletions
Show Stats Download Patch File Download Diff File

176
audiofile-0.3.6-pull42.patch
Unescape View File

@ -0,0 +1,176 @@
diff -Nur audiofile-0.3.6/libaudiofile/modules/BlockCodec.cpp audiofile-0.3.6-pull42/libaudiofile/modules/BlockCodec.cpp
--- audiofile-0.3.6/libaudiofile/modules/BlockCodec.cpp 2013-03-06 06:30:03.000000000 +0100
+++ audiofile-0.3.6-pull42/libaudiofile/modules/BlockCodec.cpp 2017-03-10 15:40:02.000000000 +0100
@@ -52,8 +52,9 @@
// Decompress into m_outChunk.
for (int i=0; i<blocksRead; i++)
{
- decodeBlock(static_cast<const uint8_t *>(m_inChunk->buffer) + i * m_bytesPerPacket,
- static_cast<int16_t *>(m_outChunk->buffer) + i * m_framesPerPacket * m_track->f.channelCount);
+ if (decodeBlock(static_cast<const uint8_t *>(m_inChunk->buffer) + i * m_bytesPerPacket,
+ static_cast<int16_t *>(m_outChunk->buffer) + i * m_framesPerPacket * m_track->f.channelCount)==0)
+ break;
framesRead += m_framesPerPacket;
}
diff -Nur audiofile-0.3.6/libaudiofile/modules/MSADPCM.cpp audiofile-0.3.6-pull42/libaudiofile/modules/MSADPCM.cpp
--- audiofile-0.3.6/libaudiofile/modules/MSADPCM.cpp 2013-03-06 06:30:03.000000000 +0100
+++ audiofile-0.3.6-pull42/libaudiofile/modules/MSADPCM.cpp 2017-03-10 15:40:02.000000000 +0100
@@ -101,24 +101,60 @@
768, 614, 512, 409, 307, 230, 230, 230
};
+int firstBitSet(int x)
+{
+ int position=0;
+ while (x!=0)
+ {
+ x>>=1;
+ ++position;
+ }
+ return position;
+}
+
+#ifndef __has_builtin
+#define __has_builtin(x) 0
+#endif
+
+bool multiplyCheckOverflow(int a, int b, int *result)
+{
+#if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow))
+ return __builtin_mul_overflow(a, b, result);
+#else
+ if (firstBitSet(a)+firstBitSet(b)>31) // int is signed, so we can't use 32 bits
+ return true;
+ *result = a * b;
+ return false;
+#endif
+}
+
+
// Compute a linear PCM value from the given differential coded value.
static int16_t decodeSample(ms_adpcm_state &state,
- uint8_t code, const int16_t *coefficient)
+ uint8_t code, const int16_t *coefficient, bool *ok=NULL)
{
int linearSample = (state.sample1 * coefficient[0] +
state.sample2 * coefficient[1]) >> 8;
+ int delta;
linearSample += ((code & 0x08) ? (code - 0x10) : code) * state.delta;
linearSample = clamp(linearSample, MIN_INT16, MAX_INT16);
- int delta = (state.delta * adaptationTable[code]) >> 8;
+ if (multiplyCheckOverflow(state.delta, adaptationTable[code], &delta))
+ {
+ if (ok) *ok=false;
+ _af_error(AF_BAD_COMPRESSION, "Error decoding sample");
+ return 0;
+ }
+ delta >>= 8;
if (delta < 16)
delta = 16;
state.delta = delta;
state.sample2 = state.sample1;
state.sample1 = linearSample;
+ if (ok) *ok=true;
return static_cast<int16_t>(linearSample);
}
@@ -212,13 +248,16 @@
{
uint8_t code;
int16_t newSample;
+ bool ok;
code = *encoded >> 4;
- newSample = decodeSample(*state[0], code, coefficient[0]);
+ newSample = decodeSample(*state[0], code, coefficient[0], &ok);
+ if (!ok) return 0;
*decoded++ = newSample;
code = *encoded & 0x0f;
- newSample = decodeSample(*state[1], code, coefficient[1]);
+ newSample = decodeSample(*state[1], code, coefficient[1], &ok);
+ if (!ok) return 0;
*decoded++ = newSample;
encoded++;
diff -Nur audiofile-0.3.6/libaudiofile/WAVE.cpp audiofile-0.3.6-pull42/libaudiofile/WAVE.cpp
--- audiofile-0.3.6/libaudiofile/WAVE.cpp 2013-03-06 06:30:03.000000000 +0100
+++ audiofile-0.3.6-pull42/libaudiofile/WAVE.cpp 2017-03-10 15:40:02.000000000 +0100
@@ -281,6 +281,12 @@
/* numCoefficients should be at least 7. */
assert(numCoefficients >= 7 && numCoefficients <= 255);
+ if (numCoefficients < 7 || numCoefficients > 255)
+ {
+ _af_error(AF_BAD_HEADER,
+ "Bad number of coefficients");
+ return AF_FAIL;
+ }
m_msadpcmNumCoefficients = numCoefficients;
@@ -834,6 +840,8 @@
}
TrackSetup *track = setup->getTrack();
+ if (!track)
+ return AF_NULL_FILESETUP;
if (track->f.isCompressed())
{
diff -Nur audiofile-0.3.6/sfcommands/sfconvert.c audiofile-0.3.6-pull42/sfcommands/sfconvert.c
--- audiofile-0.3.6/sfcommands/sfconvert.c 2013-03-06 06:30:03.000000000 +0100
+++ audiofile-0.3.6-pull42/sfcommands/sfconvert.c 2017-03-10 15:40:02.000000000 +0100
@@ -45,6 +45,33 @@
void usageerror (void);
bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid);
+int firstBitSet(int x)
+{
+ int position=0;
+ while (x!=0)
+ {
+ x>>=1;
+ ++position;
+ }
+ return position;
+}
+
+#ifndef __has_builtin
+#define __has_builtin(x) 0
+#endif
+
+bool multiplyCheckOverflow(int a, int b, int *result)
+{
+#if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow))
+ return __builtin_mul_overflow(a, b, result);
+#else
+ if (firstBitSet(a)+firstBitSet(b)>31) // int is signed, so we can't use 32 bits
+ return true;
+ *result = a * b;
+ return false;
+#endif
+}
+
int main (int argc, char **argv)
{
if (argc == 2)
@@ -323,8 +350,11 @@
{
int frameSize = afGetVirtualFrameSize(infile, trackid, 1);
- const int kBufferFrameCount = 65536;
- void *buffer = malloc(kBufferFrameCount * frameSize);
+ int kBufferFrameCount = 65536;
+ int bufferSize;
+ while (multiplyCheckOverflow(kBufferFrameCount, frameSize, &bufferSize))
+ kBufferFrameCount /= 2;
+ void *buffer = malloc(bufferSize);
AFframecount totalFrames = afGetFrameCount(infile, AF_DEFAULT_TRACK);
AFframecount totalFramesWritten = 0;

21
audiofile-0.3.6-pull43.patch
Unescape View File

@ -0,0 +1,21 @@
diff -Nur audiofile-0.3.6/libaudiofile/modules/IMA.cpp audiofile-0.3.6-pull43/libaudiofile/modules/IMA.cpp
--- audiofile-0.3.6/libaudiofile/modules/IMA.cpp 2013-03-06 06:30:03.000000000 +0100
+++ audiofile-0.3.6-pull43/libaudiofile/modules/IMA.cpp 2017-03-06 18:06:35.000000000 +0100
@@ -169,7 +169,7 @@
if (encoded[1] & 0x80)
m_adpcmState[c].previousValue -= 0x10000;
- m_adpcmState[c].index = encoded[2];
+ m_adpcmState[c].index = clamp(encoded[2], 0, 88);
*decoded++ = m_adpcmState[c].previousValue;
@@ -210,7 +210,7 @@
predictor -= 0x10000;
state.previousValue = clamp(predictor, MIN_INT16, MAX_INT16);
- state.index = encoded[1] & 0x7f;
+ state.index = clamp(encoded[1] & 0x7f, 0, 88);
encoded += 2;
for (int n=0; n<m_framesPerPacket; n+=2)

31
audiofile-0.3.6-pull44.patch
Unescape View File

@ -0,0 +1,31 @@
diff -Nur audiofile-0.3.6/libaudiofile/modules/BlockCodec.cpp audiofile-0.3.6-pull44/libaudiofile/modules/BlockCodec.cpp
--- audiofile-0.3.6/libaudiofile/modules/BlockCodec.cpp 2013-03-06 06:30:03.000000000 +0100
+++ audiofile-0.3.6-pull44/libaudiofile/modules/BlockCodec.cpp 2017-03-09 10:21:18.000000000 +0100
@@ -47,7 +47,7 @@
// Read the compressed data.
ssize_t bytesRead = read(m_inChunk->buffer, m_bytesPerPacket * blockCount);
- int blocksRead = bytesRead >= 0 ? bytesRead / m_bytesPerPacket : 0;
+ int blocksRead = (bytesRead >= 0 && m_bytesPerPacket > 0) ? bytesRead / m_bytesPerPacket : 0;
// Decompress into m_outChunk.
for (int i=0; i<blocksRead; i++)
diff -Nur audiofile-0.3.6/libaudiofile/WAVE.cpp audiofile-0.3.6-pull44/libaudiofile/WAVE.cpp
--- audiofile-0.3.6/libaudiofile/WAVE.cpp 2013-03-06 06:30:03.000000000 +0100
+++ audiofile-0.3.6-pull44/libaudiofile/WAVE.cpp 2017-03-09 10:21:18.000000000 +0100
@@ -326,6 +326,7 @@
{
_af_error(AF_BAD_NOT_IMPLEMENTED,
"IMA ADPCM compression supports only 4 bits per sample");
+ return AF_FAIL;
}
int bytesPerBlock = (samplesPerBlock + 14) / 8 * 4 * channelCount;
@@ -333,6 +334,7 @@
{
_af_error(AF_BAD_CODEC_CONFIG,
"Invalid samples per block for IMA ADPCM compression");
+ return AF_FAIL;
}
track->f.sampleWidth = 16;

15
audiofile.spec
Unescape View File

@ -3,7 +3,7 @@
Summary: Library for accessing various audio file formats
Name: audiofile
Version: 0.3.6
Release: 12%{?dist}
Release: 13%{?dist}
Epoch: 1
# library is LGPL / the two programs GPL / see README
License: LGPLv2+ and GPLv2+
@ -20,6 +20,11 @@ Patch0: audiofile-0.3.6-CVE-2015-7747.patch
# fixes to make build with GCC 6
Patch1: audiofile-0.3.6-left-shift-neg.patch
Patch2: audiofile-0.3.6-narrowing.patch
# pull requests #42,#43,#44
Patch3: audiofile-0.3.6-pull42.patch
Patch4: audiofile-0.3.6-pull43.patch
Patch5: audiofile-0.3.6-pull44.patch
%description
The Audio File library is an implementation of the Audio File Library
@ -44,7 +49,9 @@ other resources you can use to develop Audio File applications.
%patch0 -p1 -b .CVE-2015-7747
%patch1 -p1 -b .left-shift-neg
%patch2 -p1 -b .narrowing-conversion
%patch3 -p1 -b .pull42
%patch4 -p1 -b .pull43
%patch5 -p1 -b .pull44
%build
%configure --disable-static
@ -84,6 +91,10 @@ make check
%{_mandir}/man3/*
%changelog
* Sun Mar 12 2017 Michael Schwendt <mschwendt@fedoraproject.org> - 1:0.3.6-13
- Merge upstream pull requests #42,#43,#44 from Agostino Sarubbo to fix
security issues.
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.3.6-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

Write Preview
Loading…
Cancel
Save