Compare commits
No commits in common. 'i10c-beta' and 'c9' have entirely different histories.
@ -1 +1 @@
|
|||||||
a8c36ac8c6e2df8611aab9590bb9e6bdf646c0e1 SOURCES/flac-1.4.3.tar.xz
|
6ac2e8f1dd18c9b0214c4d81bd70cdc1e943cffe SOURCES/flac-1.3.3.tar.xz
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
SOURCES/flac-1.4.3.tar.xz
|
SOURCES/flac-1.3.3.tar.xz
|
||||||
|
|||||||
@ -0,0 +1,23 @@
|
|||||||
|
commit 2e7931c27eb15e387da440a37f12437e35b22dd4
|
||||||
|
Author: Erik de Castro Lopo <erikd@mega-nerd.com>
|
||||||
|
Date: Mon Oct 7 12:55:58 2019 +1100
|
||||||
|
|
||||||
|
libFLAC/bitreader.c: Fix out-of-bounds read
|
||||||
|
|
||||||
|
Credit: Oss-Fuzz
|
||||||
|
Issue: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17069
|
||||||
|
Testcase: fuzzer_decoder-5670265022840832
|
||||||
|
|
||||||
|
diff --git a/src/libFLAC/bitreader.c b/src/libFLAC/bitreader.c
|
||||||
|
index 5e4b5918..3df4d02c 100644
|
||||||
|
--- a/src/libFLAC/bitreader.c
|
||||||
|
+++ b/src/libFLAC/bitreader.c
|
||||||
|
@@ -869,7 +869,7 @@ incomplete_lsbs:
|
||||||
|
cwords = br->consumed_words;
|
||||||
|
words = br->words;
|
||||||
|
ucbits = FLAC__BITS_PER_WORD - br->consumed_bits;
|
||||||
|
- b = br->buffer[cwords] << br->consumed_bits;
|
||||||
|
+ b = cwords < br->capacity ? br->buffer[cwords] << br->consumed_bits : 0;
|
||||||
|
} while(cwords >= words && val < end);
|
||||||
|
}
|
||||||
|
|
||||||
@ -0,0 +1,182 @@
|
|||||||
|
commit 21fe95ee828b0b9b944f6aa0bb02d24fbb981815
|
||||||
|
Author: Martijn van Beurden <mvanb1@gmail.com>
|
||||||
|
Date: Wed Aug 3 13:52:19 2022 +0200
|
||||||
|
|
||||||
|
Add and use _nofree variants of safe_realloc functions
|
||||||
|
|
||||||
|
Parts of the code use realloc like
|
||||||
|
|
||||||
|
x = safe_realloc(x, somesize);
|
||||||
|
|
||||||
|
when this is the case, the safe_realloc variant used must free the
|
||||||
|
old memory block in case it fails, otherwise it will leak. However,
|
||||||
|
there are also instances in the code where handling is different:
|
||||||
|
|
||||||
|
if (0 == (x = safe_realloc(y, somesize)))
|
||||||
|
return false
|
||||||
|
|
||||||
|
in this case, y should not be freed, as y is not set to NULL we
|
||||||
|
could encounter double frees. Here the safe_realloc_nofree
|
||||||
|
functions are used.
|
||||||
|
|
||||||
|
diff --git a/include/share/alloc.h b/include/share/alloc.h
|
||||||
|
index 9b53b010..74f444d6 100644
|
||||||
|
--- a/include/share/alloc.h
|
||||||
|
+++ b/include/share/alloc.h
|
||||||
|
@@ -161,17 +161,30 @@ static inline void *safe_realloc_(void *ptr, size_t size)
|
||||||
|
free(oldptr);
|
||||||
|
return newptr;
|
||||||
|
}
|
||||||
|
-static inline void *safe_realloc_add_2op_(void *ptr, size_t size1, size_t size2)
|
||||||
|
+static inline void *safe_realloc_nofree_add_2op_(void *ptr, size_t size1, size_t size2)
|
||||||
|
+{
|
||||||
|
+ size2 += size1;
|
||||||
|
+ if(size2 < size1)
|
||||||
|
+ return 0;
|
||||||
|
+ return realloc(ptr, size2);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static inline void *safe_realloc_add_3op_(void *ptr, size_t size1, size_t size2, size_t size3)
|
||||||
|
{
|
||||||
|
size2 += size1;
|
||||||
|
if(size2 < size1) {
|
||||||
|
free(ptr);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
- return realloc(ptr, size2);
|
||||||
|
+ size3 += size2;
|
||||||
|
+ if(size3 < size2) {
|
||||||
|
+ free(ptr);
|
||||||
|
+ return 0;
|
||||||
|
+ }
|
||||||
|
+ return safe_realloc_(ptr, size3);
|
||||||
|
}
|
||||||
|
|
||||||
|
-static inline void *safe_realloc_add_3op_(void *ptr, size_t size1, size_t size2, size_t size3)
|
||||||
|
+static inline void *safe_realloc_nofree_add_3op_(void *ptr, size_t size1, size_t size2, size_t size3)
|
||||||
|
{
|
||||||
|
size2 += size1;
|
||||||
|
if(size2 < size1)
|
||||||
|
@@ -182,7 +195,7 @@ static inline void *safe_realloc_add_3op_(void *ptr, size_t size1, size_t size2,
|
||||||
|
return realloc(ptr, size3);
|
||||||
|
}
|
||||||
|
|
||||||
|
-static inline void *safe_realloc_add_4op_(void *ptr, size_t size1, size_t size2, size_t size3, size_t size4)
|
||||||
|
+static inline void *safe_realloc_nofree_add_4op_(void *ptr, size_t size1, size_t size2, size_t size3, size_t size4)
|
||||||
|
{
|
||||||
|
size2 += size1;
|
||||||
|
if(size2 < size1)
|
||||||
|
@@ -207,6 +220,15 @@ static inline void *safe_realloc_mul_2op_(void *ptr, size_t size1, size_t size2)
|
||||||
|
return safe_realloc_(ptr, size1*size2);
|
||||||
|
}
|
||||||
|
|
||||||
|
+static inline void *safe_realloc_nofree_mul_2op_(void *ptr, size_t size1, size_t size2)
|
||||||
|
+{
|
||||||
|
+ if(!size1 || !size2)
|
||||||
|
+ return realloc(ptr, 0); /* preserve POSIX realloc(ptr, 0) semantics */
|
||||||
|
+ if(size1 > SIZE_MAX / size2)
|
||||||
|
+ return 0;
|
||||||
|
+ return realloc(ptr, size1*size2);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/* size1 * (size2 + size3) */
|
||||||
|
static inline void *safe_realloc_muladd2_(void *ptr, size_t size1, size_t size2, size_t size3)
|
||||||
|
{
|
||||||
|
@@ -220,4 +242,15 @@ static inline void *safe_realloc_muladd2_(void *ptr, size_t size1, size_t size2,
|
||||||
|
return safe_realloc_mul_2op_(ptr, size1, size2);
|
||||||
|
}
|
||||||
|
|
||||||
|
+/* size1 * (size2 + size3) */
|
||||||
|
+static inline void *safe_realloc_nofree_muladd2_(void *ptr, size_t size1, size_t size2, size_t size3)
|
||||||
|
+{
|
||||||
|
+ if(!size1 || (!size2 && !size3))
|
||||||
|
+ return realloc(ptr, 0); /* preserve POSIX realloc(ptr, 0) semantics */
|
||||||
|
+ size2 += size3;
|
||||||
|
+ if(size2 < size3)
|
||||||
|
+ return 0;
|
||||||
|
+ return safe_realloc_nofree_mul_2op_(ptr, size1, size2);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
#endif
|
||||||
|
diff --git a/src/flac/encode.c b/src/flac/encode.c
|
||||||
|
index a7d1f7b2..b82ced76 100644
|
||||||
|
--- a/src/flac/encode.c
|
||||||
|
+++ b/src/flac/encode.c
|
||||||
|
@@ -1734,10 +1734,10 @@ static void static_metadata_clear(static_metadata_t *m)
|
||||||
|
static FLAC__bool static_metadata_append(static_metadata_t *m, FLAC__StreamMetadata *d, FLAC__bool needs_delete)
|
||||||
|
{
|
||||||
|
void *x;
|
||||||
|
- if(0 == (x = safe_realloc_muladd2_(m->metadata, sizeof(*m->metadata), /*times (*/m->num_metadata, /*+*/1/*)*/)))
|
||||||
|
+ if(0 == (x = safe_realloc_nofree_muladd2_(m->metadata, sizeof(*m->metadata), /*times (*/m->num_metadata, /*+*/1/*)*/)))
|
||||||
|
return false;
|
||||||
|
m->metadata = (FLAC__StreamMetadata**)x;
|
||||||
|
- if(0 == (x = safe_realloc_muladd2_(m->needs_delete, sizeof(*m->needs_delete), /*times (*/m->num_metadata, /*+*/1/*)*/)))
|
||||||
|
+ if(0 == (x = safe_realloc_nofree_muladd2_(m->needs_delete, sizeof(*m->needs_delete), /*times (*/m->num_metadata, /*+*/1/*)*/)))
|
||||||
|
return false;
|
||||||
|
m->needs_delete = (FLAC__bool*)x;
|
||||||
|
m->metadata[m->num_metadata] = d;
|
||||||
|
diff --git a/src/flac/foreign_metadata.c b/src/flac/foreign_metadata.c
|
||||||
|
index 9a1fb96c..c86dff42 100644
|
||||||
|
--- a/src/flac/foreign_metadata.c
|
||||||
|
+++ b/src/flac/foreign_metadata.c
|
||||||
|
@@ -74,7 +74,7 @@ static FLAC__bool copy_data_(FILE *fin, FILE *fout, size_t size, const char **er
|
||||||
|
|
||||||
|
static FLAC__bool append_block_(foreign_metadata_t *fm, FLAC__off_t offset, FLAC__uint32 size, const char **error)
|
||||||
|
{
|
||||||
|
- foreign_block_t *fb = safe_realloc_muladd2_(fm->blocks, sizeof(foreign_block_t), /*times (*/fm->num_blocks, /*+*/1/*)*/);
|
||||||
|
+ foreign_block_t *fb = safe_realloc_nofree_muladd2_(fm->blocks, sizeof(foreign_block_t), /*times (*/fm->num_blocks, /*+*/1/*)*/);
|
||||||
|
if(fb) {
|
||||||
|
fb[fm->num_blocks].offset = offset;
|
||||||
|
fb[fm->num_blocks].size = size;
|
||||||
|
diff --git a/src/libFLAC/bitwriter.c b/src/libFLAC/bitwriter.c
|
||||||
|
index 79ab8649..8865a2f4 100644
|
||||||
|
--- a/src/libFLAC/bitwriter.c
|
||||||
|
+++ b/src/libFLAC/bitwriter.c
|
||||||
|
@@ -133,7 +133,7 @@ FLAC__bool bitwriter_grow_(FLAC__BitWriter *bw, uint32_t bits_to_add)
|
||||||
|
FLAC__ASSERT(new_capacity > bw->capacity);
|
||||||
|
FLAC__ASSERT(new_capacity >= bw->words + ((bw->bits + bits_to_add + FLAC__BITS_PER_WORD - 1) / FLAC__BITS_PER_WORD));
|
||||||
|
|
||||||
|
- new_buffer = safe_realloc_mul_2op_(bw->buffer, sizeof(bwword), /*times*/new_capacity);
|
||||||
|
+ new_buffer = safe_realloc_nofree_mul_2op_(bw->buffer, sizeof(bwword), /*times*/new_capacity);
|
||||||
|
if(new_buffer == 0)
|
||||||
|
return false;
|
||||||
|
bw->buffer = new_buffer;
|
||||||
|
diff --git a/src/libFLAC/metadata_object.c b/src/libFLAC/metadata_object.c
|
||||||
|
index 7cc8ee9f..2c7da8db 100644
|
||||||
|
--- a/src/libFLAC/metadata_object.c
|
||||||
|
+++ b/src/libFLAC/metadata_object.c
|
||||||
|
@@ -98,7 +98,7 @@ static FLAC__bool free_copy_bytes_(FLAC__byte **to, const FLAC__byte *from, uint
|
||||||
|
/* realloc() failure leaves entry unchanged */
|
||||||
|
static FLAC__bool ensure_null_terminated_(FLAC__byte **entry, uint32_t length)
|
||||||
|
{
|
||||||
|
- FLAC__byte *x = safe_realloc_add_2op_(*entry, length, /*+*/1);
|
||||||
|
+ FLAC__byte *x = safe_realloc_nofree_add_2op_(*entry, length, /*+*/1);
|
||||||
|
if (x != NULL) {
|
||||||
|
x[length] = '\0';
|
||||||
|
*entry = x;
|
||||||
|
diff --git a/src/plugin_common/tags.c b/src/plugin_common/tags.c
|
||||||
|
index e9227444..ffd846b6 100644
|
||||||
|
--- a/src/plugin_common/tags.c
|
||||||
|
+++ b/src/plugin_common/tags.c
|
||||||
|
@@ -317,7 +317,7 @@ FLAC__bool FLAC_plugin__tags_add_tag_utf8(FLAC__StreamMetadata *tags, const char
|
||||||
|
const size_t value_len = strlen(value);
|
||||||
|
const size_t separator_len = strlen(separator);
|
||||||
|
FLAC__byte *new_entry;
|
||||||
|
- if(0 == (new_entry = safe_realloc_add_4op_(entry->entry, entry->length, /*+*/value_len, /*+*/separator_len, /*+*/1)))
|
||||||
|
+ if(0 == (new_entry = safe_realloc_nofree_add_4op_(entry->entry, entry->length, /*+*/value_len, /*+*/separator_len, /*+*/1)))
|
||||||
|
return false;
|
||||||
|
memcpy(new_entry+entry->length, separator, separator_len);
|
||||||
|
entry->length += separator_len;
|
||||||
|
diff --git a/src/share/utf8/iconvert.c b/src/share/utf8/iconvert.c
|
||||||
|
index 8ab53c10..876c06e8 100644
|
||||||
|
--- a/src/share/utf8/iconvert.c
|
||||||
|
+++ b/src/share/utf8/iconvert.c
|
||||||
|
@@ -149,7 +149,7 @@ int iconvert(const char *fromcode, const char *tocode,
|
||||||
|
iconv_close(cd1);
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
- newbuf = safe_realloc_add_2op_(utfbuf, (ob - utfbuf), /*+*/1);
|
||||||
|
+ newbuf = safe_realloc_nofree_add_2op_(utfbuf, (ob - utfbuf), /*+*/1);
|
||||||
|
if (!newbuf)
|
||||||
|
goto fail;
|
||||||
|
ob = (ob - utfbuf) + newbuf;
|
||||||
@ -0,0 +1,28 @@
|
|||||||
|
commit e1575e4a7c5157cbf4e4a16dbd39b74f7174c7be
|
||||||
|
Author: Neelkamal Semwal <neelkamal.semwal@ittiam.com>
|
||||||
|
Date: Fri Dec 18 22:28:36 2020 +0530
|
||||||
|
|
||||||
|
libFlac: Exit at EOS in verify mode
|
||||||
|
|
||||||
|
When verify mode is enabled, once decoder flags end of stream,
|
||||||
|
encode processing is considered complete.
|
||||||
|
|
||||||
|
CVE-2021-0561
|
||||||
|
|
||||||
|
Signed-off-by: Ralph Giles <giles@thaumas.net>
|
||||||
|
|
||||||
|
diff --git a/src/libFLAC/stream_encoder.c b/src/libFLAC/stream_encoder.c
|
||||||
|
index 4c91247f..7109802c 100644
|
||||||
|
--- a/src/libFLAC/stream_encoder.c
|
||||||
|
+++ b/src/libFLAC/stream_encoder.c
|
||||||
|
@@ -2610,7 +2610,9 @@ FLAC__bool write_bitbuffer_(FLAC__StreamEncoder *encoder, uint32_t samples, FLAC
|
||||||
|
encoder->private_->verify.needs_magic_hack = true;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
- if(!FLAC__stream_decoder_process_single(encoder->private_->verify.decoder)) {
|
||||||
|
+ if(!FLAC__stream_decoder_process_single(encoder->private_->verify.decoder)
|
||||||
|
+ || (!is_last_block
|
||||||
|
+ && (FLAC__stream_encoder_get_verify_decoder_state(encoder) == FLAC__STREAM_DECODER_END_OF_STREAM))) {
|
||||||
|
FLAC__bitwriter_release_buffer(encoder->private_->frame);
|
||||||
|
FLAC__bitwriter_clear(encoder->private_->frame);
|
||||||
|
if(encoder->protected_->state != FLAC__STREAM_ENCODER_VERIFY_MISMATCH_IN_AUDIO_DATA)
|
||||||
Loading…
Reference in new issue