CaROS/meta-openembedded
3
1
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-01-01 13:58:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

audiofile: patch CVE-2017-6831

Browse Source 
Use patch from buildroot:
bd5f84d301

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9d668989b1)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Peter Marko 2024-12-27 11:56:14 +01:00 committed by Armin Kuster
parent 85c8b0ab7a
commit 2bdeebd11f
2 changed files with 47 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb
View File

@ -16,6 +16,7 @@ SRC_URI = " \
file://0004-Always-check-the-number-of-coefficients.patch \
file://0005-clamp-index-values-to-fix-index-overflow-in-IMA.cpp.patch \
file://0006-Check-for-multiplication-overflow-in-sfconvert.patch \
file://0007-Actually-fail-when-error-occurs-in-parseFormat.patch \
"
SRC_URI[md5sum] = "235dde14742317328f0109e9866a8008"
SRC_URI[sha256sum] = "ea2449ad3f201ec590d811db9da6d02ffc5e87a677d06b92ab15363d8cb59782"

46
meta-oe/recipes-multimedia/audiofile/files/0007-Actually-fail-when-error-occurs-in-parseFormat.patch Normal file
View File

@ -0,0 +1,46 @@
From a2e9eab8ea87c4ffc494d839ebb4ea145eb9f2e6 Mon Sep 17 00:00:00 2001
From: Antonio Larrosa <larrosa@kde.org>
Date: Mon, 6 Mar 2017 18:59:26 +0100
Subject: [PATCH] Actually fail when error occurs in parseFormat
When there's an unsupported number of bits per sample or an invalid
number of samples per block, don't only print an error message using
the error handler, but actually stop parsing the file.
This fixes #35 (also reported at
https://bugzilla.opensuse.org/show_bug.cgi?id=1026983 and
https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-imadecodeblockwave-ima-cpp/
)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
CVE: CVE-2017-6831
Upstream-Status: Inactive-Upstream [lastrelease: 2013]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
libaudiofile/WAVE.cpp | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libaudiofile/WAVE.cpp b/libaudiofile/WAVE.cpp
index 0e81cf7..d762249 100644
--- a/libaudiofile/WAVE.cpp
+++ b/libaudiofile/WAVE.cpp
@@ -326,6 +326,7 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
{
_af_error(AF_BAD_NOT_IMPLEMENTED,
"IMA ADPCM compression supports only 4 bits per sample");
+ return AF_FAIL;
}
int bytesPerBlock = (samplesPerBlock + 14) / 8 * 4 * channelCount;
@@ -333,6 +334,7 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
{
_af_error(AF_BAD_CODEC_CONFIG,
"Invalid samples per block for IMA ADPCM compression");
+ return AF_FAIL;
}
track->f.sampleWidth = 16;
--
2.11.0