components/libsndfile/patches/fix-buffer-problems.patch
author Rich Burridge <rich.burridge@oracle.com>
Tue, 02 May 2017 17:26:42 -0700
changeset 7963 18067c41cdb2
permissions -rw-r--r--
25980101 problem in LIBRARY/LIBSNDFILE
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
7963
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
     1
Fix four overflow/invalid memory access issues.
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
     2
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
     3
* CVE-2017-8361
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
     4
  global buffer overflow in flac_buffer_copy
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
     5
  https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-flac_buffer_copy-flac-c/
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
     6
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
     7
* CVE-2017-8362
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
     8
  invalid memory read in flac_buffer_copy
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
     9
  https://blogs.gentoo.org/ago/2017/04/29/libsndfile-invalid-memory-read-in-flac_buffer_copy-flac-c/
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    10
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    11
* CVE-2017-8363
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    12
  heap-based buffer overflow in flac_buffer_copy
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    13
  https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    14
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    15
* CVE-2017-8365
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    16
  global buffer overflow in i2les_array (pcm_c)
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    17
  https://blogs.gentoo.org/ago/2017/04/29/libsndfile-global-buffer-overflow-in-i2les_array-pcm-c/
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    18
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    19
Upstream commits at:
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    20
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    21
  https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    22
  https://github.com/erikd/libsndfile/commit/ef1dbb2df1c0e741486646de40bd638a9c4cd808
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    23
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    24
--- libsndfile-1.0.28/src/common.h.orig	2017-05-02 09:34:22.327230292 +0000
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    25
+++ libsndfile-1.0.28/src/common.h	2017-05-02 09:38:07.414347779 +0000
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    26
@@ -725,6 +725,7 @@
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    27
 	SFE_FLAC_INIT_DECODER,
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    28
 	SFE_FLAC_LOST_SYNC,
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    29
 	SFE_FLAC_BAD_SAMPLE_RATE,
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    30
+	SFE_FLAC_CHANNEL_COUNT_CHANGED,
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    31
 	SFE_FLAC_UNKOWN_ERROR,
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    32
 
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    33
 	SFE_WVE_NOT_WVE,
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    34
--- libsndfile-1.0.28/src/flac.c.orig	2017-05-02 09:34:40.424371952 +0000
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    35
+++ libsndfile-1.0.28/src/flac.c	2017-05-02 09:43:43.952685131 +0000
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    36
@@ -169,6 +169,14 @@
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    37
 	const int32_t* const *buffer = pflac->wbuffer ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    38
 	unsigned i = 0, j, offset, channels, len ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    39
 
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    40
+	if (psf->sf.channels != (int) frame->header.channels)
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    41
+	{	psf_log_printf (psf, "Error: FLAC frame changed from %d to %d channels\n"
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    42
+					"Nothing to do but to error out.\n" ,
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    43
+					psf->sf.channels, frame->header.channels) ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    44
+		psf->error = SFE_FLAC_CHANNEL_COUNT_CHANGED ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    45
+		return 0 ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    46
+		} ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    47
+
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    48
 	/*
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    49
 	**	frame->header.blocksize is variable and we're using a constant blocksize
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    50
 	**	of FLAC__MAX_BLOCK_SIZE.
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    51
@@ -202,7 +210,6 @@
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    52
 		return 0 ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    53
 		} ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    54
 
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    55
-
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    56
 	len = SF_MIN (pflac->len, frame->header.blocksize) ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    57
 
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    58
 	if (pflac->remain % channels != 0)
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    59
@@ -435,6 +442,19 @@
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    60
 
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    61
 	switch (metadata->type)
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    62
 	{	case FLAC__METADATA_TYPE_STREAMINFO :
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    63
+			if (psf->sf.channels > 0 && psf->sf.channels != (int) metadata->data.stream_info.channels)
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    64
+			{	psf_log_printf (psf, "Error: FLAC stream changed from %d to %d channels\n"
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    65
+							"Nothing to do but to error out.\n" ,
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    66
+							psf->sf.channels, metadata->data.stream_info.channels) ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    67
+				psf->error = SFE_FLAC_CHANNEL_COUNT_CHANGED ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    68
+				return ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    69
+				} ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    70
+
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    71
+			if (psf->sf.channels > 0 && psf->sf.samplerate != (int) metadata->data.stream_info.sample_rate)
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    72
+			{	psf_log_printf (psf, "Warning: FLAC stream changed sample rates from %d to %d.\n"
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    73
+							"Carrying on as if nothing happened.",
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    74
+							psf->sf.samplerate, metadata->data.stream_info.sample_rate) ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    75
+				} ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    76
 			psf->sf.channels = metadata->data.stream_info.channels ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    77
 			psf->sf.samplerate = metadata->data.stream_info.sample_rate ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    78
 			psf->sf.frames = metadata->data.stream_info.total_samples ;
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    79
--- libsndfile-1.0.28/src/sndfile.c.orig	2017-05-02 09:35:02.297609256 +0000
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    80
+++ libsndfile-1.0.28/src/sndfile.c	2017-05-02 09:41:54.139468824 +0000
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    81
@@ -245,6 +245,7 @@
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    82
 	{	SFE_FLAC_INIT_DECODER	, "Error : problem with initialization of the flac decoder." },
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    83
 	{	SFE_FLAC_LOST_SYNC		, "Error : flac decoder lost sync." },
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    84
 	{	SFE_FLAC_BAD_SAMPLE_RATE, "Error : flac does not support this sample rate." },
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    85
+	{	SFE_FLAC_CHANNEL_COUNT_CHANGED, "Error : flac channel changed mid stream." },
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    86
 	{	SFE_FLAC_UNKOWN_ERROR	, "Error : unknown error in flac decoder." },
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    87
 
18067c41cdb2 25980101 problem in LIBRARY/LIBSNDFILE
Rich Burridge <rich.burridge@oracle.com>
parents:
diff changeset
    88
 	{	SFE_WVE_NOT_WVE			, "Error : not a WVE file." },