equal
deleted
inserted
replaced
|
1 # |
|
2 # Fix CVE-2014-8145[0]: |
|
3 # two heap-based buffer overflows |
|
4 # Upstream changesets 7d3f38 and f39c57. |
|
5 # http://sourceforge.net/p/sox/code/ci/7d3f38007a1eeaf5ab7669aba0d2a7e4d3def57e/ |
|
6 # http://sourceforge.net/p/sox/code/ci/f39c574bc423fd5b12bd6510264512f5d5366183/ |
|
7 # |
|
8 |
|
9 --- a/src/sphere.c |
|
10 +++ b/src/sphere.c |
|
11 @@ -47,6 +47,11 @@ |
|
12 |
|
13 /* Determine header size, and allocate a buffer large enough to hold it. */ |
|
14 sscanf(fldsval, "%lu", &header_size_ul); |
|
15 + if (header_size_ul < 16) { |
|
16 + lsx_fail_errno(ft, SOX_EHDR, "Error reading Sphere header"); |
|
17 + return (SOX_EOF); |
|
18 + } |
|
19 + |
|
20 buf = lsx_malloc(header_size = header_size_ul); |
|
21 |
|
22 /* Skip what we have read so far */ |
|
23 |
|
24 |
|
25 --- a/src/wav.c |
|
26 +++ b/src/wav.c |
|
27 @@ -166,7 +166,7 @@ |
|
28 /* work with partial blocks. Specs say it should be null */ |
|
29 /* padded but I guess this is better than trailing quiet. */ |
|
30 samplesThisBlock = lsx_ms_adpcm_samples_in((size_t)0, (size_t)ft->signal.channels, bytesRead, (size_t)0); |
|
31 - if (samplesThisBlock == 0) |
|
32 + if (samplesThisBlock == 0 || samplesThisBlock > wav->samplesPerBlock) |
|
33 { |
|
34 lsx_warn("Premature EOF on .wav input file"); |
|
35 return 0; |