1 #

     2 # Fix CVE-2014-8145[0]:

     3 #    two heap-based buffer overflows

     4 # Upstream changesets 7d3f38 and f39c57.

     5 # http://sourceforge.net/p/sox/code/ci/7d3f38007a1eeaf5ab7669aba0d2a7e4d3def57e/

     6 # http://sourceforge.net/p/sox/code/ci/f39c574bc423fd5b12bd6510264512f5d5366183/

     7 #

     8 

     9 --- a/src/sphere.c

    10 +++ b/src/sphere.c

    11 @@ -47,6 +47,11 @@

    12  

    13    /* Determine header size, and allocate a buffer large enough to hold it. */

    14    sscanf(fldsval, "%lu", &header_size_ul);

    15 +  if (header_size_ul < 16) {

    16 +    lsx_fail_errno(ft, SOX_EHDR, "Error reading Sphere header");

    17 +    return (SOX_EOF);

    18 +  }

    19 +

    20    buf = lsx_malloc(header_size = header_size_ul);

    21  

    22    /* Skip what we have read so far */

    23 

    24 

    25 --- a/src/wav.c

    26 +++ b/src/wav.c

    27 @@ -166,7 +166,7 @@

    28          /* work with partial blocks.  Specs say it should be null */

    29          /* padded but I guess this is better than trailing quiet. */

    30          samplesThisBlock = lsx_ms_adpcm_samples_in((size_t)0, (size_t)ft->signal.channels, bytesRead, (size_t)0);

    31 -        if (samplesThisBlock == 0)

    32 +        if (samplesThisBlock == 0 || samplesThisBlock > wav->samplesPerBlock)

    33          {

    34              lsx_warn("Premature EOF on .wav input file");

    35              return 0;