audiofile: fix a lot of CVEs, enable flac, remove unused dependency
- Enable flac by adding libflac-devel to makedepends
- remove dependency gtk+-devel, wasn't used at any point (added by
error?)
- CVEs fixes:
CVE-2017-6827
CVE-2017-6828
CVE-2017-6829
CVE-2017-6830
CVE-2017-6831
CVE-2017-6832
CVE-2017-6833
CVE-2017-6834
CVE-2017-6835
CVE-2017-6836
CVE-2017-6837
CVE-2017-6838
CVE-2017-6839
This commit is contained in:
maxice8
maxice8
parent
5ce24e6bd9
commit
dee932c8f1
|
|
@ -0,0 +1,33 @@
|
|||
From: Antonio Larrosa <larrosa@kde.org>
|
||||
Date: Mon, 6 Mar 2017 18:02:31 +0100
|
||||
Subject: clamp index values to fix index overflow in IMA.cpp
|
||||
|
||||
This fixes #33
|
||||
(also reported at https://bugzilla.opensuse.org/show_bug.cgi?id=1026981
|
||||
and https://blogs.gentoo.org/ago/2017/02/20/audiofile-global-buffer-overflow-in-decodesample-ima-cpp/)
|
||||
---
|
||||
libaudiofile/modules/IMA.cpp | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/libaudiofile/modules/IMA.cpp b/libaudiofile/modules/IMA.cpp
|
||||
index 7476d44..df4aad6 100644
|
||||
--- libaudiofile/modules/IMA.cpp
|
||||
+++ libaudiofile/modules/IMA.cpp
|
||||
@@ -169,7 +169,7 @@ int IMA::decodeBlockWAVE(const uint8_t *encoded, int16_t *decoded)
|
||||
if (encoded[1] & 0x80)
|
||||
m_adpcmState[c].previousValue -= 0x10000;
|
||||
|
||||
- m_adpcmState[c].index = encoded[2];
|
||||
+ m_adpcmState[c].index = clamp(encoded[2], 0, 88);
|
||||
|
||||
*decoded++ = m_adpcmState[c].previousValue;
|
||||
|
||||
@@ -210,7 +210,7 @@ int IMA::decodeBlockQT(const uint8_t *encoded, int16_t *decoded)
|
||||
predictor -= 0x10000;
|
||||
|
||||
state.previousValue = clamp(predictor, MIN_INT16, MAX_INT16);
|
||||
- state.index = encoded[1] & 0x7f;
|
||||
+ state.index = clamp(encoded[1] & 0x7f, 0, 88);
|
||||
encoded += 2;
|
||||
|
||||
for (int n=0; n<m_framesPerPacket; n+=2)
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
From: Antonio Larrosa <larrosa@kde.org>
|
||||
Date: Mon, 6 Mar 2017 12:51:22 +0100
|
||||
Subject: Always check the number of coefficients
|
||||
|
||||
When building the library with NDEBUG, asserts are eliminated
|
||||
so it's better to always check that the number of coefficients
|
||||
is inside the array range.
|
||||
|
||||
This fixes the 00191-audiofile-indexoob issue in #41
|
||||
---
|
||||
libaudiofile/WAVE.cpp | 6 ++++++
|
||||
1 file changed, 6 insertions(+)
|
||||
|
||||
diff --git a/libaudiofile/WAVE.cpp b/libaudiofile/WAVE.cpp
|
||||
index 9dd8511..0fc48e8 100644
|
||||
--- libaudiofile/WAVE.cpp
|
||||
+++ libaudiofile/WAVE.cpp
|
||||
@@ -281,6 +281,12 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
|
||||
|
||||
/* numCoefficients should be at least 7. */
|
||||
assert(numCoefficients >= 7 && numCoefficients <= 255);
|
||||
+ if (numCoefficients < 7 || numCoefficients > 255)
|
||||
+ {
|
||||
+ _af_error(AF_BAD_HEADER,
|
||||
+ "Bad number of coefficients");
|
||||
+ return AF_FAIL;
|
||||
+ }
|
||||
|
||||
m_msadpcmNumCoefficients = numCoefficients;
|
||||
|
||||
|
|
@ -0,0 +1,116 @@
|
|||
From: Antonio Larrosa <larrosa@kde.org>
|
||||
Date: Mon, 6 Mar 2017 13:43:53 +0100
|
||||
Subject: Check for multiplication overflow in MSADPCM decodeSample
|
||||
|
||||
Check for multiplication overflow (using __builtin_mul_overflow
|
||||
if available) in MSADPCM.cpp decodeSample and return an empty
|
||||
decoded block if an error occurs.
|
||||
|
||||
This fixes the 00193-audiofile-signintoverflow-MSADPCM case of #41
|
||||
---
|
||||
libaudiofile/modules/BlockCodec.cpp | 5 ++--
|
||||
libaudiofile/modules/MSADPCM.cpp | 47 +++++++++++++++++++++++++++++++++----
|
||||
2 files changed, 46 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/libaudiofile/modules/BlockCodec.cpp b/libaudiofile/modules/BlockCodec.cpp
|
||||
index 45925e8..4731be1 100644
|
||||
--- libaudiofile/modules/BlockCodec.cpp
|
||||
+++ libaudiofile/modules/BlockCodec.cpp
|
||||
@@ -52,8 +52,9 @@ void BlockCodec::runPull()
|
||||
// Decompress into m_outChunk.
|
||||
for (int i=0; i<blocksRead; i++)
|
||||
{
|
||||
- decodeBlock(static_cast<const uint8_t *>(m_inChunk->buffer) + i * m_bytesPerPacket,
|
||||
- static_cast<int16_t *>(m_outChunk->buffer) + i * m_framesPerPacket * m_track->f.channelCount);
|
||||
+ if (decodeBlock(static_cast<const uint8_t *>(m_inChunk->buffer) + i * m_bytesPerPacket,
|
||||
+ static_cast<int16_t *>(m_outChunk->buffer) + i * m_framesPerPacket * m_track->f.channelCount)==0)
|
||||
+ break;
|
||||
|
||||
framesRead += m_framesPerPacket;
|
||||
}
|
||||
diff --git a/libaudiofile/modules/MSADPCM.cpp b/libaudiofile/modules/MSADPCM.cpp
|
||||
index 8ea3c85..ef9c38c 100644
|
||||
--- libaudiofile/modules/MSADPCM.cpp
|
||||
+++ libaudiofile/modules/MSADPCM.cpp
|
||||
@@ -101,24 +101,60 @@ static const int16_t adaptationTable[] =
|
||||
768, 614, 512, 409, 307, 230, 230, 230
|
||||
};
|
||||
|
||||
+int firstBitSet(int x)
|
||||
+{
|
||||
+ int position=0;
|
||||
+ while (x!=0)
|
||||
+ {
|
||||
+ x>>=1;
|
||||
+ ++position;
|
||||
+ }
|
||||
+ return position;
|
||||
+}
|
||||
+
|
||||
+#ifndef __has_builtin
|
||||
+#define __has_builtin(x) 0
|
||||
+#endif
|
||||
+
|
||||
+int multiplyCheckOverflow(int a, int b, int *result)
|
||||
+{
|
||||
+#if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow))
|
||||
+ return __builtin_mul_overflow(a, b, result);
|
||||
+#else
|
||||
+ if (firstBitSet(a)+firstBitSet(b)>31) // int is signed, so we can't use 32 bits
|
||||
+ return true;
|
||||
+ *result = a * b;
|
||||
+ return false;
|
||||
+#endif
|
||||
+}
|
||||
+
|
||||
+
|
||||
// Compute a linear PCM value from the given differential coded value.
|
||||
static int16_t decodeSample(ms_adpcm_state &state,
|
||||
- uint8_t code, const int16_t *coefficient)
|
||||
+ uint8_t code, const int16_t *coefficient, bool *ok=NULL)
|
||||
{
|
||||
int linearSample = (state.sample1 * coefficient[0] +
|
||||
state.sample2 * coefficient[1]) >> 8;
|
||||
+ int delta;
|
||||
|
||||
linearSample += ((code & 0x08) ? (code - 0x10) : code) * state.delta;
|
||||
|
||||
linearSample = clamp(linearSample, MIN_INT16, MAX_INT16);
|
||||
|
||||
- int delta = (state.delta * adaptationTable[code]) >> 8;
|
||||
+ if (multiplyCheckOverflow(state.delta, adaptationTable[code], &delta))
|
||||
+ {
|
||||
+ if (ok) *ok=false;
|
||||
+ _af_error(AF_BAD_COMPRESSION, "Error decoding sample");
|
||||
+ return 0;
|
||||
+ }
|
||||
+ delta >>= 8;
|
||||
if (delta < 16)
|
||||
delta = 16;
|
||||
|
||||
state.delta = delta;
|
||||
state.sample2 = state.sample1;
|
||||
state.sample1 = linearSample;
|
||||
+ if (ok) *ok=true;
|
||||
|
||||
return static_cast<int16_t>(linearSample);
|
||||
}
|
||||
@@ -212,13 +248,16 @@ int MSADPCM::decodeBlock(const uint8_t *encoded, int16_t *decoded)
|
||||
{
|
||||
uint8_t code;
|
||||
int16_t newSample;
|
||||
+ bool ok;
|
||||
|
||||
code = *encoded >> 4;
|
||||
- newSample = decodeSample(*state[0], code, coefficient[0]);
|
||||
+ newSample = decodeSample(*state[0], code, coefficient[0], &ok);
|
||||
+ if (!ok) return 0;
|
||||
*decoded++ = newSample;
|
||||
|
||||
code = *encoded & 0x0f;
|
||||
- newSample = decodeSample(*state[1], code, coefficient[1]);
|
||||
+ newSample = decodeSample(*state[1], code, coefficient[1], &ok);
|
||||
+ if (!ok) return 0;
|
||||
*decoded++ = newSample;
|
||||
|
||||
encoded++;
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
From: Antonio Larrosa <larrosa@kde.org>
|
||||
Date: Mon, 6 Mar 2017 13:54:52 +0100
|
||||
Subject: Check for multiplication overflow in sfconvert
|
||||
|
||||
Checks that a multiplication doesn't overflow when
|
||||
calculating the buffer size, and if it overflows,
|
||||
reduce the buffer size instead of failing.
|
||||
|
||||
This fixes the 00192-audiofile-signintoverflow-sfconvert case
|
||||
in #41
|
||||
---
|
||||
sfcommands/sfconvert.c | 34 ++++++++++++++++++++++++++++++++--
|
||||
1 file changed, 32 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/sfcommands/sfconvert.c b/sfcommands/sfconvert.c
|
||||
index 80a1bc4..970a3e4 100644
|
||||
--- sfcommands/sfconvert.c
|
||||
+++ sfcommands/sfconvert.c
|
||||
@@ -45,6 +45,33 @@ void printusage (void);
|
||||
void usageerror (void);
|
||||
bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid);
|
||||
|
||||
+int firstBitSet(int x)
|
||||
+{
|
||||
+ int position=0;
|
||||
+ while (x!=0)
|
||||
+ {
|
||||
+ x>>=1;
|
||||
+ ++position;
|
||||
+ }
|
||||
+ return position;
|
||||
+}
|
||||
+
|
||||
+#ifndef __has_builtin
|
||||
+#define __has_builtin(x) 0
|
||||
+#endif
|
||||
+
|
||||
+int multiplyCheckOverflow(int a, int b, int *result)
|
||||
+{
|
||||
+#if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow))
|
||||
+ return __builtin_mul_overflow(a, b, result);
|
||||
+#else
|
||||
+ if (firstBitSet(a)+firstBitSet(b)>31) // int is signed, so we can't use 32 bits
|
||||
+ return true;
|
||||
+ *result = a * b;
|
||||
+ return false;
|
||||
+#endif
|
||||
+}
|
||||
+
|
||||
int main (int argc, char **argv)
|
||||
{
|
||||
if (argc == 2)
|
||||
@@ -323,8 +350,11 @@ bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid)
|
||||
{
|
||||
int frameSize = afGetVirtualFrameSize(infile, trackid, 1);
|
||||
|
||||
- const int kBufferFrameCount = 65536;
|
||||
- void *buffer = malloc(kBufferFrameCount * frameSize);
|
||||
+ int kBufferFrameCount = 65536;
|
||||
+ int bufferSize;
|
||||
+ while (multiplyCheckOverflow(kBufferFrameCount, frameSize, &bufferSize))
|
||||
+ kBufferFrameCount /= 2;
|
||||
+ void *buffer = malloc(bufferSize);
|
||||
|
||||
AFframecount totalFrames = afGetFrameCount(infile, AF_DEFAULT_TRACK);
|
||||
AFframecount totalFramesWritten = 0;
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
From: Antonio Larrosa <larrosa@kde.org>
|
||||
Date: Mon, 6 Mar 2017 18:59:26 +0100
|
||||
Subject: Actually fail when error occurs in parseFormat
|
||||
|
||||
When there's an unsupported number of bits per sample or an invalid
|
||||
number of samples per block, don't only print an error message using
|
||||
the error handler, but actually stop parsing the file.
|
||||
|
||||
This fixes #35 (also reported at
|
||||
https://bugzilla.opensuse.org/show_bug.cgi?id=1026983 and
|
||||
https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-imadecodeblockwave-ima-cpp/
|
||||
)
|
||||
---
|
||||
libaudiofile/WAVE.cpp | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/libaudiofile/WAVE.cpp b/libaudiofile/WAVE.cpp
|
||||
index 0fc48e8..d04b796 100644
|
||||
--- libaudiofile/WAVE.cpp
|
||||
+++ libaudiofile/WAVE.cpp
|
||||
@@ -332,6 +332,7 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
|
||||
{
|
||||
_af_error(AF_BAD_NOT_IMPLEMENTED,
|
||||
"IMA ADPCM compression supports only 4 bits per sample");
|
||||
+ return AF_FAIL;
|
||||
}
|
||||
|
||||
int bytesPerBlock = (samplesPerBlock + 14) / 8 * 4 * channelCount;
|
||||
@@ -339,6 +340,7 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
|
||||
{
|
||||
_af_error(AF_BAD_CODEC_CONFIG,
|
||||
"Invalid samples per block for IMA ADPCM compression");
|
||||
+ return AF_FAIL;
|
||||
}
|
||||
|
||||
track->f.sampleWidth = 16;
|
||||
|
|
@ -1,31 +1,31 @@
|
|||
# Template file for 'audiofile'
|
||||
pkgname=audiofile
|
||||
version=0.3.6
|
||||
revision=2
|
||||
wrksrc=$pkgname-$pkgname-$version
|
||||
revision=3
|
||||
wrksrc="$pkgname-$pkgname-$version"
|
||||
build_style=gnu-configure
|
||||
hostmakedepends="automake libtool asciidoc pkg-config"
|
||||
makedepends="gtk+-devel alsa-lib-devel"
|
||||
makedepends="alsa-lib-devel libflac-devel"
|
||||
short_desc="C library for reading and writing audio files"
|
||||
maintainer="Michael Aldridge <maldridge@VoidLinux.eu>"
|
||||
license="LGPL-2.1"
|
||||
license="LGPL-2.1-or-later"
|
||||
homepage="http://audiofile.68k.org"
|
||||
disable_parallel_build=1
|
||||
distfiles="http://github.com/mpruett/audiofile/archive/audiofile-$version.tar.gz"
|
||||
distfiles="http://github.com/mpruett/audiofile/archive/audiofile-${version}.tar.gz"
|
||||
checksum=52125fee6c7454d743acdc27ebda194c6b5c7b9111426c7d5fdea0754cd366cc
|
||||
disable_parallel_build=1
|
||||
|
||||
pre_configure() {
|
||||
./autogen.sh
|
||||
autoreconf -fi
|
||||
}
|
||||
|
||||
audiofile-devel_package() {
|
||||
short_desc+=" - development files"
|
||||
depends="audiofile>=${version}_${revision}"
|
||||
pkg_install() {
|
||||
vmove usr/lib/*.so
|
||||
vmove usr/lib/*.a
|
||||
vmove usr/lib/pkgconfig/
|
||||
vmove usr/include/
|
||||
vmove usr/share/man/man3/
|
||||
vmove "usr/lib/*.so"
|
||||
vmove "usr/lib/*.a"
|
||||
vmove usr/lib/pkgconfig
|
||||
vmove usr/include
|
||||
vmove usr/share/man/man3
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue