void-packages/srcpkgs/libsndfile/patches/CVE-2017-8363.patch

68 lines
2.2 KiB
Diff

commit cd7da8dbf6ee4310d21d9e44b385d6797160d9e8
Author: Erik de Castro Lopo <erikd@mega-nerd.com>
Date: Wed Apr 12 20:19:34 2017 +1000
src/flac.c: Fix another memory leak
When the FLAC decoder was passed a malformed file, the associated
`FLAC__StreamDecoder` object was not getting released.
Closes: https://github.com/erikd/libsndfile/issues/233
diff --git src/flac.c src/flac.c
index 986a7b8f..5a4f8c21 100644
--- src/flac.c
+++ src/flac.c
@@ -841,7 +841,9 @@ flac_read_header (SF_PRIVATE *psf)
psf_log_printf (psf, "End\n") ;
- if (psf->error == 0)
+ if (psf->error != 0)
+ FLAC__stream_decoder_delete (pflac->fsd) ;
+ else
{ FLAC__uint64 position ;
FLAC__stream_decoder_get_decode_position (pflac->fsd, &position) ;
commit 5206a9b65e61598fde44d276c81b0585bc428562
Author: Erik de Castro Lopo <erikd@mega-nerd.com>
Date: Wed Apr 12 19:10:40 2017 +1000
src/flac.c: Fix a memory leak
The pflac->rbuffer pointer array was being allocated in two
places, but only one of them (the one that was kept) was checking
to ensure the pointers were NULL before allocation.
Leak was found by fuzzing the sndfile-resample binary compiled
with ASAN.
diff --git src/flac.c src/flac.c
index 40629c7d..84de0e26 100644
--- src/flac.c
+++ src/flac.c
@@ -430,8 +430,7 @@ sf_flac_meta_get_vorbiscomments (SF_PRIVATE *psf, const FLAC__StreamMetadata *me
static void
sf_flac_meta_callback (const FLAC__StreamDecoder * UNUSED (decoder), const FLAC__StreamMetadata *metadata, void *client_data)
{ SF_PRIVATE *psf = (SF_PRIVATE*) client_data ;
- FLAC_PRIVATE* pflac = (FLAC_PRIVATE*) psf->codec_data ;
- int bitwidth = 0, i ;
+ int bitwidth = 0 ;
switch (metadata->type)
{ case FLAC__METADATA_TYPE_STREAMINFO :
@@ -468,12 +467,6 @@ sf_flac_meta_callback (const FLAC__StreamDecoder * UNUSED (decoder), const FLAC_
if (bitwidth > 0)
psf_log_printf (psf, " Bit width : %d\n", bitwidth) ;
-
-
- for (i = 0 ; i < psf->sf.channels ; i++)
- pflac->rbuffer [i] = calloc (FLAC__MAX_BLOCK_SIZE, sizeof (int32_t)) ;
-
- pflac->wbuffer = (const int32_t* const*) pflac->rbuffer ;
break ;
case FLAC__METADATA_TYPE_VORBIS_COMMENT :