66 lines
2.5 KiB
Diff
66 lines
2.5 KiB
Diff
Fix CVE-2017-12562
|
|
|
|
See:
|
|
|
|
https://nvd.nist.gov/vuln/detail/CVE-2017-12562
|
|
https://github.com/erikd/libsndfile/issues/292
|
|
|
|
for more details.
|
|
|
|
Changes come from the upstream committed fix at:
|
|
|
|
https://github.com/erikd/libsndfile/commit/cf7a8182c2642c50f1cf90dddea9ce96a8bad2e8
|
|
|
|
--- libsndfile-1.0.28/src/common.c.orig 2017-08-07 07:13:53.056875691 +0000
|
|
+++ libsndfile-1.0.28/src/common.c 2017-08-07 07:23:57.493033443 +0000
|
|
@@ -675,16 +675,16 @@
|
|
/* Write a C string (guaranteed to have a zero terminator). */
|
|
strptr = va_arg (argptr, char *) ;
|
|
size = strlen (strptr) + 1 ;
|
|
- size += (size & 1) ;
|
|
|
|
- if (psf->header.indx + (sf_count_t) size >= psf->header.len && psf_bump_header_allocation (psf, 16))
|
|
+ if (psf->header.indx + 4 + (sf_count_t) size + (sf_count_t) (size & 1) > psf->header.len && psf_bump_header_allocation (psf, 4 + size + (size & 1)))
|
|
return count ;
|
|
|
|
if (psf->rwf_endian == SF_ENDIAN_BIG)
|
|
- header_put_be_int (psf, size) ;
|
|
+ header_put_be_int (psf, size + (size & 1)) ;
|
|
else
|
|
- header_put_le_int (psf, size) ;
|
|
+ header_put_le_int (psf, size + (size & 1)) ;
|
|
memcpy (&(psf->header.ptr [psf->header.indx]), strptr, size) ;
|
|
+ size += (size & 1) ;
|
|
psf->header.indx += size ;
|
|
psf->header.ptr [psf->header.indx - 1] = 0 ;
|
|
count += 4 + size ;
|
|
@@ -697,16 +697,15 @@
|
|
*/
|
|
strptr = va_arg (argptr, char *) ;
|
|
size = strlen (strptr) ;
|
|
- if (psf->header.indx + (sf_count_t) size > psf->header.len && psf_bump_header_allocation (psf, size))
|
|
+ if (psf->header.indx + 4 + (sf_count_t) size + (sf_count_t) (size & 1) > psf->header.len && psf_bump_header_allocation (psf, 4 + size + (size & 1)))
|
|
return count ;
|
|
if (psf->rwf_endian == SF_ENDIAN_BIG)
|
|
header_put_be_int (psf, size) ;
|
|
else
|
|
header_put_le_int (psf, size) ;
|
|
- memcpy (&(psf->header.ptr [psf->header.indx]), strptr, size + 1) ;
|
|
+ memcpy (&(psf->header.ptr [psf->header.indx]), strptr, size + (size & 1)) ;
|
|
size += (size & 1) ;
|
|
psf->header.indx += size ;
|
|
- psf->header.ptr [psf->header.indx] = 0 ;
|
|
count += 4 + size ;
|
|
break ;
|
|
|
|
@@ -718,7 +717,7 @@
|
|
size = (size & 1) ? size : size + 1 ;
|
|
size = (size > 254) ? 254 : size ;
|
|
|
|
- if (psf->header.indx + (sf_count_t) size > psf->header.len && psf_bump_header_allocation (psf, size))
|
|
+ if (psf->header.indx + 1 + (sf_count_t) size > psf->header.len && psf_bump_header_allocation (psf, 1 + size))
|
|
return count ;
|
|
|
|
header_put_byte (psf, size) ;
|
|
|