FreeBSD Bugzilla – Attachment 160879 Details for
Bug 202941
audio/vorbis-tools: buffer overflow issue with invalid aiff files (CVE-2015-6749)
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Part 2 of patch
vorbis-tools-1.4.0_10,3.patch (text/plain), 4.14 KB, created by
Jason Unovitch
on 2015-09-09 21:11:55 UTC
(
hide
)
Description:
Part 2 of patch
Filename:
MIME Type:
Creator:
Jason Unovitch
Created:
2015-09-09 21:11:55 UTC
Size:
4.14 KB
patch
obsolete
>Index: Makefile >=================================================================== >--- Makefile (revision 396532) >+++ Makefile (working copy) >@@ -3,7 +3,7 @@ > > PORTNAME= vorbis-tools > PORTVERSION= 1.4.0 >-PORTREVISION= 9 >+PORTREVISION= 10 > PORTEPOCH= 3 > CATEGORIES= audio > MASTER_SITES= http://downloads.xiph.org/releases/vorbis/ >Index: files/patch-oggenc_audio.c >=================================================================== >--- files/patch-oggenc_audio.c (revision 396532) >+++ files/patch-oggenc_audio.c (working copy) >@@ -1,6 +1,14 @@ > --- oggenc/audio.c.orig 2010-03-24 08:27:14 UTC > +++ oggenc/audio.c >-@@ -245,8 +245,8 @@ static int aiff_permute_matrix[6][6] = >+@@ -13,6 +13,7 @@ >+ #include <config.h> >+ #endif >+ >++#include <limits.h> >+ #include <stdlib.h> >+ #include <stdio.h> >+ #include <string.h> >+@@ -245,12 +246,13 @@ static int aiff_permute_matrix[6][6] = > int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen) > { > int aifc; /* AIFC or AIFF? */ >@@ -11,7 +19,12 @@ > unsigned char buf2[8]; > aiff_fmt format; > aifffile *aiff = malloc(sizeof(aifffile)); >-@@ -269,9 +269,9 @@ int aiff_open(FILE *in, oe_enc_opt *opt, >+ int i; >++ long channels; >+ >+ if(buf[11]=='C') >+ aifc=1; >+@@ -269,19 +271,25 @@ int aiff_open(FILE *in, oe_enc_opt *opt, > return 0; /* Weird common chunk */ > } > >@@ -24,3 +37,48 @@ > { > fprintf(stderr, _("Warning: Unexpected EOF in reading AIFF header\n")); > return 0; >+ } >+ >+- format.channels = READ_U16_BE(buffer); >++ format.channels = channels = READ_U16_BE(buffer); >+ format.totalframes = READ_U32_BE(buffer+2); >+ format.samplesize = READ_U16_BE(buffer+6); >+ format.rate = (int)read_IEEE80(buffer+8); >+ >++ if(channels <= 0L || SHRT_MAX < channels) >++ { >++ fprintf(stderr, _("Warning: Unsupported count of channels in AIFF header\n")); >++ return 0; >++ } >++ >+ aiff->bigendian = 1; >+ >+ if(aifc) >+@@ -412,6 +420,7 @@ int wav_open(FILE *in, oe_enc_opt *opt, >+ wav_fmt format; >+ wavfile *wav = malloc(sizeof(wavfile)); >+ int i; >++ long channels; >+ >+ /* Ok. At this point, we know we have a WAV file. Now we have to detect >+ * whether we support the subtype, and we have to find the actual data >+@@ -449,12 +458,18 @@ int wav_open(FILE *in, oe_enc_opt *opt, >+ } >+ >+ format.format = READ_U16_LE(buf); >+- format.channels = READ_U16_LE(buf+2); >++ format.channels = channels = READ_U16_LE(buf+2); >+ format.samplerate = READ_U32_LE(buf+4); >+ format.bytespersec = READ_U32_LE(buf+8); >+ format.align = READ_U16_LE(buf+12); >+ format.samplesize = READ_U16_LE(buf+14); >+ >++ if(channels <= 0L || SHRT_MAX < channels) >++ { >++ fprintf(stderr, _("Warning: Unsupported count of channels in WAV header\n")); >++ return 0; >++ } >++ >+ if(format.format == -2) /* WAVE_FORMAT_EXTENSIBLE */ >+ { >+ if(len<40) >Index: files/patch-oggenc_oggenc.c >=================================================================== >--- files/patch-oggenc_oggenc.c (revision 0) >+++ files/patch-oggenc_oggenc.c (working copy) >@@ -0,0 +1,21 @@ >+--- oggenc/oggenc.c.orig 2010-03-26 07:07:07 UTC >++++ oggenc/oggenc.c >+@@ -97,6 +97,8 @@ int main(int argc, char **argv) >+ .3,-1, >+ 0,0,0.f, >+ 0, 0, 0, 0, 0}; >++ input_format raw_format = {NULL, 0, raw_open, wav_close, "raw", >++ N_("RAW file reader")}; >+ >+ int i; >+ >+@@ -239,9 +241,6 @@ int main(int argc, char **argv) >+ >+ if(opt.rawmode) >+ { >+- input_format raw_format = {NULL, 0, raw_open, wav_close, "raw", >+- N_("RAW file reader")}; >+- >+ enc_opts.rate=opt.raw_samplerate; >+ enc_opts.channels=opt.raw_channels; >+ enc_opts.samplesize=opt.raw_samplesize; > >Property changes on: files/patch-oggenc_oggenc.c >___________________________________________________________________ >Added: fbsd:nokeywords >## -0,0 +1 ## >+yes >\ No newline at end of property >Added: svn:eol-style >## -0,0 +1 ## >+native >\ No newline at end of property >Added: svn:mime-type >## -0,0 +1 ## >+text/plain >\ No newline at end of property
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 202941
:
160878
| 160879