diff options
author | Omar Vega Ramos <ovruni@gnu.org.pe> | 2020-04-03 14:03:34 -0500 |
---|---|---|
committer | Omar Vega Ramos <ovruni@gnu.org.pe> | 2020-04-03 14:04:49 -0500 |
commit | 9fc410f3ecdc790c30599ea74cc9d74a8792115d (patch) | |
tree | 6053229bd240fa0d0612c62c84a06d59805a73ac /libre/sdl/SDL-1.2.15-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch | |
parent | 6d40c7a496a53725f05ab36599b185ac9b3780bc (diff) | |
download | abslibre-9fc410f3ecdc790c30599ea74cc9d74a8792115d.tar.gz abslibre-9fc410f3ecdc790c30599ea74cc9d74a8792115d.tar.bz2 abslibre-9fc410f3ecdc790c30599ea74cc9d74a8792115d.zip |
sdl-1.2.15-13.parabola1: rebuild
Diffstat (limited to 'libre/sdl/SDL-1.2.15-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch')
-rw-r--r-- | libre/sdl/SDL-1.2.15-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch | 57 |
1 files changed, 57 insertions, 0 deletions
diff --git a/libre/sdl/SDL-1.2.15-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch b/libre/sdl/SDL-1.2.15-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch new file mode 100644 index 000000000..06b429cb6 --- /dev/null +++ b/libre/sdl/SDL-1.2.15-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch @@ -0,0 +1,57 @@ +From 69cd6157644cb0a5c9edd7b5920232c2ca31c151 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com> +Date: Tue, 12 Mar 2019 16:21:41 +0100 +Subject: [PATCH] CVE-2019-7577: Fix a buffer overread in MS_ADPCM_nibble and + MS_ADPCM_decode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +If a chunk of RIFF/WAV file with MS ADPCM encoding contains an invalid +predictor (a valid predictor's value is between 0 and 6 inclusive), +a buffer overread can happen when the predictor is used as an index +into an array of MS ADPCM coefficients. + +The overead happens when indexing MS_ADPCM_state.aCoeff[] array in +MS_ADPCM_decode() and later when dereferencing a coef pointer in +MS_ADPCM_nibble(). + +This patch fixes it by checking the MS ADPCM predictor values fit +into the valid range. + +CVE-2019-7577 +Reproducer: https://bugzilla.libsdl.org/show_bug.cgi?id=4492 + +Signed-off-by: Petr Písař <ppisar@redhat.com> +--- + src/audio/SDL_wave.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c +index 08f65cb..5f93651 100644 +--- a/src/audio/SDL_wave.c ++++ b/src/audio/SDL_wave.c +@@ -155,6 +155,9 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len) + if ( stereo ) { + state[1]->hPredictor = *encoded++; + } ++ if (state[0]->hPredictor >= 7 || state[1]->hPredictor >= 7) { ++ goto invalid_predictor; ++ } + state[0]->iDelta = ((encoded[1]<<8)|encoded[0]); + encoded += sizeof(Sint16); + if ( stereo ) { +@@ -227,6 +230,10 @@ invalid_size: + SDL_SetError("Unexpected chunk length for a MS ADPCM decoder"); + SDL_free(freeable); + return(-1); ++invalid_predictor: ++ SDL_SetError("Invalid predictor value for a MS ADPCM decoder"); ++ SDL_free(freeable); ++ return(-1); + } + + struct IMA_ADPCM_decodestate { +-- +2.20.1 + |