From a3b5e5acd774ce8d48d647e5a35f2ce2c7e505c7 Mon Sep 17 00:00:00 2001 From: David P Date: Sun, 22 May 2022 16:50:38 -0400 Subject: deprecate sdl Signed-off-by: David P --- ...73-CVE-2019-7576-Fix-buffer-overreads-in-.patch | 83 ---------------------- 1 file changed, 83 deletions(-) delete mode 100644 libre/sdl/SDL-1.2.15-CVE-2019-7573-CVE-2019-7576-Fix-buffer-overreads-in-.patch (limited to 'libre/sdl/SDL-1.2.15-CVE-2019-7573-CVE-2019-7576-Fix-buffer-overreads-in-.patch') diff --git a/libre/sdl/SDL-1.2.15-CVE-2019-7573-CVE-2019-7576-Fix-buffer-overreads-in-.patch b/libre/sdl/SDL-1.2.15-CVE-2019-7573-CVE-2019-7576-Fix-buffer-overreads-in-.patch deleted file mode 100644 index 767a3b207..000000000 --- a/libre/sdl/SDL-1.2.15-CVE-2019-7573-CVE-2019-7576-Fix-buffer-overreads-in-.patch +++ /dev/null @@ -1,83 +0,0 @@ -From 3e2c89e516701f3586dfeadec13932f665371d2a Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= -Date: Fri, 15 Feb 2019 10:36:13 +0100 -Subject: [PATCH] CVE-2019-7573, CVE-2019-7576: Fix buffer overreads in - InitMS_ADPCM -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -If MS ADPCM format chunk was too short, InitMS_ADPCM() parsing it -could read past the end of chunk data. This patch fixes it. - -CVE-2019-7573 -https://bugzilla.libsdl.org/show_bug.cgi?id=4491 -CVE-2019-7576 -https://bugzilla.libsdl.org/show_bug.cgi?id=4490 - -Signed-off-by: Petr Písař ---- - src/audio/SDL_wave.c | 13 ++++++++++--- - 1 file changed, 10 insertions(+), 3 deletions(-) - -diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c -index 91e89e8..1d446ed 100644 ---- a/src/audio/SDL_wave.c -+++ b/src/audio/SDL_wave.c -@@ -44,12 +44,13 @@ static struct MS_ADPCM_decoder { - struct MS_ADPCM_decodestate state[2]; - } MS_ADPCM_state; - --static int InitMS_ADPCM(WaveFMT *format) -+static int InitMS_ADPCM(WaveFMT *format, int length) - { -- Uint8 *rogue_feel; -+ Uint8 *rogue_feel, *rogue_feel_end; - int i; - - /* Set the rogue pointer to the MS_ADPCM specific data */ -+ if (length < sizeof(*format)) goto too_short; - MS_ADPCM_state.wavefmt.encoding = SDL_SwapLE16(format->encoding); - MS_ADPCM_state.wavefmt.channels = SDL_SwapLE16(format->channels); - MS_ADPCM_state.wavefmt.frequency = SDL_SwapLE32(format->frequency); -@@ -58,9 +59,11 @@ static int InitMS_ADPCM(WaveFMT *format) - MS_ADPCM_state.wavefmt.bitspersample = - SDL_SwapLE16(format->bitspersample); - rogue_feel = (Uint8 *)format+sizeof(*format); -+ rogue_feel_end = (Uint8 *)format + length; - if ( sizeof(*format) == 16 ) { - rogue_feel += sizeof(Uint16); - } -+ if (rogue_feel + 4 > rogue_feel_end) goto too_short; - MS_ADPCM_state.wSamplesPerBlock = ((rogue_feel[1]<<8)|rogue_feel[0]); - rogue_feel += sizeof(Uint16); - MS_ADPCM_state.wNumCoef = ((rogue_feel[1]<<8)|rogue_feel[0]); -@@ -70,12 +73,16 @@ static int InitMS_ADPCM(WaveFMT *format) - return(-1); - } - for ( i=0; i rogue_feel_end) goto too_short; - MS_ADPCM_state.aCoeff[i][0] = ((rogue_feel[1]<<8)|rogue_feel[0]); - rogue_feel += sizeof(Uint16); - MS_ADPCM_state.aCoeff[i][1] = ((rogue_feel[1]<<8)|rogue_feel[0]); - rogue_feel += sizeof(Uint16); - } - return(0); -+too_short: -+ SDL_SetError("Unexpected length of a chunk with a MS ADPCM format"); -+ return(-1); - } - - static Sint32 MS_ADPCM_nibble(struct MS_ADPCM_decodestate *state, -@@ -485,7 +492,7 @@ SDL_AudioSpec * SDL_LoadWAV_RW (SDL_RWops *src, int freesrc, - break; - case MS_ADPCM_CODE: - /* Try to understand this */ -- if ( InitMS_ADPCM(format) < 0 ) { -+ if ( InitMS_ADPCM(format, lenread) < 0 ) { - was_error = 1; - goto done; - } --- -2.20.1 - -- cgit v1.2.3