From a3b5e5acd774ce8d48d647e5a35f2ce2c7e505c7 Mon Sep 17 00:00:00 2001 From: David P Date: Sun, 22 May 2022 16:50:38 -0400 Subject: deprecate sdl Signed-off-by: David P --- ...75-Fix-a-buffer-overwrite-in-MS_ADPCM_dec.patch | 84 ---------------------- 1 file changed, 84 deletions(-) delete mode 100644 libre/sdl/SDL-1.2.15-CVE-2019-7575-Fix-a-buffer-overwrite-in-MS_ADPCM_dec.patch (limited to 'libre/sdl/SDL-1.2.15-CVE-2019-7575-Fix-a-buffer-overwrite-in-MS_ADPCM_dec.patch') diff --git a/libre/sdl/SDL-1.2.15-CVE-2019-7575-Fix-a-buffer-overwrite-in-MS_ADPCM_dec.patch b/libre/sdl/SDL-1.2.15-CVE-2019-7575-Fix-a-buffer-overwrite-in-MS_ADPCM_dec.patch deleted file mode 100644 index 53965aa2f..000000000 --- a/libre/sdl/SDL-1.2.15-CVE-2019-7575-Fix-a-buffer-overwrite-in-MS_ADPCM_dec.patch +++ /dev/null @@ -1,84 +0,0 @@ -From e1f80cadb079e35103e6eebf160a818815c823df Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= -Date: Thu, 14 Feb 2019 14:51:52 +0100 -Subject: [PATCH] CVE-2019-7575: Fix a buffer overwrite in MS_ADPCM_decode -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -If a WAV format defines shorter audio stream and decoded MS ADPCM data chunk -is longer, decoding continued past the output audio buffer. - -This fix is based on a patch from -. - -https://bugzilla.libsdl.org/show_bug.cgi?id=4493 -CVE-2019-7575 - -Signed-off-by: Petr Písař ---- - src/audio/SDL_wave.c | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c -index e42d01c..b6c49de 100644 ---- a/src/audio/SDL_wave.c -+++ b/src/audio/SDL_wave.c -@@ -115,7 +115,7 @@ static Sint32 MS_ADPCM_nibble(struct MS_ADPCM_decodestate *state, - static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len) - { - struct MS_ADPCM_decodestate *state[2]; -- Uint8 *freeable, *encoded, *encoded_end, *decoded; -+ Uint8 *freeable, *encoded, *encoded_end, *decoded, *decoded_end; - Sint32 encoded_len, samplesleft; - Sint8 nybble, stereo; - Sint16 *coeff[2]; -@@ -135,6 +135,7 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len) - return(-1); - } - decoded = *audio_buf; -+ decoded_end = decoded + *audio_len; - - /* Get ready... Go! */ - stereo = (MS_ADPCM_state.wavefmt.channels == 2); -@@ -142,7 +143,7 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len) - state[1] = &MS_ADPCM_state.state[stereo]; - while ( encoded_len >= MS_ADPCM_state.wavefmt.blockalign ) { - /* Grab the initial information for this block */ -- if (encoded + 7 + (stereo ? 7 : 0) > encoded_end) goto too_short; -+ if (encoded + 7 + (stereo ? 7 : 0) > encoded_end) goto invalid_size; - state[0]->hPredictor = *encoded++; - if ( stereo ) { - state[1]->hPredictor = *encoded++; -@@ -169,6 +170,7 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len) - coeff[1] = MS_ADPCM_state.aCoeff[state[1]->hPredictor]; - - /* Store the two initial samples we start with */ -+ if (decoded + 4 + (stereo ? 4 : 0) > decoded_end) goto invalid_size; - decoded[0] = state[0]->iSamp2&0xFF; - decoded[1] = state[0]->iSamp2>>8; - decoded += 2; -@@ -190,7 +192,8 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len) - samplesleft = (MS_ADPCM_state.wSamplesPerBlock-2)* - MS_ADPCM_state.wavefmt.channels; - while ( samplesleft > 0 ) { -- if (encoded + 1 > encoded_end) goto too_short; -+ if (encoded + 1 > encoded_end) goto invalid_size; -+ if (decoded + 4 > decoded_end) goto invalid_size; - - nybble = (*encoded)>>4; - new_sample = MS_ADPCM_nibble(state[0],nybble,coeff[0]); -@@ -213,8 +216,8 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len) - } - SDL_free(freeable); - return(0); --too_short: -- SDL_SetError("Too short chunk for a MS ADPCM decoder"); -+invalid_size: -+ SDL_SetError("Unexpected chunk length for a MS ADPCM decoder"); - SDL_free(freeable); - return(-1); - } --- -2.20.1 - -- cgit v1.2.3