From a3b5e5acd774ce8d48d647e5a35f2ce2c7e505c7 Mon Sep 17 00:00:00 2001 From: David P Date: Sun, 22 May 2022 16:50:38 -0400 Subject: deprecate sdl Signed-off-by: David P --- ...77-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch | 57 ---------------------- 1 file changed, 57 deletions(-) delete mode 100644 libre/sdl/SDL-1.2.15-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch (limited to 'libre/sdl/SDL-1.2.15-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch') diff --git a/libre/sdl/SDL-1.2.15-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch b/libre/sdl/SDL-1.2.15-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch deleted file mode 100644 index 06b429cb6..000000000 --- a/libre/sdl/SDL-1.2.15-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 69cd6157644cb0a5c9edd7b5920232c2ca31c151 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= -Date: Tue, 12 Mar 2019 16:21:41 +0100 -Subject: [PATCH] CVE-2019-7577: Fix a buffer overread in MS_ADPCM_nibble and - MS_ADPCM_decode -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -If a chunk of RIFF/WAV file with MS ADPCM encoding contains an invalid -predictor (a valid predictor's value is between 0 and 6 inclusive), -a buffer overread can happen when the predictor is used as an index -into an array of MS ADPCM coefficients. - -The overead happens when indexing MS_ADPCM_state.aCoeff[] array in -MS_ADPCM_decode() and later when dereferencing a coef pointer in -MS_ADPCM_nibble(). - -This patch fixes it by checking the MS ADPCM predictor values fit -into the valid range. - -CVE-2019-7577 -Reproducer: https://bugzilla.libsdl.org/show_bug.cgi?id=4492 - -Signed-off-by: Petr Písař ---- - src/audio/SDL_wave.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c -index 08f65cb..5f93651 100644 ---- a/src/audio/SDL_wave.c -+++ b/src/audio/SDL_wave.c -@@ -155,6 +155,9 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len) - if ( stereo ) { - state[1]->hPredictor = *encoded++; - } -+ if (state[0]->hPredictor >= 7 || state[1]->hPredictor >= 7) { -+ goto invalid_predictor; -+ } - state[0]->iDelta = ((encoded[1]<<8)|encoded[0]); - encoded += sizeof(Sint16); - if ( stereo ) { -@@ -227,6 +230,10 @@ invalid_size: - SDL_SetError("Unexpected chunk length for a MS ADPCM decoder"); - SDL_free(freeable); - return(-1); -+invalid_predictor: -+ SDL_SetError("Invalid predictor value for a MS ADPCM decoder"); -+ SDL_free(freeable); -+ return(-1); - } - - struct IMA_ADPCM_decodestate { --- -2.20.1 - -- cgit v1.2.3