diff options
author | A. Wilcox <awilcox@wilcox-tech.com> | 2020-03-22 10:34:42 +0000 |
---|---|---|
committer | A. Wilcox <awilcox@wilcox-tech.com> | 2020-03-22 10:34:42 +0000 |
commit | 7a8eb9c1a4a9c2f3e3a3228266bcba74ab298c23 (patch) | |
tree | 7cb10f6bfae6c18be3f8b837840bdc060505fe65 /user/sox/CVE-2017-11358.patch | |
parent | 8e8bfad331752ef7dc605c9f7c65e8271f96ddeb (diff) | |
parent | 988d22dd710713d46c13c0b08f045aa2ce4f69d9 (diff) | |
download | packages-7a8eb9c1a4a9c2f3e3a3228266bcba74ab298c23.tar.gz packages-7a8eb9c1a4a9c2f3e3a3228266bcba74ab298c23.tar.bz2 packages-7a8eb9c1a4a9c2f3e3a3228266bcba74ab298c23.tar.xz packages-7a8eb9c1a4a9c2f3e3a3228266bcba74ab298c23.zip |
Merge branch 'cves.2020.03.16' into 'master'
CVE patches for 2020.03.16
See merge request adelie/packages!411
Diffstat (limited to 'user/sox/CVE-2017-11358.patch')
-rw-r--r-- | user/sox/CVE-2017-11358.patch | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/user/sox/CVE-2017-11358.patch b/user/sox/CVE-2017-11358.patch new file mode 100644 index 000000000..4fadeda30 --- /dev/null +++ b/user/sox/CVE-2017-11358.patch @@ -0,0 +1,44 @@ +From e410d00c4821726accfbe1f825f2def6376e181f Mon Sep 17 00:00:00 2001 +From: Mans Rullgard <mans@mansr.com> +Date: Sun, 5 Nov 2017 16:43:35 +0000 +Subject: [PATCH] hcom: fix crash on input with corrupt dictionary + (CVE-2017-11358) + +--- + src/hcom.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/src/hcom.c b/src/hcom.c +index e76820e9..be17d9d2 100644 +--- a/src/hcom.c ++++ b/src/hcom.c +@@ -73,6 +73,14 @@ typedef struct { + size_t pos; /* Where next byte goes */ + } priv_t; + ++static int dictvalid(int n, int size, int left, int right) ++{ ++ if (n > 0 && left < 0) ++ return 1; ++ ++ return (unsigned)left < size && (unsigned)right < size; ++} ++ + static int startread(sox_format_t * ft) + { + priv_t *p = (priv_t *) ft->priv; +@@ -150,6 +158,11 @@ static int startread(sox_format_t * ft) + lsx_debug("%d %d", + p->dictionary[i].dict_leftson, + p->dictionary[i].dict_rightson); ++ if (!dictvalid(i, dictsize, p->dictionary[i].dict_leftson, ++ p->dictionary[i].dict_rightson)) { ++ lsx_fail_errno(ft, SOX_EHDR, "Invalid dictionary"); ++ return SOX_EOF; ++ } + } + rc = lsx_skipbytes(ft, (size_t) 1); /* skip pad byte */ + if (rc) +-- +2.25.0 + |