diff options
| author | A. Wilcox <awilcox@wilcox-tech.com> | 2020-11-29 21:27:55 +0000 |
|---|---|---|
| committer | A. Wilcox <awilcox@wilcox-tech.com> | 2020-11-29 21:27:55 +0000 |
| commit | 0f63226da893aa856ac37aa0acf50b1ad4aac0e8 (patch) | |
| tree | 57e0cc7abddfc4a52c0415677fbda6d92e99b599 /user/vorbis-tools/CVE-2015-6749.patch | |
| parent | 96ac70f3dec394fee604cc6f6d49b57128452026 (diff) | |
| parent | 8961c23b4a0761e2dfc30143c0d54c1829843266 (diff) | |
| download | packages-0f63226da893aa856ac37aa0acf50b1ad4aac0e8.tar.gz packages-0f63226da893aa856ac37aa0acf50b1ad4aac0e8.tar.bz2 packages-0f63226da893aa856ac37aa0acf50b1ad4aac0e8.tar.xz packages-0f63226da893aa856ac37aa0acf50b1ad4aac0e8.zip | |
Merge branch 'sec/vorbis-tools' into 'master'
user/vorbis-tools: cleanup sec patches from upstream
See merge request adelie/packages!590
Diffstat (limited to 'user/vorbis-tools/CVE-2015-6749.patch')
| -rw-r--r-- | user/vorbis-tools/CVE-2015-6749.patch | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/user/vorbis-tools/CVE-2015-6749.patch b/user/vorbis-tools/CVE-2015-6749.patch new file mode 100644 index 000000000..b83f70cc2 --- /dev/null +++ b/user/vorbis-tools/CVE-2015-6749.patch @@ -0,0 +1,46 @@ +From c1059cd1e5c9278fe73a044d0e0792cac75f44b3 Mon Sep 17 00:00:00 2001 +From: Petter Reinholdtsen <pere@debian.org> +Date: Tue, 22 Sep 2015 14:56:58 +0200 +Subject: [PATCH] oggenc: Fix large alloca on bad AIFF input (CVE-2015-6749). + +Author: Mark Harris <mark.hsj@gmail.com> +Origin: https://trac.xiph.org/attachment/ticket/2212/0001-oggenc-Fix-large-alloca-on-bad-AIFF-input.patch +Bug-Debian: https://bugs.debian.org/797461 +Forwarded: https://trac.xiph.org/ticket/2212 +Reviewed-By: Petter Reinholdtsen <pere@hungry.com> +Last-Update: 2015-09-22 +--- + oggenc/audio.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/oggenc/audio.c b/oggenc/audio.c +index 477da8c..4921fb9 100644 +--- a/oggenc/audio.c ++++ b/oggenc/audio.c +@@ -245,8 +245,8 @@ static int aiff_permute_matrix[6][6] = + int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen) + { + int aifc; /* AIFC or AIFF? */ +- unsigned int len; +- unsigned char *buffer; ++ unsigned int len, readlen; ++ unsigned char buffer[22]; + unsigned char buf2[8]; + aiff_fmt format; + aifffile *aiff = malloc(sizeof(aifffile)); +@@ -269,9 +269,9 @@ int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen) + return 0; /* Weird common chunk */ + } + +- buffer = alloca(len); +- +- if(fread(buffer,1,len,in) < len) ++ readlen = len < sizeof(buffer) ? len : sizeof(buffer); ++ if(fread(buffer,1,readlen,in) < readlen || ++ (len > readlen && !seek_forward(in, len-readlen))) + { + fprintf(stderr, _("Warning: Unexpected EOF in reading AIFF header\n")); + return 0; +-- +GitLab + |