summaryrefslogtreecommitdiff
path: root/user/vorbis-tools/vorbis-tools-cve9638-cve9639.patch
diff options
context:
space:
mode:
authorNathan <ndowens@artixlinux.org>2020-10-21 23:52:14 +0000
committerNathan <ndowens@artixlinux.org>2020-10-24 20:24:10 +0000
commit25ce85c1d3f2f59f72b7de44700404864b2e56a5 (patch)
tree3c7e9254a1bddfeed699b580a3a1116cefa6bcac /user/vorbis-tools/vorbis-tools-cve9638-cve9639.patch
parent2b0e79727fefc4f22e1ea43f3c8c6981b17c8926 (diff)
downloadpackages-25ce85c1d3f2f59f72b7de44700404864b2e56a5.tar.gz
packages-25ce85c1d3f2f59f72b7de44700404864b2e56a5.tar.bz2
packages-25ce85c1d3f2f59f72b7de44700404864b2e56a5.tar.xz
packages-25ce85c1d3f2f59f72b7de44700404864b2e56a5.zip
user/vorbis-tools: Add
Diffstat (limited to 'user/vorbis-tools/vorbis-tools-cve9638-cve9639.patch')
-rw-r--r--user/vorbis-tools/vorbis-tools-cve9638-cve9639.patch77
1 files changed, 77 insertions, 0 deletions
diff --git a/user/vorbis-tools/vorbis-tools-cve9638-cve9639.patch b/user/vorbis-tools/vorbis-tools-cve9638-cve9639.patch
new file mode 100644
index 000000000..80238b741
--- /dev/null
+++ b/user/vorbis-tools/vorbis-tools-cve9638-cve9639.patch
@@ -0,0 +1,77 @@
+... in order to prevent a division by zero (CVE-2014-9638) and integer
+overflow (CVE-2014-9639).
+
+Bug: https://trac.xiph.org/ticket/2136
+Bug: https://trac.xiph.org/ticket/2137
+---
+ oggenc/audio.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/oggenc/audio.c b/oggenc/audio.c
+index 477da8c..1167f1b 100644
+--- a/oggenc/audio.c
++++ b/oggenc/audio.c
+@@ -13,6 +13,7 @@
+ #include <config.h>
+ #endif
+
++#include <limits.h>
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <string.h>
+@@ -251,6 +252,7 @@ int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen)
+ aiff_fmt format;
+ aifffile *aiff = malloc(sizeof(aifffile));
+ int i;
++ long channels;
+
+ if(buf[11]=='C')
+ aifc=1;
+@@ -277,11 +279,17 @@ int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen)
+ return 0;
+ }
+
+- format.channels = READ_U16_BE(buffer);
++ format.channels = channels = READ_U16_BE(buffer);
+ format.totalframes = READ_U32_BE(buffer+2);
+ format.samplesize = READ_U16_BE(buffer+6);
+ format.rate = (int)read_IEEE80(buffer+8);
+
++ if(channels <= 0L || SHRT_MAX < channels)
++ {
++ fprintf(stderr, _("Warning: Unsupported count of channels in AIFF header\n"));
++ return 0;
++ }
++
+ aiff->bigendian = 1;
+
+ if(aifc)
+@@ -416,6 +424,7 @@ int wav_open(FILE *in, oe_enc_opt *opt, unsigned char *oldbuf, int buflen)
+ wav_fmt format;
+ wavfile *wav = malloc(sizeof(wavfile));
+ int i;
++ long channels;
+
+ /* Ok. At this point, we know we have a WAV file. Now we have to detect
+ * whether we support the subtype, and we have to find the actual data
+@@ -453,12 +462,18 @@ int wav_open(FILE *in, oe_enc_opt *opt, unsigned char *oldbuf, int buflen)
+ }
+
+ format.format = READ_U16_LE(buf);
+- format.channels = READ_U16_LE(buf+2);
++ format.channels = channels = READ_U16_LE(buf+2);
+ format.samplerate = READ_U32_LE(buf+4);
+ format.bytespersec = READ_U32_LE(buf+8);
+ format.align = READ_U16_LE(buf+12);
+ format.samplesize = READ_U16_LE(buf+14);
+
++ if(channels <= 0L || SHRT_MAX < channels)
++ {
++ fprintf(stderr, _("Warning: Unsupported count of channels in WAV header\n"));
++ return 0;
++ }
++
+ if(format.format == -2) /* WAVE_FORMAT_EXTENSIBLE */
+ {
+ if(len<40)
+--