summaryrefslogtreecommitdiff
path: root/user/sox/CVE-2017-15372.patch
diff options
context:
space:
mode:
Diffstat (limited to 'user/sox/CVE-2017-15372.patch')
-rw-r--r--user/sox/CVE-2017-15372.patch100
1 files changed, 0 insertions, 100 deletions
diff --git a/user/sox/CVE-2017-15372.patch b/user/sox/CVE-2017-15372.patch
deleted file mode 100644
index dd7fcff5d..000000000
--- a/user/sox/CVE-2017-15372.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 515b986139183326cc40c67c75f83edc60826a9e Mon Sep 17 00:00:00 2001
-From: Mans Rullgard <mans@mansr.com>
-Date: Wed, 8 Nov 2017 00:27:46 +0000
-Subject: [PATCH] adpcm: fix stack overflow with >4 channels (CVE-2017-15372)
-
----
- src/adpcm.c | 8 +++++++-
- src/adpcm.h | 3 +++
- src/wav.c | 5 ++++-
- 3 files changed, 14 insertions(+), 2 deletions(-)
-
-diff --git a/src/adpcm.c b/src/adpcm.c
-index 2e13867e..f64b7d5c 100644
---- a/src/adpcm.c
-+++ b/src/adpcm.c
-@@ -71,6 +71,11 @@ const short lsx_ms_adpcm_i_coef[7][2] = {
- { 392,-232}
- };
-
-+extern void *lsx_ms_adpcm_alloc(unsigned chans)
-+{
-+ return lsx_malloc(chans * sizeof(MsState_t));
-+}
-+
- static inline sox_sample_t AdpcmDecode(sox_sample_t c, MsState_t *state,
- sox_sample_t sample1, sox_sample_t sample2)
- {
-@@ -102,6 +107,7 @@ static inline sox_sample_t AdpcmDecode(sox_sample_t c, MsState_t *state,
-
- /* lsx_ms_adpcm_block_expand_i() outputs interleaved samples into one output buffer */
- const char *lsx_ms_adpcm_block_expand_i(
-+ void *priv,
- unsigned chans, /* total channels */
- int nCoef,
- const short *coef,
-@@ -113,7 +119,7 @@ const char *lsx_ms_adpcm_block_expand_i(
- const unsigned char *ip;
- unsigned ch;
- const char *errmsg = NULL;
-- MsState_t state[4]; /* One decompressor state for each channel */
-+ MsState_t *state = priv; /* One decompressor state for each channel */
-
- /* Read the four-byte header for each channel */
- ip = ibuff;
-diff --git a/src/adpcm.h b/src/adpcm.h
-index af4d6f08..db5cc615 100644
---- a/src/adpcm.h
-+++ b/src/adpcm.h
-@@ -29,8 +29,11 @@
- /* default coef sets */
- extern const short lsx_ms_adpcm_i_coef[7][2];
-
-+extern void *lsx_ms_adpcm_alloc(unsigned chans);
-+
- /* lsx_ms_adpcm_block_expand_i() outputs interleaved samples into one output buffer */
- extern const char *lsx_ms_adpcm_block_expand_i(
-+ void *priv,
- unsigned chans, /* total channels */
- int nCoef,
- const short *coef,
-diff --git a/src/wav.c b/src/wav.c
-index fad334cf..066be6d7 100644
---- a/src/wav.c
-+++ b/src/wav.c
-@@ -82,6 +82,7 @@ typedef struct {
- /* following used by *ADPCM wav files */
- unsigned short nCoefs; /* ADPCM: number of coef sets */
- short *lsx_ms_adpcm_i_coefs; /* ADPCM: coef sets */
-+ void *ms_adpcm_data; /* Private data of adpcm decoder */
- unsigned char *packet; /* Temporary buffer for packets */
- short *samples; /* interleaved samples buffer */
- short *samplePtr; /* Pointer to current sample */
-@@ -175,7 +176,7 @@ static unsigned short AdpcmReadBlock(sox_format_t * ft)
- }
- }
-
-- errmsg = lsx_ms_adpcm_block_expand_i(ft->signal.channels, wav->nCoefs, wav->lsx_ms_adpcm_i_coefs, wav->packet, wav->samples, samplesThisBlock);
-+ errmsg = lsx_ms_adpcm_block_expand_i(wav->ms_adpcm_data, ft->signal.channels, wav->nCoefs, wav->lsx_ms_adpcm_i_coefs, wav->packet, wav->samples, samplesThisBlock);
-
- if (errmsg)
- lsx_warn("%s", errmsg);
-@@ -791,6 +792,7 @@ static int startread(sox_format_t * ft)
-
- /* nCoefs, lsx_ms_adpcm_i_coefs used by adpcm.c */
- wav->lsx_ms_adpcm_i_coefs = lsx_malloc(wav->nCoefs * 2 * sizeof(short));
-+ wav->ms_adpcm_data = lsx_ms_adpcm_alloc(wChannels);
- {
- int i, errct=0;
- for (i=0; len>=2 && i < 2*wav->nCoefs; i++) {
-@@ -1216,6 +1218,7 @@ static int stopread(sox_format_t * ft)
- free(wav->packet);
- free(wav->samples);
- free(wav->lsx_ms_adpcm_i_coefs);
-+ free(wav->ms_adpcm_data);
- free(wav->comment);
- wav->comment = NULL;
-
---
-2.25.0
-