diff options
Diffstat (limited to 'gnu/packages/patches/libsndfile-CVE-2014-9496.patch')
| -rw-r--r-- | gnu/packages/patches/libsndfile-CVE-2014-9496.patch | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/gnu/packages/patches/libsndfile-CVE-2014-9496.patch b/gnu/packages/patches/libsndfile-CVE-2014-9496.patch new file mode 100644 index 0000000000..87d42955fb --- /dev/null +++ b/gnu/packages/patches/libsndfile-CVE-2014-9496.patch @@ -0,0 +1,55 @@ +Copied from Fedora. + +http://pkgs.fedoraproject.org/cgit/libsndfile.git/plain/libsndfile-1.0.25-cve2014_9496.patch + +diff -up libsndfile-1.0.25/src/sd2.c.cve2014_9496 libsndfile-1.0.25/src/sd2.c +--- libsndfile-1.0.25/src/sd2.c.cve2014_9496 2011-01-19 11:10:36.000000000 +0100 ++++ libsndfile-1.0.25/src/sd2.c 2015-01-13 17:00:35.920285526 +0100 +@@ -395,6 +395,21 @@ read_marker (const unsigned char * data, + return 0x666 ; + } /* read_marker */ + ++static inline int ++read_rsrc_marker (const SD2_RSRC *prsrc, int offset) ++{ const unsigned char * data = prsrc->rsrc_data ; ++ ++ if (offset < 0 || offset + 3 >= prsrc->rsrc_len) ++ return 0 ; ++ ++ if (CPU_IS_BIG_ENDIAN) ++ return (((uint32_t) data [offset]) << 24) + (data [offset + 1] << 16) + (data [offset + 2] << 8) + data [offset + 3] ; ++ if (CPU_IS_LITTLE_ENDIAN) ++ return data [offset] + (data [offset + 1] << 8) + (data [offset + 2] << 16) + (((uint32_t) data [offset + 3]) << 24) ; ++ ++ return 0 ; ++} /* read_rsrc_marker */ ++ + static void + read_str (const unsigned char * data, int offset, char * buffer, int buffer_len) + { int k ; +@@ -496,6 +511,11 @@ sd2_parse_rsrc_fork (SF_PRIVATE *psf) + + rsrc.type_offset = rsrc.map_offset + 30 ; + ++ if (rsrc.map_offset + 28 > rsrc.rsrc_len) ++ { psf_log_printf (psf, "Bad map offset.\n") ; ++ goto parse_rsrc_fork_cleanup ; ++ } ; ++ + rsrc.type_count = read_short (rsrc.rsrc_data, rsrc.map_offset + 28) + 1 ; + if (rsrc.type_count < 1) + { psf_log_printf (psf, "Bad type count.\n") ; +@@ -512,7 +532,12 @@ sd2_parse_rsrc_fork (SF_PRIVATE *psf) + + rsrc.str_index = -1 ; + for (k = 0 ; k < rsrc.type_count ; k ++) +- { marker = read_marker (rsrc.rsrc_data, rsrc.type_offset + k * 8) ; ++ { if (rsrc.type_offset + k * 8 > rsrc.rsrc_len) ++ { psf_log_printf (psf, "Bad rsrc marker.\n") ; ++ goto parse_rsrc_fork_cleanup ; ++ } ; ++ ++ marker = read_rsrc_marker (&rsrc, rsrc.type_offset + k * 8) ; + + if (marker == STR_MARKER) + { rsrc.str_index = k ; |