gnu: vorbis-tools: Fix CVE-2014-9638, CVE-2014-9639, CVE-2014-9640.
* gnu/packages/xiph.scm (vorbis-tools)[source]: Add patches. * gnu/packages/patches/vorbis-tools-CVE-2014-9638+CVE-2014-9639.patch, gnu/packages/patches/vorbis-tools-CVE-2014-9640.patch: New variables. * gnu/local.mk (dist_patch_DATA): Add them.
This commit is contained in:
Efraim Flashner
parent
e99dd67ad8
commit
b3d20b8280
|
|
@ -766,6 +766,8 @@ dist_patch_DATA = \
|
|||
%D%/packages/patches/util-linux-tests.patch \
|
||||
%D%/packages/patches/upower-builddir.patch \
|
||||
%D%/packages/patches/valgrind-enable-arm.patch \
|
||||
%D%/packages/patches/vorbis-tools-CVE-2014-9638+CVE-2014-9639.patch \
|
||||
%D%/packages/patches/vorbis-tools-CVE-2014-9640.patch \
|
||||
%D%/packages/patches/vorbis-tools-CVE-2015-6749.patch \
|
||||
%D%/packages/patches/vpnc-script.patch \
|
||||
%D%/packages/patches/vtk-mesa-10.patch \
|
||||
|
|
|
|||
|
|
@ -0,0 +1,83 @@
|
|||
From: Petter Reinholdtsen <pere@debian.org>
|
||||
Date: Tue, 22 Sep 2015 15:14:06 +0200
|
||||
Subject: oggenc: validate count of channels in the header (CVE-2014-9638 &
|
||||
CVE-2014-9639)
|
||||
|
||||
Author: Kamil Dudka <kdudka@redhat.com>
|
||||
Origin: http://lists.xiph.org/pipermail/vorbis-dev/2015-February/020423.html
|
||||
Bug: https://trac.xiph.org/ticket/2136
|
||||
Bug: https://trac.xiph.org/ticket/2137
|
||||
Bug-Debian: https://bugs.debian.org/776086
|
||||
Forwarded: not-needed
|
||||
Reviewed-By: Petter Reinholdtsen <pere@hungry.com>
|
||||
Last-Update: 2015-09-22
|
||||
---
|
||||
oggenc/audio.c | 18 ++++++++++++++++--
|
||||
1 file changed, 16 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/oggenc/audio.c b/oggenc/audio.c
|
||||
index 05e42b3..1b3f179 100644
|
||||
--- a/oggenc/audio.c
|
||||
+++ b/oggenc/audio.c
|
||||
@@ -13,6 +13,7 @@
|
||||
#include <config.h>
|
||||
#endif
|
||||
|
||||
+#include <limits.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
@@ -251,6 +252,7 @@ int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen)
|
||||
aiff_fmt format;
|
||||
aifffile *aiff = malloc(sizeof(aifffile));
|
||||
int i;
|
||||
+ long channels;
|
||||
|
||||
if(buf[11]=='C')
|
||||
aifc=1;
|
||||
@@ -277,11 +279,16 @@ int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen)
|
||||
return 0;
|
||||
}
|
||||
|
||||
- format.channels = READ_U16_BE(buffer);
|
||||
+ format.channels = channels = READ_U16_BE(buffer);
|
||||
format.totalframes = READ_U32_BE(buffer+2);
|
||||
format.samplesize = READ_U16_BE(buffer+6);
|
||||
format.rate = (int)read_IEEE80(buffer+8);
|
||||
|
||||
+ if(channels <= 0L || SHRT_MAX < channels)
|
||||
+ {
|
||||
+ fprintf(stderr, _("Warning: Unsupported count of channels in AIFF header\n"));
|
||||
+ return 0;
|
||||
+ }
|
||||
aiff->bigendian = 1;
|
||||
|
||||
if(aifc)
|
||||
@@ -412,6 +419,7 @@ int wav_open(FILE *in, oe_enc_opt *opt, unsigned char *oldbuf, int buflen)
|
||||
wav_fmt format;
|
||||
wavfile *wav = malloc(sizeof(wavfile));
|
||||
int i;
|
||||
+ long channels;
|
||||
|
||||
/* Ok. At this point, we know we have a WAV file. Now we have to detect
|
||||
* whether we support the subtype, and we have to find the actual data
|
||||
@@ -449,12 +457,18 @@ int wav_open(FILE *in, oe_enc_opt *opt, unsigned char *oldbuf, int buflen)
|
||||
}
|
||||
|
||||
format.format = READ_U16_LE(buf);
|
||||
- format.channels = READ_U16_LE(buf+2);
|
||||
+ format.channels = channels = READ_U16_LE(buf+2);
|
||||
format.samplerate = READ_U32_LE(buf+4);
|
||||
format.bytespersec = READ_U32_LE(buf+8);
|
||||
format.align = READ_U16_LE(buf+12);
|
||||
format.samplesize = READ_U16_LE(buf+14);
|
||||
|
||||
+ if(channels <= 0L || SHRT_MAX < channels)
|
||||
+ {
|
||||
+ fprintf(stderr, _("Warning: Unsupported count of channels in WAV header\n"));
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
if(format.format == -2) /* WAVE_FORMAT_EXTENSIBLE */
|
||||
{
|
||||
if(len<40)
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
Index: vorbis-tools/oggenc/oggenc.c
|
||||
===================================================================
|
||||
--- vorbis-tools/oggenc/oggenc.c (revision 19116)
|
||||
+++ vorbis-tools/oggenc/oggenc.c (revision 19117)
|
||||
@@ -98,4 +98,6 @@
|
||||
0,0,0.f,
|
||||
0, 0, 0, 0, 0};
|
||||
+ input_format raw_format = {NULL, 0, raw_open, wav_close, "raw",
|
||||
+ N_("RAW file reader")};
|
||||
|
||||
int i;
|
||||
@@ -240,6 +242,4 @@
|
||||
if(opt.rawmode)
|
||||
{
|
||||
- input_format raw_format = {NULL, 0, raw_open, wav_close, "raw",
|
||||
- N_("RAW file reader")};
|
||||
|
||||
enc_opts.rate=opt.raw_samplerate;
|
||||
Index: vorbis-tools/oggenc/skeleton.h
|
||||
===================================================================
|
||||
--- vorbis-tools/oggenc/skeleton.h (revision 19116)
|
||||
+++ vorbis-tools/oggenc/skeleton.h (revision 19117)
|
||||
@@ -42,5 +42,5 @@
|
||||
ogg_int64_t start_granule; /* start granule value */
|
||||
ogg_uint32_t preroll; /* preroll */
|
||||
- unsigned char granule_shift; // a 8-bit field /* 1 byte value holding the granule shift */
|
||||
+ unsigned char granule_shift; /* 1 byte value holding the granule shift */
|
||||
char *message_header_fields; /* holds all the message header fields */
|
||||
/* current total size of the message header fields, for realloc purpose, initially zero */
|
||||
|
|
@ -270,7 +270,10 @@ Kate stream.")
|
|||
(sha256
|
||||
(base32
|
||||
"1g12bnh5ah08v529y72kfdz5lhvy75iaz7f9jskyby23m9dkk2d3"))
|
||||
(patches (search-patches "vorbis-tools-CVE-2015-6749.patch"))))
|
||||
(patches (search-patches
|
||||
"vorbis-tools-CVE-2014-9638+CVE-2014-9639.patch"
|
||||
"vorbis-tools-CVE-2014-9640.patch"
|
||||
"vorbis-tools-CVE-2015-6749.patch"))))
|
||||
(build-system gnu-build-system)
|
||||
(inputs `(("ao" ,ao)
|
||||
("curl" ,curl)
|
||||
|
|
|
|||
Loading…
Reference in New Issue