We are currently migrating Bugzilla to GitHub issues.
Any changes made to the bug tracker now will be lost, so please do not post new bugs or make changes to them.
When we're done, all bug URLs will redirect to their equivalent location on the new bug tracker.

[patch] Fix

0001-CVE-2019-7573-CVE-2019-7576-Fix-buffer-overreads-in-.patch (text/plain), 2.81 KB, created by Petr Pisar on 2019-02-15 09:51:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Petr Pisar

Created: 2019-02-15 09:51:53 UTC

Size: 2.81 KB

patch

obsolete

>From 3e2c89e516701f3586dfeadec13932f665371d2a Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
>Date: Fri, 15 Feb 2019 10:36:13 +0100
>Subject: [PATCH] CVE-2019-7573, CVE-2019-7576: Fix buffer overreads in
> InitMS_ADPCM
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>If MS ADPCM format chunk was too short, InitMS_ADPCM() parsing it
>could read past the end of chunk data. This patch fixes it.
>
>CVE-2019-7573
>https://bugzilla.libsdl.org/show_bug.cgi?id=4491
>CVE-2019-7576
>https://bugzilla.libsdl.org/show_bug.cgi?id=4490
>
>Signed-off-by: Petr PÃsaÅ <ppisar@redhat.com>
>---
> src/audio/SDL_wave.c | 13 ++++++++++---
> 1 file changed, 10 insertions(+), 3 deletions(-)
>
>diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c
>index 91e89e8..1d446ed 100644
>--- a/src/audio/SDL_wave.c
>+++ b/src/audio/SDL_wave.c
>@@ -44,12 +44,13 @@ static struct MS_ADPCM_decoder {
> 	struct MS_ADPCM_decodestate state[2];
> } MS_ADPCM_state;
> 
>-static int InitMS_ADPCM(WaveFMT *format)
>+static int InitMS_ADPCM(WaveFMT *format, int length)
> {
>-	Uint8 *rogue_feel;
>+	Uint8 *rogue_feel, *rogue_feel_end;
> 	int i;
> 
> 	/* Set the rogue pointer to the MS_ADPCM specific data */
>+	if (length < sizeof(*format)) goto too_short;
> 	MS_ADPCM_state.wavefmt.encoding = SDL_SwapLE16(format->encoding);
> 	MS_ADPCM_state.wavefmt.channels = SDL_SwapLE16(format->channels);
> 	MS_ADPCM_state.wavefmt.frequency = SDL_SwapLE32(format->frequency);
>@@ -58,9 +59,11 @@ static int InitMS_ADPCM(WaveFMT *format)
> 	MS_ADPCM_state.wavefmt.bitspersample =
> 					 SDL_SwapLE16(format->bitspersample);
> 	rogue_feel = (Uint8 *)format+sizeof(*format);
>+	rogue_feel_end = (Uint8 *)format + length;
> 	if ( sizeof(*format) == 16 ) {
> 		rogue_feel += sizeof(Uint16);
> 	}
>+	if (rogue_feel + 4 > rogue_feel_end) goto too_short;
> 	MS_ADPCM_state.wSamplesPerBlock = ((rogue_feel[1]<<8)|rogue_feel[0]);
> 	rogue_feel += sizeof(Uint16);
> 	MS_ADPCM_state.wNumCoef = ((rogue_feel[1]<<8)|rogue_feel[0]);
>@@ -70,12 +73,16 @@ static int InitMS_ADPCM(WaveFMT *format)
> 		return(-1);
> 	}
> 	for ( i=0; i<MS_ADPCM_state.wNumCoef; ++i ) {
>+		if (rogue_feel + 4 > rogue_feel_end) goto too_short;
> 		MS_ADPCM_state.aCoeff[i][0] = ((rogue_feel[1]<<8)|rogue_feel[0]);
> 		rogue_feel += sizeof(Uint16);
> 		MS_ADPCM_state.aCoeff[i][1] = ((rogue_feel[1]<<8)|rogue_feel[0]);
> 		rogue_feel += sizeof(Uint16);
> 	}
> 	return(0);
>+too_short:
>+	SDL_SetError("Unexpected length of a chunk with a MS ADPCM format");
>+	return(-1);
> }
> 
> static Sint32 MS_ADPCM_nibble(struct MS_ADPCM_decodestate *state,
>@@ -485,7 +492,7 @@ SDL_AudioSpec * SDL_LoadWAV_RW (SDL_RWops *src, int freesrc,
> 			break;
> 		case MS_ADPCM_CODE:
> 			/* Try to understand this */
>-			if ( InitMS_ADPCM(format) < 0 ) {
>+			if ( InitMS_ADPCM(format, lenread) < 0 ) {
> 				was_error = 1;
> 				goto done;
> 			}
>-- 
>2.20.1
>

Actions: View | Diff

Attachments on bug 4491: 3597 | 3619 | 3620 | 3621

We are currently migrating Bugzilla to GitHub issues.Any changes made to the bug tracker now will be lost, so please do not post new bugs or make changes to them.When we're done, all bug URLs will redirect to their equivalent location on the new bug tracker.

We are currently migrating Bugzilla to GitHub issues.
Any changes made to the bug tracker now will be lost, so please do not post new bugs or make changes to them.
When we're done, all bug URLs will redirect to their equivalent location on the new bug tracker.