From 437635f608f2d9b69fefcde9ebfcff2bab64d35e Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Fri, 21 Mar 2025 00:14:04 +0100 Subject: [PATCH] libmad: patch CVE-2017-8372 and CVE-2017-8373 Pick patch [1] from Debian based on [2] and [3]. [1] https://salsa.debian.org/multimedia-team/libmad/-/blob/debian/0.15.1b-11/debian/patches/md_size.diff?ref_type=tags [2] https://security-tracker.debian.org/tracker/CVE-2017-8372 [3] https://security-tracker.debian.org/tracker/CVE-2017-8373 Signed-off-by: Peter Marko Signed-off-by: Khem Raj --- .../libmad/CVE-2017-8372_CVE-2017-8373.patch | 69 +++++++++++++++++++ .../libmad/libmad_0.15.1b.bb | 1 + 2 files changed, 70 insertions(+) create mode 100644 meta-oe/recipes-multimedia/libmad/libmad/CVE-2017-8372_CVE-2017-8373.patch diff --git a/meta-oe/recipes-multimedia/libmad/libmad/CVE-2017-8372_CVE-2017-8373.patch b/meta-oe/recipes-multimedia/libmad/libmad/CVE-2017-8372_CVE-2017-8373.patch new file mode 100644 index 0000000000..a57df492d0 --- /dev/null +++ b/meta-oe/recipes-multimedia/libmad/libmad/CVE-2017-8372_CVE-2017-8373.patch @@ -0,0 +1,69 @@ +From 7e8f6e5118e31455924940141a761a1589e8d85d Mon Sep 17 00:00:00 2001 +From: Kurt Roeckx +Date: Sun, 28 Jan 2018 15:44:08 +0100 +Subject: [PATCH] Check the size of the main data + +The main data to decode a frame can come from the current frame and part of the +previous frame, the so called bit reservoir. si.main_data_begin is the part of +the previous frame we need for this frame. frame_space is the amount of main +data that can be in this frame, and next_md_begin is the part of this frame that +is going to be used for the next frame. + +The maximum amount of data from a previous frame that the format allows is 511 +bytes. The maximum frame size for the defined bitrates is at MPEG 2.5 layer 2 +at 320 kbit/s and 8 kHz sample rate which gives 72 * (320000 / 8000) + 1 = 2881. +So those defines are not large enough: + # define MAD_BUFFER_GUARD 8 + # define MAD_BUFFER_MDLEN (511 + 2048 + MAD_BUFFER_GUARD) + +There is also support for a "free" bitrate which allows you to create any frame +size, which can be larger than the buffer. + +Changing the defines is not an option since it's part of the ABI, so we check +that the main data fits in the bufer. + +The previous frame data is stored in *stream->main_data and contains +stream->md_len bytes. If stream->md_len is larger than the data we +need from the previous frame (si.main_data_begin) it still wouldn't fit +in the buffer, so just keep the data that we need. + +Source: https://salsa.debian.org/multimedia-team/libmad/-/blob/debian/0.15.1b-11/debian/patches/md_size.diff?ref_type=tags + +CVE: CVE-2017-8372 +CVE: CVE-2017-8373 +Upstream-Status: Inactive-Upstream [lastrelease: 2018] +Signed-off-by: Peter Marko +--- + layer3.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/layer3.c b/layer3.c +index 4e5d3fa..7dc4ca6 100644 +--- a/layer3.c ++++ b/layer3.c +@@ -2608,6 +2608,11 @@ int mad_layer_III(struct mad_stream *stream, struct mad_frame *frame) + next_md_begin = 0; + + md_len = si.main_data_begin + frame_space - next_md_begin; ++ if (md_len + MAD_BUFFER_GUARD > MAD_BUFFER_MDLEN) { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + + frame_used = 0; + +@@ -2625,8 +2630,11 @@ int mad_layer_III(struct mad_stream *stream, struct mad_frame *frame) + } + } + else { +- mad_bit_init(&ptr, +- *stream->main_data + stream->md_len - si.main_data_begin); ++ memmove(stream->main_data, ++ *stream->main_data + stream->md_len - si.main_data_begin, ++ si.main_data_begin); ++ stream->md_len = si.main_data_begin; ++ mad_bit_init(&ptr, *stream->main_data); + + if (md_len > si.main_data_begin) { + assert(stream->md_len + md_len - diff --git a/meta-oe/recipes-multimedia/libmad/libmad_0.15.1b.bb b/meta-oe/recipes-multimedia/libmad/libmad_0.15.1b.bb index 2d63f9a804..b6668980da 100644 --- a/meta-oe/recipes-multimedia/libmad/libmad_0.15.1b.bb +++ b/meta-oe/recipes-multimedia/libmad/libmad_0.15.1b.bb @@ -16,6 +16,7 @@ SRC_URI = "https://downloads.sourceforge.net/mad/libmad-${PV}.tar.gz \ file://obsolete_automake_macros.patch \ file://automake-foreign.patch \ file://0001-configure-Respect-the-cflags-from-environment.patch \ + file://CVE-2017-8372_CVE-2017-8373.patch \ " SRC_URI:append:toolchain-clang = " file://0004-Remove-clang-unsupported-compiler-flags.patch "