MIRRORS/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2025-12-14 22:35:25 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

audiofile: fix multiple CVEs

Browse Source 
CVE-2017-6830 / CVE-2017-6834 / CVE-2017-6836 / CVE-2017-6838

Use patch from buildroot:
4a1a8277bb

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Peter Marko 2024-12-27 11:56:13 +01:00 committed by Khem Raj
parent f29fbaa465
commit 75f2bd2b3b
No known key found for this signature in database
GPG Key ID: BB053355919D3314
2 changed files with 80 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb
View File

@ -15,6 +15,7 @@ SRC_URI = " \
file://0003-fix-CVE-2015-7747.patch \ file://0003-fix-CVE-2015-7747.patch \
file://0004-Always-check-the-number-of-coefficients.patch \ file://0004-Always-check-the-number-of-coefficients.patch \
file://0005-clamp-index-values-to-fix-index-overflow-in-IMA.cpp.patch \ file://0005-clamp-index-values-to-fix-index-overflow-in-IMA.cpp.patch \
file://0006-Check-for-multiplication-overflow-in-sfconvert.patch \
" "
SRC_URI[sha256sum] = "ea2449ad3f201ec590d811db9da6d02ffc5e87a677d06b92ab15363d8cb59782" SRC_URI[sha256sum] = "ea2449ad3f201ec590d811db9da6d02ffc5e87a677d06b92ab15363d8cb59782"

79
meta-oe/recipes-multimedia/audiofile/files/0006-Check-for-multiplication-overflow-in-sfconvert.patch Normal file
View File

@ -0,0 +1,79 @@
From 7d65f89defb092b63bcbc5d98349fb222ca73b3c Mon Sep 17 00:00:00 2001
From: Antonio Larrosa <larrosa@kde.org>
Date: Mon, 6 Mar 2017 13:54:52 +0100
Subject: [PATCH] Check for multiplication overflow in sfconvert
Checks that a multiplication doesn't overflow when
calculating the buffer size, and if it overflows,
reduce the buffer size instead of failing.
This fixes the 00192-audiofile-signintoverflow-sfconvert case
in #41
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
CVE: CVE-2017-6830
CVE: CVE-2017-6834
CVE: CVE-2017-6836
CVE: CVE-2017-6838
Upstream-Status: Inactive-Upstream [lastrelease: 2013]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
sfcommands/sfconvert.c | 34 ++++++++++++++++++++++++++++++++--
1 file changed, 32 insertions(+), 2 deletions(-)
diff --git a/sfcommands/sfconvert.c b/sfcommands/sfconvert.c
index 80a1bc4..970a3e4 100644
--- a/sfcommands/sfconvert.c
+++ b/sfcommands/sfconvert.c
@@ -45,6 +45,33 @@ void printusage (void);
void usageerror (void);
bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid);
+int firstBitSet(int x)
+{
+ int position=0;
+ while (x!=0)
+ {
+ x>>=1;
+ ++position;
+ }
+ return position;
+}
+
+#ifndef __has_builtin
+#define __has_builtin(x) 0
+#endif
+
+int multiplyCheckOverflow(int a, int b, int *result)
+{
+#if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow))
+ return __builtin_mul_overflow(a, b, result);
+#else
+ if (firstBitSet(a)+firstBitSet(b)>31) // int is signed, so we can't use 32 bits
+ return true;
+ *result = a * b;
+ return false;
+#endif
+}
+
int main (int argc, char **argv)
{
if (argc == 2)
@@ -323,8 +350,11 @@ bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid)
{
int frameSize = afGetVirtualFrameSize(infile, trackid, 1);
- const int kBufferFrameCount = 65536;
- void *buffer = malloc(kBufferFrameCount * frameSize);
+ int kBufferFrameCount = 65536;
+ int bufferSize;
+ while (multiplyCheckOverflow(kBufferFrameCount, frameSize, &bufferSize))
+ kBufferFrameCount /= 2;
+ void *buffer = malloc(bufferSize);
AFframecount totalFrames = afGetFrameCount(infile, AF_DEFAULT_TRACK);
AFframecount totalFramesWritten = 0;
--
2.11.0