56 lines
1.9 KiB
Diff
56 lines
1.9 KiB
Diff
Copied from Fedora.
|
|
|
|
http://pkgs.fedoraproject.org/cgit/libsndfile.git/plain/libsndfile-1.0.25-cve2014_9496.patch
|
|
|
|
diff -up libsndfile-1.0.25/src/sd2.c.cve2014_9496 libsndfile-1.0.25/src/sd2.c
|
|
--- libsndfile-1.0.25/src/sd2.c.cve2014_9496 2011-01-19 11:10:36.000000000 +0100
|
|
+++ libsndfile-1.0.25/src/sd2.c 2015-01-13 17:00:35.920285526 +0100
|
|
@@ -395,6 +395,21 @@ read_marker (const unsigned char * data,
|
|
return 0x666 ;
|
|
} /* read_marker */
|
|
|
|
+static inline int
|
|
+read_rsrc_marker (const SD2_RSRC *prsrc, int offset)
|
|
+{ const unsigned char * data = prsrc->rsrc_data ;
|
|
+
|
|
+ if (offset < 0 || offset + 3 >= prsrc->rsrc_len)
|
|
+ return 0 ;
|
|
+
|
|
+ if (CPU_IS_BIG_ENDIAN)
|
|
+ return (((uint32_t) data [offset]) << 24) + (data [offset + 1] << 16) + (data [offset + 2] << 8) + data [offset + 3] ;
|
|
+ if (CPU_IS_LITTLE_ENDIAN)
|
|
+ return data [offset] + (data [offset + 1] << 8) + (data [offset + 2] << 16) + (((uint32_t) data [offset + 3]) << 24) ;
|
|
+
|
|
+ return 0 ;
|
|
+} /* read_rsrc_marker */
|
|
+
|
|
static void
|
|
read_str (const unsigned char * data, int offset, char * buffer, int buffer_len)
|
|
{ int k ;
|
|
@@ -496,6 +511,11 @@ sd2_parse_rsrc_fork (SF_PRIVATE *psf)
|
|
|
|
rsrc.type_offset = rsrc.map_offset + 30 ;
|
|
|
|
+ if (rsrc.map_offset + 28 > rsrc.rsrc_len)
|
|
+ { psf_log_printf (psf, "Bad map offset.\n") ;
|
|
+ goto parse_rsrc_fork_cleanup ;
|
|
+ } ;
|
|
+
|
|
rsrc.type_count = read_short (rsrc.rsrc_data, rsrc.map_offset + 28) + 1 ;
|
|
if (rsrc.type_count < 1)
|
|
{ psf_log_printf (psf, "Bad type count.\n") ;
|
|
@@ -512,7 +532,12 @@ sd2_parse_rsrc_fork (SF_PRIVATE *psf)
|
|
|
|
rsrc.str_index = -1 ;
|
|
for (k = 0 ; k < rsrc.type_count ; k ++)
|
|
- { marker = read_marker (rsrc.rsrc_data, rsrc.type_offset + k * 8) ;
|
|
+ { if (rsrc.type_offset + k * 8 > rsrc.rsrc_len)
|
|
+ { psf_log_printf (psf, "Bad rsrc marker.\n") ;
|
|
+ goto parse_rsrc_fork_cleanup ;
|
|
+ } ;
|
|
+
|
|
+ marker = read_rsrc_marker (&rsrc, rsrc.type_offset + k * 8) ;
|
|
|
|
if (marker == STR_MARKER)
|
|
{ rsrc.str_index = k ;
|