mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-13 17:39:57 +00:00
Code Issues Projects Releases Wiki Activity

sox: patch CVE-2017-15372

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2017-15372

Pick the patch that was indeitified by Debian[1] as the solution.

[1]: https://security-tracker.debian.org/tracker/CVE-2017-15372

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This commit is contained in:
Gyorgy Sarvari
2026-02-09 12:38:53 +01:00
parent f9d6eb7ebd
commit 23dcf5a6e9
2 changed files with 101 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-multimedia/recipes-multimedia/sox/sox/CVE-2017-15372.patch
+100
View File
@@ -0,0 +1,100 @@
From 13086aa971f5a0a5a644323456a90a9fa96e03c3 Mon Sep 17 00:00:00 2001
From: Mans Rullgard <mans@mansr.com>
Date: Wed, 8 Nov 2017 00:27:46 +0000
Subject: [PATCH] adpcm: fix stack overflow with >4 channels (CVE-2017-15372)
CVE: CVE-2017-15372
Upstream-Status: Backport [https://github.com/mansr/sox/commit/001c337552912d286ba68086ac378f6fdc1e8b50]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
src/adpcm.c | 8 +++++++-
src/adpcm.h | 3 +++
src/wav.c | 5 ++++-
3 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/src/adpcm.c b/src/adpcm.c
index 2e13867..f64b7d5 100644
--- a/src/adpcm.c
+++ b/src/adpcm.c
@@ -71,6 +71,11 @@ const short lsx_ms_adpcm_i_coef[7][2] = {
{ 392,-232}
};
+extern void *lsx_ms_adpcm_alloc(unsigned chans)
+{
+ return lsx_malloc(chans * sizeof(MsState_t));
+}
+
static inline sox_sample_t AdpcmDecode(sox_sample_t c, MsState_t *state,
sox_sample_t sample1, sox_sample_t sample2)
{
@@ -102,6 +107,7 @@ static inline sox_sample_t AdpcmDecode(sox_sample_t c, MsState_t *state,
/* lsx_ms_adpcm_block_expand_i() outputs interleaved samples into one output buffer */
const char *lsx_ms_adpcm_block_expand_i(
+ void *priv,
unsigned chans, /* total channels */
int nCoef,
const short *coef,
@@ -113,7 +119,7 @@ const char *lsx_ms_adpcm_block_expand_i(
const unsigned char *ip;
unsigned ch;
const char *errmsg = NULL;
- MsState_t state[4]; /* One decompressor state for each channel */
+ MsState_t *state = priv; /* One decompressor state for each channel */
/* Read the four-byte header for each channel */
ip = ibuff;
diff --git a/src/adpcm.h b/src/adpcm.h
index af4d6f0..db5cc61 100644
--- a/src/adpcm.h
+++ b/src/adpcm.h
@@ -29,8 +29,11 @@
/* default coef sets */
extern const short lsx_ms_adpcm_i_coef[7][2];
+extern void *lsx_ms_adpcm_alloc(unsigned chans);
+
/* lsx_ms_adpcm_block_expand_i() outputs interleaved samples into one output buffer */
extern const char *lsx_ms_adpcm_block_expand_i(
+ void *priv,
unsigned chans, /* total channels */
int nCoef,
const short *coef,
diff --git a/src/wav.c b/src/wav.c
index fad334c..066be6d 100644
--- a/src/wav.c
+++ b/src/wav.c
@@ -82,6 +82,7 @@ typedef struct {
/* following used by *ADPCM wav files */
unsigned short nCoefs; /* ADPCM: number of coef sets */
short *lsx_ms_adpcm_i_coefs; /* ADPCM: coef sets */
+ void *ms_adpcm_data; /* Private data of adpcm decoder */
unsigned char *packet; /* Temporary buffer for packets */
short *samples; /* interleaved samples buffer */
short *samplePtr; /* Pointer to current sample */
@@ -175,7 +176,7 @@ static unsigned short AdpcmReadBlock(sox_format_t * ft)
}
}
- errmsg = lsx_ms_adpcm_block_expand_i(ft->signal.channels, wav->nCoefs, wav->lsx_ms_adpcm_i_coefs, wav->packet, wav->samples, samplesThisBlock);
+ errmsg = lsx_ms_adpcm_block_expand_i(wav->ms_adpcm_data, ft->signal.channels, wav->nCoefs, wav->lsx_ms_adpcm_i_coefs, wav->packet, wav->samples, samplesThisBlock);
if (errmsg)
lsx_warn("%s", errmsg);
@@ -791,6 +792,7 @@ static int startread(sox_format_t * ft)
/* nCoefs, lsx_ms_adpcm_i_coefs used by adpcm.c */
wav->lsx_ms_adpcm_i_coefs = lsx_malloc(wav->nCoefs * 2 * sizeof(short));
+ wav->ms_adpcm_data = lsx_ms_adpcm_alloc(wChannels);
{
int i, errct=0;
for (i=0; len>=2 && i < 2*wav->nCoefs; i++) {
@@ -1216,6 +1218,7 @@ static int stopread(sox_format_t * ft)
free(wav->packet);
free(wav->samples);
free(wav->lsx_ms_adpcm_i_coefs);
+ free(wav->ms_adpcm_data);
free(wav->comment);
wav->comment = NULL;
meta-multimedia/recipes-multimedia/sox/sox_14.4.2.bb
+1
View File
@@ -35,6 +35,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/sox/sox-${PV}.tar.gz \
file://CVE-2017-11359.patch \
file://CVE-2017-15370.patch \
file://CVE-2017-15371.patch \
file://CVE-2017-15372.patch \
"
SRC_URI[md5sum] = "d04fba2d9245e661f245de0577f48a33"
SRC_URI[sha256sum] = "b45f598643ffbd8e363ff24d61166ccec4836fea6d3888881b8df53e3bb55f6c"