mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-04-20 23:48:20 +00:00
Code Issues Projects Releases Wiki Activity

audiofile: fix multiple CVEs

Browse Source 
CVE-2017-6827 / CVE-2017-6828 / CVE-2017-6832 / CVE-2017-6833 / CVE-2017-6835 / CVE-2017-6837

Use patch from buildroot:
cc00bde57f

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Peter Marko
2024-12-27 11:56:11 +01:00
committed by Khem Raj
parent 74cda1df0e
commit 634cbcb91c
2 changed files with 46 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb
View File

@@ -13,6 +13,7 @@ SRC_URI = " \
file://0001-fix-negative-shift-constants.patch \ file://0001-fix-negative-shift-constants.patch \
file://0002-fix-build-on-gcc6.patch \ file://0002-fix-build-on-gcc6.patch \
file://0003-fix-CVE-2015-7747.patch \ file://0003-fix-CVE-2015-7747.patch \
file://0004-Always-check-the-number-of-coefficients.patch \
" "
SRC_URI[sha256sum] = "ea2449ad3f201ec590d811db9da6d02ffc5e87a677d06b92ab15363d8cb59782" SRC_URI[sha256sum] = "ea2449ad3f201ec590d811db9da6d02ffc5e87a677d06b92ab15363d8cb59782"

45
meta-oe/recipes-multimedia/audiofile/files/0004-Always-check-the-number-of-coefficients.patch Normal file
View File

@@ -0,0 +1,45 @@
From c48e4c6503f7dabd41f11d4c9c7b7f8960e7f2c0 Mon Sep 17 00:00:00 2001
From: Antonio Larrosa <larrosa@kde.org>
Date: Mon, 6 Mar 2017 12:51:22 +0100
Subject: [PATCH] Always check the number of coefficients
When building the library with NDEBUG, asserts are eliminated
so it's better to always check that the number of coefficients
is inside the array range.
This fixes the 00191-audiofile-indexoob issue in #41
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
CVE: CVE-2017-6827
CVE: CVE-2017-6828
CVE: CVE-2017-6832
CVE: CVE-2017-6833
CVE: CVE-2017-6835
CVE: CVE-2017-6837
Upstream-Status: Inactive-Upstream [lastrelease: 2013]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
libaudiofile/WAVE.cpp | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libaudiofile/WAVE.cpp b/libaudiofile/WAVE.cpp
index 0e81cf7..61f9541 100644
--- a/libaudiofile/WAVE.cpp
+++ b/libaudiofile/WAVE.cpp
@@ -281,6 +281,12 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
/* numCoefficients should be at least 7. */
assert(numCoefficients >= 7 && numCoefficients <= 255);
+ if (numCoefficients < 7 || numCoefficients > 255)
+ {
+ _af_error(AF_BAD_HEADER,
+ "Bad number of coefficients");
+ return AF_FAIL;
+ }
m_msadpcmNumCoefficients = numCoefficients;
--
2.11.0