mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-07-15 16:07:26 +00:00
Code Issues Projects Releases Wiki Activity

sox: patch CVE-2017-11332

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2017-11332

Pick the patch that was identified by Debian[1] as the solution.

[1]: https://security-tracker.debian.org/tracker/CVE-2017-11332

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Gyorgy Sarvari
2026-01-26 14:04:55 +01:00
committed by Anuj Mittal
parent 2306b49360
commit 73816b3deb
2 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-multimedia/recipes-multimedia/sox/sox/CVE-2017-11332.patch
+28
View File
@@ -0,0 +1,28 @@
From 80479b4978ddeb6fadb75007abc81f1ca2c50abb Mon Sep 17 00:00:00 2001
From: Mans Rullgard <mans@mansr.com>
Date: Sun, 5 Nov 2017 16:29:28 +0000
Subject: [PATCH] wav: fix crash if channel count is zero (CVE-2017-11332)
CVE: CVE-2017-11332
Upstream-Status: Backport [https://github.com/mansr/sox/commit/7405bcaacb1ded8c595cb751d407cf738cb26571]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
src/wav.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/wav.c b/src/wav.c
index 5202556..71fd52a 100644
--- a/src/wav.c
+++ b/src/wav.c
@@ -712,6 +712,11 @@ static int startread(sox_format_t * ft)
else
lsx_report("User options overriding channels read in .wav header");
+ if (ft->signal.channels == 0) {
+ lsx_fail_errno(ft, SOX_EHDR, "Channel count is zero");
+ return SOX_EOF;
+ }
+
if (ft->signal.rate == 0 || ft->signal.rate == dwSamplesPerSecond)
ft->signal.rate = dwSamplesPerSecond;
else
meta-multimedia/recipes-multimedia/sox/sox_14.4.2.bb
+1
View File
@@ -30,6 +30,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.GPL;md5=751419260aa954499f7abaabaa882bbe \
SRC_URI = "${SOURCEFORGE_MIRROR}/sox/sox-${PV}.tar.gz \ SRC_URI = "${SOURCEFORGE_MIRROR}/sox/sox-${PV}.tar.gz \
file://0001-remove-the-error-line-and-live-without-file-type-det.patch \ file://0001-remove-the-error-line-and-live-without-file-type-det.patch \
file://0001-Update-exported-symbol-list.patch \ file://0001-Update-exported-symbol-list.patch \
file://CVE-2017-11332.patch \
" "
SRC_URI[md5sum] = "d04fba2d9245e661f245de0577f48a33" SRC_URI[md5sum] = "d04fba2d9245e661f245de0577f48a33"
SRC_URI[sha256sum] = "b45f598643ffbd8e363ff24d61166ccec4836fea6d3888881b8df53e3bb55f6c" SRC_URI[sha256sum] = "b45f598643ffbd8e363ff24d61166ccec4836fea6d3888881b8df53e3bb55f6c"