mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-01 02:30:13 +00:00
Code Issues Projects Releases Wiki Activity

libsndfile1: patch CVE-2026-37555

Browse Source 
Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-37555

(From OE-Core rev: 19b24171d147f22fbd1db31e01cc2c389679fa8f)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Peter Marko
2026-08-24 11:43:46 +01:00
committed by Paul Barker
parent b28d0cf59a
commit f02ff451cd
2 changed files with 45 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch
+44
View File
@@ -0,0 +1,44 @@
From c32c090ff9bb45e1dae637957c9c9b47b3967623 Mon Sep 17 00:00:00 2001
From: Alb3e3 <74142887+Alb3e3@users.noreply.github.com>
Date: Sat, 27 Jun 2026 14:34:16 +0200
Subject: [PATCH] sds: avoid divide-by-zero in sds_byterate for zero-frame
files
sds_read_header() sets psf->sf.frames directly from the file's 3-byte
data-length field without a lower bound, so a crafted .sds file can
leave psf->sf.frames == 0. SDS never sets psf->bytewidth, so
sf_current_byterate() falls through to psf->byterate (sds_byterate),
which computes
(psf->datalength * psf->sf.samplerate) / psf->sf.frames
dividing by zero -> SIGFPE crash (denial of service) when an
application calls the public sf_current_byterate() on such a file.
Guard the division with psf->sf.frames > 0, returning -1 (the same
'unknown' value already used for the write path) otherwise.
Reproduced with a 21-byte crafted .sds (data-length field = 0) under
AddressSanitizer: 'FPE ... in sds_byterate src/sds.c:761' before the
fix; returns -1 cleanly after.
CVE: CVE-2026-37555
Upstream-Status: Backport [https://github.com/libsndfile/libsndfile/commit/c32c090ff9bb45e1dae637957c9c9b47b3967623]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
src/sds.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/sds.c b/src/sds.c
index 2a0f164c..1070e653 100644
--- a/src/sds.c
+++ b/src/sds.c
@@ -757,7 +757,7 @@ sds_seek (SF_PRIVATE *psf, int mode, sf_count_t seek_from_start)
static int
sds_byterate (SF_PRIVATE * psf)
{
- if (psf->file.mode == SFM_READ)
+ if (psf->file.mode == SFM_READ && psf->sf.frames > 0)
return (psf->datalength * psf->sf.samplerate) / psf->sf.frames ;
return -1 ;
meta/recipes-multimedia/libsndfile/libsndfile1_1.2.2.bb
+1
View File
@@ -13,6 +13,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/libsndfile-${PV}.tar.xz \
file://CVE-2024-50612.patch \
file://CVE-2025-56226-01.patch \
file://CVE-2025-56226-02.patch \
file://CVE-2026-37555.patch \
"
GITHUB_BASE_URI = "https://github.com/libsndfile/libsndfile/releases/"