diff options
| author | Yue Tao <Yue.Tao@windriver.com> | 2015-06-05 15:48:15 +0800 |
|---|---|---|
| committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2015-06-08 17:32:45 +0100 |
| commit | 9907e20868397a9823cc1e755ee1b697da6be2f3 (patch) | |
| tree | fddc31a7d9b7b04266ebd18e6ea09dfc5b6cdae8 /meta/recipes-multimedia/libsndfile/files/0001-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch | |
| parent | 8cc63ea7e1e4838988f61bdedf395d8f5f328450 (diff) | |
| download | openembedded-core-9907e20868397a9823cc1e755ee1b697da6be2f3.tar.gz openembedded-core-9907e20868397a9823cc1e755ee1b697da6be2f3.tar.bz2 openembedded-core-9907e20868397a9823cc1e755ee1b697da6be2f3.zip | |
libsndfile: Security Advisory - libsndfile - CVE-2014-9496
Backport two commits from libsndfile upstream to fix a segfault and
two potential buffer overflows.
Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Diffstat (limited to 'meta/recipes-multimedia/libsndfile/files/0001-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch')
| -rw-r--r-- | meta/recipes-multimedia/libsndfile/files/0001-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch | 49 |
1 files changed, 49 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libsndfile/files/0001-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch b/meta/recipes-multimedia/libsndfile/files/0001-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch new file mode 100644 index 0000000000..fa6473d4f8 --- /dev/null +++ b/meta/recipes-multimedia/libsndfile/files/0001-src-sd2.c-Fix-two-potential-buffer-read-overflows.patch @@ -0,0 +1,49 @@ +From dbe14f00030af5d3577f4cabbf9861db59e9c378 Mon Sep 17 00:00:00 2001 +From: Erik de Castro Lopo <erikd@mega-nerd.com> +Date: Thu, 25 Dec 2014 19:23:12 +1100 +Subject: [PATCH] src/sd2.c : Fix two potential buffer read overflows. + +(Upstream commit dbe14f00030af5d3577f4cabbf9861db59e9c378) + +Closes: https://github.com/erikd/libsndfile/issues/93 + +Upstream-Status: Backport + +Signed-off-by: Yue Tao <yue.tao@windriver.com> +--- + src/sd2.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/src/sd2.c b/src/sd2.c +index 0b4e5af..a70a1f1 100644 +--- a/src/sd2.c ++++ b/src/sd2.c +@@ -517,6 +517,11 @@ sd2_parse_rsrc_fork (SF_PRIVATE *psf) + + rsrc.type_offset = rsrc.map_offset + 30 ; + ++ if (rsrc.map_offset + 28 > rsrc.rsrc_len) ++ { psf_log_printf (psf, "Bad map offset.\n") ; ++ goto parse_rsrc_fork_cleanup ; ++ } ; ++ + rsrc.type_count = read_rsrc_short (&rsrc, rsrc.map_offset + 28) + 1 ; + if (rsrc.type_count < 1) + { psf_log_printf (psf, "Bad type count.\n") ; +@@ -533,7 +538,12 @@ sd2_parse_rsrc_fork (SF_PRIVATE *psf) + + rsrc.str_index = -1 ; + for (k = 0 ; k < rsrc.type_count ; k ++) +- { marker = read_rsrc_marker (&rsrc, rsrc.type_offset + k * 8) ; ++ { if (rsrc.type_offset + k * 8 > rsrc.rsrc_len) ++ { psf_log_printf (psf, "Bad rsrc marker.\n") ; ++ goto parse_rsrc_fork_cleanup ; ++ } ; ++ ++ marker = read_rsrc_marker (&rsrc, rsrc.type_offset + k * 8) ; + + if (marker == STR_MARKER) + { rsrc.str_index = k ; +-- +1.7.9.5 + |