From 06d20617d0d5bb89a6caf5f2201c93baf03c43c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Mon, 10 Jun 2019 08:54:29 -0700 Subject: [PATCH 05/11] CVE-2019-7577: Fix a buffer overread in MS_ADPCM_nibble and MS_ADPCM_decode If a chunk of RIFF/WAV file with MS ADPCM encoding contains an invalid predictor (a valid predictor's value is between 0 and 6 inclusive), a buffer overread can happen when the predictor is used as an index into an array of MS ADPCM coefficients. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The overead happens when indexing MS_ADPCM_state.aCoeff[] array in MS_ADPCM_decode() and later when dereferencing a coef pointer in MS_ADPCM_nibble(). This patch fixes it by checking the MS ADPCM predictor values fit into the valid range. CVE-2019-7577 Reproducer: https://bugzilla.libsdl.org/show_bug.cgi?id=4492 Signed-off-by: Petr Písař --HG-- branch : SDL-1.2 --- src/audio/SDL_wave.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c index 6c6eb14eb..3eedd20a1 100644 --- a/src/audio/SDL_wave.c +++ b/src/audio/SDL_wave.c @@ -147,6 +147,9 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len) if ( stereo ) { state[1]->hPredictor = *encoded++; } + if (state[0]->hPredictor >= 7 || state[1]->hPredictor >= 7) { + goto invalid_predictor; + } state[0]->iDelta = ((encoded[1]<<8)|encoded[0]); encoded += sizeof(Sint16); if ( stereo ) { @@ -217,6 +220,10 @@ too_short: SDL_SetError("Too short chunk for a MS ADPCM decoder"); SDL_free(freeable); return(-1); +invalid_predictor: + SDL_SetError("Invalid predictor value for a MS ADPCM decoder"); + SDL_free(freeable); + return(-1); } struct IMA_ADPCM_decodestate { -- 2.21.0