From 98a125494cbb7c45cecf398206a771071adcd0f7 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Sep 29 2020 06:59:31 +0000 Subject: import libsndfile-1.0.25-12.el7 --- diff --git a/SOURCES/libsndfile-1.0.28-CVE_2018_19662.patch b/SOURCES/libsndfile-1.0.28-CVE_2018_19662.patch new file mode 100644 index 0000000..d311c11 --- /dev/null +++ b/SOURCES/libsndfile-1.0.28-CVE_2018_19662.patch @@ -0,0 +1,91 @@ +From 585cc28a93be27d6938f276af0011401b9f7c0ca Mon Sep 17 00:00:00 2001 +From: Hugo Lefeuvre +Date: Mon, 24 Dec 2018 06:43:48 +0100 +Subject: [PATCH] a/ulaw: fix multiple buffer overflows (#432) + +i2ulaw_array() and i2alaw_array() fail to handle ptr [count] = INT_MIN +properly, leading to buffer underflow. INT_MIN is a special value +since - INT_MIN cannot be represented as int. + +In this case round - INT_MIN to INT_MAX and proceed as usual. + +f2ulaw_array() and f2alaw_array() fail to handle ptr [count] = NaN +properly, leading to null pointer dereference. + +In this case, arbitrarily set the buffer value to 0. + +This commit fixes #429 (CVE-2018-19661 and CVE-2018-19662) and +fixes #344 (CVE-2017-17456 and CVE-2017-17457). +--- + src/alaw.c | 9 +++++++-- + src/ulaw.c | 9 +++++++-- + 2 files changed, 14 insertions(+), 4 deletions(-) + +diff --git a/src/alaw.c b/src/alaw.c +index 063fd1a2..4220224c 100644 +--- a/src/alaw.c ++++ b/src/alaw.c +@@ -19,6 +19,7 @@ + #include "sfconfig.h" + + #include ++#include + + #include "sndfile.h" + #include "common.h" +@@ -326,7 +327,9 @@ s2alaw_array (const short *ptr, int count, unsigned char *buffer) + static inline void + i2alaw_array (const int *ptr, int count, unsigned char *buffer) + { while (--count >= 0) +- { if (ptr [count] >= 0) ++ { if (ptr [count] == INT_MIN) ++ buffer [count] = alaw_encode [INT_MAX >> (16 + 4)] ; ++ else if (ptr [count] >= 0) + buffer [count] = alaw_encode [ptr [count] >> (16 + 4)] ; + else + buffer [count] = 0x7F & alaw_encode [- ptr [count] >> (16 + 4)] ; +@@ -346,7 +349,9 @@ f2alaw_array (const float *ptr, int count, unsigned char *buffer, float normfact + static inline void + d2alaw_array (const double *ptr, int count, unsigned char *buffer, double normfact) + { while (--count >= 0) +- { if (ptr [count] >= 0) ++ { if (!isfinite (ptr [count])) ++ buffer [count] = 0 ; ++ else if (ptr [count] >= 0) + buffer [count] = alaw_encode [lrint (normfact * ptr [count])] ; + else + buffer [count] = 0x7F & alaw_encode [- lrint (normfact * ptr [count])] ; +diff --git a/src/ulaw.c b/src/ulaw.c +index e50b4cb5..b6070ade 100644 +--- a/src/ulaw.c ++++ b/src/ulaw.c +@@ -19,6 +19,7 @@ + #include "sfconfig.h" + + #include ++#include + + #include "sndfile.h" + #include "common.h" +@@ -827,7 +828,9 @@ s2ulaw_array (const short *ptr, int count, unsigned char *buffer) + static inline void + i2ulaw_array (const int *ptr, int count, unsigned char *buffer) + { while (--count >= 0) +- { if (ptr [count] >= 0) ++ { if (ptr [count] == INT_MIN) ++ buffer [count] = ulaw_encode [INT_MAX >> (16 + 2)] ; ++ else if (ptr [count] >= 0) + buffer [count] = ulaw_encode [ptr [count] >> (16 + 2)] ; + else + buffer [count] = 0x7F & ulaw_encode [-ptr [count] >> (16 + 2)] ; +@@ -847,7 +850,9 @@ f2ulaw_array (const float *ptr, int count, unsigned char *buffer, float normfact + static inline void + d2ulaw_array (const double *ptr, int count, unsigned char *buffer, double normfact) + { while (--count >= 0) +- { if (ptr [count] >= 0) ++ { if (!isfinite (ptr [count])) ++ buffer [count] = 0 ; ++ else if (ptr [count] >= 0) + buffer [count] = ulaw_encode [lrint (normfact * ptr [count])] ; + else + buffer [count] = 0x7F & ulaw_encode [- lrint (normfact * ptr [count])] ; diff --git a/SPECS/libsndfile.spec b/SPECS/libsndfile.spec index 7f21f64..1023e72 100644 --- a/SPECS/libsndfile.spec +++ b/SPECS/libsndfile.spec @@ -1,13 +1,14 @@ Summary: Library for reading and writing sound files Name: libsndfile Version: 1.0.25 -Release: 11%{?dist} +Release: 12%{?dist} License: LGPLv2+ and GPLv2+ and BSD Group: System Environment/Libraries URL: http://www.mega-nerd.com/libsndfile/ Source0: http://www.mega-nerd.com/libsndfile/files/libsndfile-%{version}.tar.gz Patch0: %{name}-1.0.25-system-gsm.patch Patch1: libsndfile-1.0.28-CVE_2018_13139.patch +Patch2: libsndfile-1.0.28-CVE_2018_19662.patch BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX) BuildRequires: alsa-lib-devel @@ -57,6 +58,7 @@ This package contains command line utilities for libsndfile. %setup -q %patch0 -p1 %patch1 -p1 -b .CVE_2018_13139 +%patch2 -p1 -b .CVE_2018_19662 rm -r src/GSM610 ; autoreconf -I M4 -fiv # for system-gsm patch #also for aarch64 support which requires autotools 2.69+ @@ -163,6 +165,9 @@ rm -rf $RPM_BUILD_ROOT %changelog +* Wed Mar 11 2020 Michal Hlavinka - 1.0.25-12 +- fix CVE-2018-19662 - buffer over-read in the function i2alaw_array (#1673086) + * Tue Oct 29 2019 Michal Hlavinka - 1.0.25-11 - fix CVE-2018-13139 - stack-based buffer overflow in sndfile-deinterleave utility (#1598577)