cb18218ad1
A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file. https://nvd.nist.gov/vuln/detail/CVE-2021-3246 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
41 lines
1.6 KiB
Diff
41 lines
1.6 KiB
Diff
From deb669ee8be55a94565f6f8a6b60890c2e7c6f32 Mon Sep 17 00:00:00 2001
|
|
From: bobsayshilol <bobsayshilol@live.co.uk>
|
|
Date: Thu, 18 Feb 2021 21:52:09 +0000
|
|
Subject: [PATCH] ms_adpcm: Fix and extend size checks
|
|
|
|
'blockalign' is the size of a block, and each block contains 7 samples
|
|
per channel as part of the preamble, so check against 'samplesperblock'
|
|
rather than 'blockalign'. Also add an additional check that the block
|
|
is big enough to hold the samples it claims to hold.
|
|
|
|
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26803
|
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
---
|
|
src/ms_adpcm.c | 10 ++++++++--
|
|
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/ms_adpcm.c b/src/ms_adpcm.c
|
|
index 5e8f1a31..a21cb994 100644
|
|
--- a/src/ms_adpcm.c
|
|
+++ b/src/ms_adpcm.c
|
|
@@ -128,8 +128,14 @@ wavlike_msadpcm_init (SF_PRIVATE *psf, int blockalign, int samplesperblock)
|
|
if (psf->file.mode == SFM_WRITE)
|
|
samplesperblock = 2 + 2 * (blockalign - 7 * psf->sf.channels) / psf->sf.channels ;
|
|
|
|
- if (blockalign < 7 * psf->sf.channels)
|
|
- { psf_log_printf (psf, "*** Error blockalign (%d) should be > %d.\n", blockalign, 7 * psf->sf.channels) ;
|
|
+ /* There's 7 samples per channel in the preamble of each block */
|
|
+ if (samplesperblock < 7 * psf->sf.channels)
|
|
+ { psf_log_printf (psf, "*** Error samplesperblock (%d) should be >= %d.\n", samplesperblock, 7 * psf->sf.channels) ;
|
|
+ return SFE_INTERNAL ;
|
|
+ } ;
|
|
+
|
|
+ if (2 * blockalign < samplesperblock * psf->sf.channels)
|
|
+ { psf_log_printf (psf, "*** Error blockalign (%d) should be >= %d.\n", blockalign, samplesperblock * psf->sf.channels / 2) ;
|
|
return SFE_INTERNAL ;
|
|
} ;
|
|
|
|
--
|
|
2.20.1
|
|
|