Description: fixes buffer write overflows CVE-2017-7741, CVE-2017-7586, CVE-2017-7585 Author: Erik de Castro Lopo Origin: upstream Applied-Upstream: 1.0.28 Reviewed-by: IOhannes m zmölnig Last-Update: 2017-05-28 --- This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ --- libsndfile.orig/src/id3.c +++ libsndfile/src/id3.c @@ -1,5 +1,5 @@ /* -** Copyright (C) 2010-2011 Erik de Castro Lopo +** Copyright (C) 2010-2017 Erik de Castro Lopo ** ** This program is free software; you can redistribute it and/or modify ** it under the terms of the GNU Lesser General Public License as published by @@ -48,9 +48,11 @@ /* Calculate new file offset and position ourselves there. */ psf->fileoffset += offset + 10 ; - psf_binheader_readf (psf, "p", psf->fileoffset) ; - return 1 ; + if (psf->fileoffset < psf->filelength) + { psf_binheader_readf (psf, "p", psf->fileoffset) ; + return 1 ; + } ; } ; return 0 ; --- libsndfile.orig/src/flac.c +++ libsndfile/src/flac.c @@ -61,10 +61,10 @@ FLAC__StreamMetadata *metadata ; - const FLAC__int32 * const * wbuffer ; - FLAC__int32 * rbuffer [FLAC__MAX_CHANNELS] ; + const int32_t * const * wbuffer ; + int32_t * rbuffer [FLAC__MAX_CHANNELS] ; - FLAC__int32* encbuffer ; + int32_t* encbuffer ; unsigned bufferpos ; const FLAC__Frame *frame ; @@ -95,18 +95,18 @@ static sf_count_t flac_write_f2flac (SF_PRIVATE *psf, const float *ptr, sf_count_t len) ; static sf_count_t flac_write_d2flac (SF_PRIVATE *psf, const double *ptr, sf_count_t len) ; -static void f2flac8_array (const float *src, FLAC__int32 *dest, int count, int normalize) ; -static void f2flac16_array (const float *src, FLAC__int32 *dest, int count, int normalize) ; -static void f2flac24_array (const float *src, FLAC__int32 *dest, int count, int normalize) ; -static void f2flac8_clip_array (const float *src, FLAC__int32 *dest, int count, int normalize) ; -static void f2flac16_clip_array (const float *src, FLAC__int32 *dest, int count, int normalize) ; -static void f2flac24_clip_array (const float *src, FLAC__int32 *dest, int count, int normalize) ; -static void d2flac8_array (const double *src, FLAC__int32 *dest, int count, int normalize) ; -static void d2flac16_array (const double *src, FLAC__int32 *dest, int count, int normalize) ; -static void d2flac24_array (const double *src, FLAC__int32 *dest, int count, int normalize) ; -static void d2flac8_clip_array (const double *src, FLAC__int32 *dest, int count, int normalize) ; -static void d2flac16_clip_array (const double *src, FLAC__int32 *dest, int count, int normalize) ; -static void d2flac24_clip_array (const double *src, FLAC__int32 *dest, int count, int normalize) ; +static void f2flac8_array (const float *src, int32_t *dest, int count, int normalize) ; +static void f2flac16_array (const float *src, int32_t *dest, int count, int normalize) ; +static void f2flac24_array (const float *src, int32_t *dest, int count, int normalize) ; +static void f2flac8_clip_array (const float *src, int32_t *dest, int count, int normalize) ; +static void f2flac16_clip_array (const float *src, int32_t *dest, int count, int normalize) ; +static void f2flac24_clip_array (const float *src, int32_t *dest, int count, int normalize) ; +static void d2flac8_array (const double *src, int32_t *dest, int count, int normalize) ; +static void d2flac16_array (const double *src, int32_t *dest, int count, int normalize) ; +static void d2flac24_array (const double *src, int32_t *dest, int count, int normalize) ; +static void d2flac8_clip_array (const double *src, int32_t *dest, int count, int normalize) ; +static void d2flac16_clip_array (const double *src, int32_t *dest, int count, int normalize) ; +static void d2flac24_clip_array (const double *src, int32_t *dest, int count, int normalize) ; static int flac_command (SF_PRIVATE *psf, int command, void *data, int datasize) ; @@ -116,7 +116,7 @@ static FLAC__StreamDecoderTellStatus sf_flac_tell_callback (const FLAC__StreamDecoder *decoder, FLAC__uint64 *absolute_byte_offset, void *client_data) ; static FLAC__StreamDecoderLengthStatus sf_flac_length_callback (const FLAC__StreamDecoder *decoder, FLAC__uint64 *stream_length, void *client_data) ; static FLAC__bool sf_flac_eof_callback (const FLAC__StreamDecoder *decoder, void *client_data) ; -static FLAC__StreamDecoderWriteStatus sf_flac_write_callback (const FLAC__StreamDecoder *decoder, const FLAC__Frame *frame, const FLAC__int32 * const buffer [], void *client_data) ; +static FLAC__StreamDecoderWriteStatus sf_flac_write_callback (const FLAC__StreamDecoder *decoder, const FLAC__Frame *frame, const int32_t * const buffer [], void *client_data) ; static void sf_flac_meta_callback (const FLAC__StreamDecoder *decoder, const FLAC__StreamMetadata *metadata, void *client_data) ; static void sf_flac_error_callback (const FLAC__StreamDecoder *decoder, FLAC__StreamDecoderErrorStatus status, void *client_data) ; @@ -126,38 +126,38 @@ static FLAC__StreamEncoderWriteStatus sf_flac_enc_write_callback (const FLAC__StreamEncoder *encoder, const FLAC__byte buffer [], size_t bytes, unsigned samples, unsigned current_frame, void *client_data) ; static void -s2flac8_array (const short *src, FLAC__int32 *dest, int count) +s2flac8_array (const short *src, int32_t *dest, int count) { while (--count >= 0) dest [count] = src [count] >> 8 ; } /* s2flac8_array */ static void -s2flac16_array (const short *src, FLAC__int32 *dest, int count) +s2flac16_array (const short *src, int32_t *dest, int count) { while (--count >= 0) dest [count] = src [count] ; } /* s2flac16_array */ static void -s2flac24_array (const short *src, FLAC__int32 *dest, int count) +s2flac24_array (const short *src, int32_t *dest, int count) { while (--count >= 0) dest [count] = src [count] << 8 ; } /* s2flac24_array */ static void -i2flac8_array (const int *src, FLAC__int32 *dest, int count) +i2flac8_array (const int *src, int32_t *dest, int count) { while (--count >= 0) dest [count] = src [count] >> 24 ; } /* i2flac8_array */ static void -i2flac16_array (const int *src, FLAC__int32 *dest, int count) +i2flac16_array (const int *src, int32_t *dest, int count) { while (--count >= 0) dest [count] = src [count] >> 16 ; } /* i2flac16_array */ static void -i2flac24_array (const int *src, FLAC__int32 *dest, int count) +i2flac24_array (const int *src, int32_t *dest, int count) { while (--count >= 0) dest [count] = src [count] >> 8 ; } /* i2flac24_array */ @@ -166,8 +166,8 @@ flac_buffer_copy (SF_PRIVATE *psf) { FLAC_PRIVATE* pflac = (FLAC_PRIVATE*) psf->codec_data ; const FLAC__Frame *frame = pflac->frame ; - const FLAC__int32* const *buffer = pflac->wbuffer ; - unsigned i = 0, j, offset ; + const int32_t* const *buffer = pflac->wbuffer ; + unsigned i = 0, j, offset, channels, len ; /* ** frame->header.blocksize is variable and we're using a constant blocksize @@ -180,53 +180,67 @@ return 0 ; } ; + if (frame->header.channels > FLAC__MAX_CHANNELS) + psf_log_printf (psf, "Ooops : frame->header.channels (%d) > FLAC__MAX_BLOCK_SIZE (%d)\n", __func__, __LINE__, frame->header.channels, FLAC__MAX_CHANNELS) ; + + channels = SF_MIN (frame->header.channels, FLAC__MAX_CHANNELS) ; + if (pflac->ptr == NULL) { /* ** Not sure why this code is here and not elsewhere. ** Removing it causes valgrind errors. */ pflac->bufferbackup = SF_TRUE ; - for (i = 0 ; i < frame->header.channels ; i++) + for (i = 0 ; i < channels ; i++) { if (pflac->rbuffer [i] == NULL) - pflac->rbuffer [i] = calloc (FLAC__MAX_BLOCK_SIZE, sizeof (FLAC__int32)) ; + pflac->rbuffer [i] = calloc (FLAC__MAX_BLOCK_SIZE, sizeof (int32_t)) ; - memcpy (pflac->rbuffer [i], buffer [i], frame->header.blocksize * sizeof (FLAC__int32)) ; + memcpy (pflac->rbuffer [i], buffer [i], frame->header.blocksize * sizeof (int32_t)) ; } ; - pflac->wbuffer = (const FLAC__int32* const*) pflac->rbuffer ; + pflac->wbuffer = (const int32_t* const*) pflac->rbuffer ; return 0 ; } ; + + len = SF_MIN (pflac->len, frame->header.blocksize) ; + switch (pflac->pcmtype) { case PFLAC_PCM_SHORT : { short *retpcm = (short*) pflac->ptr ; int shift = 16 - frame->header.bits_per_sample ; if (shift < 0) { shift = abs (shift) ; - for (i = 0 ; i < frame->header.blocksize && pflac->remain > 0 ; i++) - { offset = pflac->pos + i * frame->header.channels ; + for (i = 0 ; i < len && pflac->remain > 0 ; i++) + { offset = pflac->pos + i * channels ; if (pflac->bufferpos >= frame->header.blocksize) break ; - for (j = 0 ; j < frame->header.channels ; j++) + if (offset + channels > pflac->len) + break ; + + for (j = 0 ; j < channels ; j++) retpcm [offset + j] = buffer [j][pflac->bufferpos] >> shift ; - pflac->remain -= frame->header.channels ; + pflac->remain -= channels ; pflac->bufferpos++ ; } } else - { for (i = 0 ; i < frame->header.blocksize && pflac->remain > 0 ; i++) - { offset = pflac->pos + i * frame->header.channels ; + { for (i = 0 ; i < len && pflac->remain > 0 ; i++) + { offset = pflac->pos + i * channels ; if (pflac->bufferpos >= frame->header.blocksize) break ; - for (j = 0 ; j < frame->header.channels ; j++) + if (offset + channels > pflac->len) + break ; + + for (j = 0 ; j < channels ; j++) retpcm [offset + j] = ((uint16_t) buffer [j][pflac->bufferpos]) << shift ; - pflac->remain -= frame->header.channels ; + pflac->remain -= channels ; pflac->bufferpos++ ; } ; } ; @@ -236,15 +250,18 @@ case PFLAC_PCM_INT : { int *retpcm = (int*) pflac->ptr ; int shift = 32 - frame->header.bits_per_sample ; - for (i = 0 ; i < frame->header.blocksize && pflac->remain > 0 ; i++) - { offset = pflac->pos + i * frame->header.channels ; + for (i = 0 ; i < len && pflac->remain > 0 ; i++) + { offset = pflac->pos + i * channels ; if (pflac->bufferpos >= frame->header.blocksize) break ; - for (j = 0 ; j < frame->header.channels ; j++) + if (offset + channels > pflac->len) + break ; + + for (j = 0 ; j < channels ; j++) retpcm [offset + j] = ((uint32_t) buffer [j][pflac->bufferpos]) << shift ; - pflac->remain -= frame->header.channels ; + pflac->remain -= channels ; pflac->bufferpos++ ; } ; } ; @@ -254,15 +271,18 @@ { float *retpcm = (float*) pflac->ptr ; float norm = (psf->norm_float == SF_TRUE) ? 1.0 / (1 << (frame->header.bits_per_sample - 1)) : 1.0 ; - for (i = 0 ; i < frame->header.blocksize && pflac->remain > 0 ; i++) - { offset = pflac->pos + i * frame->header.channels ; + for (i = 0 ; i < len && pflac->remain > 0 ; i++) + { offset = pflac->pos + i * channels ; if (pflac->bufferpos >= frame->header.blocksize) break ; - for (j = 0 ; j < frame->header.channels ; j++) + if (offset + channels > pflac->len) + break ; + + for (j = 0 ; j < channels ; j++) retpcm [offset + j] = buffer [j][pflac->bufferpos] * norm ; - pflac->remain -= frame->header.channels ; + pflac->remain -= channels ; pflac->bufferpos++ ; } ; } ; @@ -272,15 +292,18 @@ { double *retpcm = (double*) pflac->ptr ; double norm = (psf->norm_double == SF_TRUE) ? 1.0 / (1 << (frame->header.bits_per_sample - 1)) : 1.0 ; - for (i = 0 ; i < frame->header.blocksize && pflac->remain > 0 ; i++) - { offset = pflac->pos + i * frame->header.channels ; + for (i = 0 ; i < len && pflac->remain > 0 ; i++) + { offset = pflac->pos + i * channels ; if (pflac->bufferpos >= frame->header.blocksize) break ; - for (j = 0 ; j < frame->header.channels ; j++) + if (offset + channels > pflac->len) + break ; + + for (j = 0 ; j < channels ; j++) retpcm [offset + j] = buffer [j][pflac->bufferpos] * norm ; - pflac->remain -= frame->header.channels ; + pflac->remain -= channels ; pflac->bufferpos++ ; } ; } ; @@ -290,8 +313,8 @@ return 0 ; } ; - offset = i * frame->header.channels ; - pflac->pos += i * frame->header.channels ; + offset = i * channels ; + pflac->pos += i * channels ; return offset ; } /* flac_buffer_copy */ @@ -351,7 +374,7 @@ } /* sf_flac_eof_callback */ static FLAC__StreamDecoderWriteStatus -sf_flac_write_callback (const FLAC__StreamDecoder * UNUSED (decoder), const FLAC__Frame *frame, const FLAC__int32 * const buffer [], void *client_data) +sf_flac_write_callback (const FLAC__StreamDecoder * UNUSED (decoder), const FLAC__Frame *frame, const int32_t * const buffer [], void *client_data) { SF_PRIVATE *psf = (SF_PRIVATE*) client_data ; FLAC_PRIVATE* pflac = (FLAC_PRIVATE*) psf->codec_data ; @@ -368,7 +391,7 @@ static void sf_flac_meta_get_vorbiscomments (SF_PRIVATE *psf, const FLAC__StreamMetadata *metadata) -{ FLAC_TAG tags [] = +{ static FLAC_TAG tags [] = { { "title", SF_STR_TITLE }, { "copyright", SF_STR_COPYRIGHT }, { "software", SF_STR_SOFTWARE }, @@ -404,7 +427,8 @@ static void sf_flac_meta_callback (const FLAC__StreamDecoder * UNUSED (decoder), const FLAC__StreamMetadata *metadata, void *client_data) { SF_PRIVATE *psf = (SF_PRIVATE*) client_data ; - int bitwidth = 0 ; + FLAC_PRIVATE* pflac = (FLAC_PRIVATE*) psf->codec_data ; + int bitwidth = 0, i ; switch (metadata->type) { case FLAC__METADATA_TYPE_STREAMINFO : @@ -441,6 +465,12 @@ if (bitwidth > 0) psf_log_printf (psf, " Bit width : %d\n", bitwidth) ; + + + for (i = 0 ; i < psf->sf.channels ; i++) + pflac->rbuffer [i] = calloc (FLAC__MAX_BLOCK_SIZE, sizeof (int32_t)) ; + + pflac->wbuffer = (const int32_t* const*) pflac->rbuffer ; break ; case FLAC__METADATA_TYPE_VORBIS_COMMENT : @@ -617,7 +647,7 @@ if (psf->error == 0) psf->dataoffset = psf_ftell (psf) ; - pflac->encbuffer = calloc (ENC_BUFFER_SIZE, sizeof (FLAC__int32)) ; + pflac->encbuffer = calloc (ENC_BUFFER_SIZE, sizeof (int32_t)) ; return psf->error ; } /* flac_write_header */ @@ -880,9 +910,12 @@ pflac->pos = 0 ; pflac->len = len ; pflac->remain = len ; + + /* First copy data that has already been decoded and buffered. */ if (pflac->frame != NULL && pflac->bufferpos < pflac->frame->header.blocksize) flac_buffer_copy (psf) ; + /* Decode some more. */ while (pflac->pos < pflac->len) { if (FLAC__stream_decoder_process_single (pflac->fsd) == 0) break ; @@ -966,6 +999,7 @@ while (total < len) { pflac->ptr = ptr + total ; readlen = (len - total > 0x1000000) ? 0x1000000 : (unsigned) (len - total) ; + current = flac_read_loop (psf, readlen) ; if (current == 0) break ; @@ -978,10 +1012,10 @@ static sf_count_t flac_write_s2flac (SF_PRIVATE *psf, const short *ptr, sf_count_t len) { FLAC_PRIVATE* pflac = (FLAC_PRIVATE*) psf->codec_data ; - void (*convert) (const short *, FLAC__int32 *, int) ; + void (*convert) (const short *, int32_t *, int) ; int bufferlen, writecount, thiswrite ; sf_count_t total = 0 ; - FLAC__int32* buffer = pflac->encbuffer ; + int32_t* buffer = pflac->encbuffer ; switch (SF_CODEC (psf->sf.format)) { case SF_FORMAT_PCM_S8 : @@ -997,7 +1031,7 @@ return -1 ; } ; - bufferlen = ENC_BUFFER_SIZE / (sizeof (FLAC__int32) * psf->sf.channels) ; + bufferlen = ENC_BUFFER_SIZE / (sizeof (int32_t) * psf->sf.channels) ; bufferlen *= psf->sf.channels ; while (len > 0) @@ -1020,10 +1054,10 @@ static sf_count_t flac_write_i2flac (SF_PRIVATE *psf, const int *ptr, sf_count_t len) { FLAC_PRIVATE* pflac = (FLAC_PRIVATE*) psf->codec_data ; - void (*convert) (const int *, FLAC__int32 *, int) ; + void (*convert) (const int *, int32_t *, int) ; int bufferlen, writecount, thiswrite ; sf_count_t total = 0 ; - FLAC__int32* buffer = pflac->encbuffer ; + int32_t* buffer = pflac->encbuffer ; switch (SF_CODEC (psf->sf.format)) { case SF_FORMAT_PCM_S8 : @@ -1039,7 +1073,7 @@ return -1 ; } ; - bufferlen = ENC_BUFFER_SIZE / (sizeof (FLAC__int32) * psf->sf.channels) ; + bufferlen = ENC_BUFFER_SIZE / (sizeof (int32_t) * psf->sf.channels) ; bufferlen *= psf->sf.channels ; while (len > 0) @@ -1062,10 +1096,10 @@ static sf_count_t flac_write_f2flac (SF_PRIVATE *psf, const float *ptr, sf_count_t len) { FLAC_PRIVATE* pflac = (FLAC_PRIVATE*) psf->codec_data ; - void (*convert) (const float *, FLAC__int32 *, int, int) ; + void (*convert) (const float *, int32_t *, int, int) ; int bufferlen, writecount, thiswrite ; sf_count_t total = 0 ; - FLAC__int32* buffer = pflac->encbuffer ; + int32_t* buffer = pflac->encbuffer ; switch (SF_CODEC (psf->sf.format)) { case SF_FORMAT_PCM_S8 : @@ -1081,7 +1115,7 @@ return -1 ; } ; - bufferlen = ENC_BUFFER_SIZE / (sizeof (FLAC__int32) * psf->sf.channels) ; + bufferlen = ENC_BUFFER_SIZE / (sizeof (int32_t) * psf->sf.channels) ; bufferlen *= psf->sf.channels ; while (len > 0) @@ -1102,7 +1136,7 @@ } /* flac_write_f2flac */ static void -f2flac8_clip_array (const float *src, FLAC__int32 *dest, int count, int normalize) +f2flac8_clip_array (const float *src, int32_t *dest, int count, int normalize) { float normfact, scaled_value ; normfact = normalize ? (8.0 * 0x10) : 1.0 ; @@ -1124,7 +1158,7 @@ } /* f2flac8_clip_array */ static void -f2flac16_clip_array (const float *src, FLAC__int32 *dest, int count, int normalize) +f2flac16_clip_array (const float *src, int32_t *dest, int count, int normalize) { float normfact, scaled_value ; normfact = normalize ? (8.0 * 0x1000) : 1.0 ; @@ -1144,7 +1178,7 @@ } /* f2flac16_clip_array */ static void -f2flac24_clip_array (const float *src, FLAC__int32 *dest, int count, int normalize) +f2flac24_clip_array (const float *src, int32_t *dest, int count, int normalize) { float normfact, scaled_value ; normfact = normalize ? (8.0 * 0x100000) : 1.0 ; @@ -1167,7 +1201,7 @@ } /* f2flac24_clip_array */ static void -f2flac8_array (const float *src, FLAC__int32 *dest, int count, int normalize) +f2flac8_array (const float *src, int32_t *dest, int count, int normalize) { float normfact = normalize ? (1.0 * 0x7F) : 1.0 ; while (--count >= 0) @@ -1175,7 +1209,7 @@ } /* f2flac8_array */ static void -f2flac16_array (const float *src, FLAC__int32 *dest, int count, int normalize) +f2flac16_array (const float *src, int32_t *dest, int count, int normalize) { float normfact = normalize ? (1.0 * 0x7FFF) : 1.0 ; while (--count >= 0) @@ -1183,7 +1217,7 @@ } /* f2flac16_array */ static void -f2flac24_array (const float *src, FLAC__int32 *dest, int count, int normalize) +f2flac24_array (const float *src, int32_t *dest, int count, int normalize) { float normfact = normalize ? (1.0 * 0x7FFFFF) : 1.0 ; while (--count >= 0) @@ -1193,10 +1227,10 @@ static sf_count_t flac_write_d2flac (SF_PRIVATE *psf, const double *ptr, sf_count_t len) { FLAC_PRIVATE* pflac = (FLAC_PRIVATE*) psf->codec_data ; - void (*convert) (const double *, FLAC__int32 *, int, int) ; + void (*convert) (const double *, int32_t *, int, int) ; int bufferlen, writecount, thiswrite ; sf_count_t total = 0 ; - FLAC__int32* buffer = pflac->encbuffer ; + int32_t* buffer = pflac->encbuffer ; switch (SF_CODEC (psf->sf.format)) { case SF_FORMAT_PCM_S8 : @@ -1212,7 +1246,7 @@ return -1 ; } ; - bufferlen = ENC_BUFFER_SIZE / (sizeof (FLAC__int32) * psf->sf.channels) ; + bufferlen = ENC_BUFFER_SIZE / (sizeof (int32_t) * psf->sf.channels) ; bufferlen *= psf->sf.channels ; while (len > 0) @@ -1233,7 +1267,7 @@ } /* flac_write_d2flac */ static void -d2flac8_clip_array (const double *src, FLAC__int32 *dest, int count, int normalize) +d2flac8_clip_array (const double *src, int32_t *dest, int count, int normalize) { double normfact, scaled_value ; normfact = normalize ? (8.0 * 0x10) : 1.0 ; @@ -1255,7 +1289,7 @@ } /* d2flac8_clip_array */ static void -d2flac16_clip_array (const double *src, FLAC__int32 *dest, int count, int normalize) +d2flac16_clip_array (const double *src, int32_t *dest, int count, int normalize) { double normfact, scaled_value ; normfact = normalize ? (8.0 * 0x1000) : 1.0 ; @@ -1277,7 +1311,7 @@ } /* d2flac16_clip_array */ static void -d2flac24_clip_array (const double *src, FLAC__int32 *dest, int count, int normalize) +d2flac24_clip_array (const double *src, int32_t *dest, int count, int normalize) { double normfact, scaled_value ; normfact = normalize ? (8.0 * 0x100000) : 1.0 ; @@ -1299,7 +1333,7 @@ } /* d2flac24_clip_array */ static void -d2flac8_array (const double *src, FLAC__int32 *dest, int count, int normalize) +d2flac8_array (const double *src, int32_t *dest, int count, int normalize) { double normfact = normalize ? (1.0 * 0x7F) : 1.0 ; while (--count >= 0) @@ -1307,7 +1341,7 @@ } /* d2flac8_array */ static void -d2flac16_array (const double *src, FLAC__int32 *dest, int count, int normalize) +d2flac16_array (const double *src, int32_t *dest, int count, int normalize) { double normfact = normalize ? (1.0 * 0x7FFF) : 1.0 ; while (--count >= 0) @@ -1315,7 +1349,7 @@ } /* d2flac16_array */ static void -d2flac24_array (const double *src, FLAC__int32 *dest, int count, int normalize) +d2flac24_array (const double *src, int32_t *dest, int count, int normalize) { double normfact = normalize ? (1.0 * 0x7FFFFF) : 1.0 ; while (--count >= 0)