From 054e68671bbe081092d7b2d38e5bf1451886d748 Mon Sep 17 00:00:00 2001 From: Michal Hlavinka Date: Wed, 11 Aug 2021 15:08:47 +0200 Subject: [PATCH] a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985029) Resolves: #1985029 --- libsndfile-1.0.31-deb669ee.patch | 21 +++++++++++++++++++++ libsndfile.spec | 8 +++++++- 2 files changed, 28 insertions(+), 1 deletion(-) create mode 100644 libsndfile-1.0.31-deb669ee.patch diff --git a/libsndfile-1.0.31-deb669ee.patch b/libsndfile-1.0.31-deb669ee.patch new file mode 100644 index 0000000..06c89b4 --- /dev/null +++ b/libsndfile-1.0.31-deb669ee.patch @@ -0,0 +1,21 @@ +diff --git a/src/ms_adpcm.c b/src/ms_adpcm.c +index 5e8f1a31..a21cb994 100644 +--- a/src/ms_adpcm.c ++++ b/src/ms_adpcm.c +@@ -128,8 +128,14 @@ wavlike_msadpcm_init (SF_PRIVATE *psf, int blockalign, int samplesperblock) + if (psf->file.mode == SFM_WRITE) + samplesperblock = 2 + 2 * (blockalign - 7 * psf->sf.channels) / psf->sf.channels ; + +- if (blockalign < 7 * psf->sf.channels) +- { psf_log_printf (psf, "*** Error blockalign (%d) should be > %d.\n", blockalign, 7 * psf->sf.channels) ; ++ /* There's 7 samples per channel in the preamble of each block */ ++ if (samplesperblock < 7 * psf->sf.channels) ++ { psf_log_printf (psf, "*** Error samplesperblock (%d) should be >= %d.\n", samplesperblock, 7 * psf->sf.channels) ; ++ return SFE_INTERNAL ; ++ } ; ++ ++ if (2 * blockalign < samplesperblock * psf->sf.channels) ++ { psf_log_printf (psf, "*** Error blockalign (%d) should be >= %d.\n", blockalign, samplesperblock * psf->sf.channels / 2) ; + return SFE_INTERNAL ; + } ; + diff --git a/libsndfile.spec b/libsndfile.spec index ff96ac4..51f4304 100644 --- a/libsndfile.spec +++ b/libsndfile.spec @@ -1,12 +1,14 @@ Summary: Library for reading and writing sound files Name: libsndfile Version: 1.0.31 -Release: 5%{?dist} +Release: 6%{?dist} License: LGPLv2+ and GPLv2+ and BSD URL: http://libsndfile.github.io/libsndfile/ Source0: https://github.com/libsndfile/libsndfile/releases/download/%{version}/libsndfile-%{version}.tar.bz2 Patch0: libsndfile-1.0.25-system-gsm.patch Patch1: libsndfile-1.0.25-zerodivfix.patch +# from upstream, for <= 1.0.31, rhbz#1985029 +Patch2: libsndfile-1.0.31-deb669ee.patch BuildRequires: gcc-c++ BuildRequires: alsa-lib-devel BuildRequires: flac-devel @@ -58,6 +60,7 @@ This package contains command line utilities for libsndfile. rm -r src/GSM610 # TODO: check if this patch is still needed %patch1 -p1 -b .zerodivfix +%patch2 -p1 -b .deb669ee %build autoreconf -I M4 -fiv # for system-gsm patch @@ -149,6 +152,9 @@ LD_LIBRARY_PATH=$PWD/src/.libs make check %changelog +* Wed Aug 11 2021 Michal Hlavinka - 1.0.31-6 +- a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985029) + * Mon Aug 09 2021 Mohan Boddu - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688