jcgruenhage/void-packages
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

audiofile: fix a lot of CVEs, enable flac, remove unused dependency

Browse source 
- Enable flac by adding libflac-devel to makedepends
- remove dependency gtk+-devel, wasn't used at any point (added by
error?)
- CVEs fixes:
    CVE-2017-6827
    CVE-2017-6828
    CVE-2017-6829
    CVE-2017-6830
    CVE-2017-6831
    CVE-2017-6832
    CVE-2017-6833
    CVE-2017-6834
    CVE-2017-6835
    CVE-2017-6836
    CVE-2017-6837
    CVE-2017-6838
    CVE-2017-6839
This commit is contained in:
maxice8 2018-10-03 18:00:01 -03:00 committed by maxice8
parent 5ce24e6bd9
commit dee932c8f1
6 changed files with 293 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
srcpkgs/audiofile/patches/004-CVE-2017-6829.patch Normal file
View file

@ -0,0 +1,33 @@
From: Antonio Larrosa <larrosa@kde.org>
Date: Mon, 6 Mar 2017 18:02:31 +0100
Subject: clamp index values to fix index overflow in IMA.cpp
This fixes #33
(also reported at https://bugzilla.opensuse.org/show_bug.cgi?id=1026981
and https://blogs.gentoo.org/ago/2017/02/20/audiofile-global-buffer-overflow-in-decodesample-ima-cpp/)
---
libaudiofile/modules/IMA.cpp | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libaudiofile/modules/IMA.cpp b/libaudiofile/modules/IMA.cpp
index 7476d44..df4aad6 100644
--- libaudiofile/modules/IMA.cpp
+++ libaudiofile/modules/IMA.cpp
@@ -169,7 +169,7 @@ int IMA::decodeBlockWAVE(const uint8_t *encoded, int16_t *decoded)
if (encoded[1] & 0x80)
m_adpcmState[c].previousValue -= 0x10000;
- m_adpcmState[c].index = encoded[2];
+ m_adpcmState[c].index = clamp(encoded[2], 0, 88);
*decoded++ = m_adpcmState[c].previousValue;
@@ -210,7 +210,7 @@ int IMA::decodeBlockQT(const uint8_t *encoded, int16_t *decoded)
predictor -= 0x10000;
state.previousValue = clamp(predictor, MIN_INT16, MAX_INT16);
- state.index = encoded[1] & 0x7f;
+ state.index = clamp(encoded[1] & 0x7f, 0, 88);
encoded += 2;
for (int n=0; n<m_framesPerPacket; n+=2)

30
srcpkgs/audiofile/patches/005-CVE-2017-6827-CVE-2017-6828-CVE-2017-6832-CVE-2017-6833-CVE-2017-6835-CVE-2017-6837.patch Normal file
View file

@ -0,0 +1,30 @@
From: Antonio Larrosa <larrosa@kde.org>
Date: Mon, 6 Mar 2017 12:51:22 +0100
Subject: Always check the number of coefficients
When building the library with NDEBUG, asserts are eliminated
so it's better to always check that the number of coefficients
is inside the array range.
This fixes the 00191-audiofile-indexoob issue in #41
---
libaudiofile/WAVE.cpp | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libaudiofile/WAVE.cpp b/libaudiofile/WAVE.cpp
index 9dd8511..0fc48e8 100644
--- libaudiofile/WAVE.cpp
+++ libaudiofile/WAVE.cpp
@@ -281,6 +281,12 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
/* numCoefficients should be at least 7. */
assert(numCoefficients >= 7 && numCoefficients <= 255);
+ if (numCoefficients < 7 || numCoefficients > 255)
+ {
+ _af_error(AF_BAD_HEADER,
+ "Bad number of coefficients");
+ return AF_FAIL;
+ }
m_msadpcmNumCoefficients = numCoefficients;

116
srcpkgs/audiofile/patches/006-CVE-2017-6839.patch Normal file
View file

@ -0,0 +1,116 @@
From: Antonio Larrosa <larrosa@kde.org>
Date: Mon, 6 Mar 2017 13:43:53 +0100
Subject: Check for multiplication overflow in MSADPCM decodeSample
Check for multiplication overflow (using __builtin_mul_overflow
if available) in MSADPCM.cpp decodeSample and return an empty
decoded block if an error occurs.
This fixes the 00193-audiofile-signintoverflow-MSADPCM case of #41
---
libaudiofile/modules/BlockCodec.cpp | 5 ++--
libaudiofile/modules/MSADPCM.cpp | 47 +++++++++++++++++++++++++++++++++----
2 files changed, 46 insertions(+), 6 deletions(-)
diff --git a/libaudiofile/modules/BlockCodec.cpp b/libaudiofile/modules/BlockCodec.cpp
index 45925e8..4731be1 100644
--- libaudiofile/modules/BlockCodec.cpp
+++ libaudiofile/modules/BlockCodec.cpp
@@ -52,8 +52,9 @@ void BlockCodec::runPull()
// Decompress into m_outChunk.
for (int i=0; i<blocksRead; i++)
{
- decodeBlock(static_cast<const uint8_t *>(m_inChunk->buffer) + i * m_bytesPerPacket,
- static_cast<int16_t *>(m_outChunk->buffer) + i * m_framesPerPacket * m_track->f.channelCount);
+ if (decodeBlock(static_cast<const uint8_t *>(m_inChunk->buffer) + i * m_bytesPerPacket,
+ static_cast<int16_t *>(m_outChunk->buffer) + i * m_framesPerPacket * m_track->f.channelCount)==0)
+ break;
framesRead += m_framesPerPacket;
}
diff --git a/libaudiofile/modules/MSADPCM.cpp b/libaudiofile/modules/MSADPCM.cpp
index 8ea3c85..ef9c38c 100644
--- libaudiofile/modules/MSADPCM.cpp
+++ libaudiofile/modules/MSADPCM.cpp
@@ -101,24 +101,60 @@ static const int16_t adaptationTable[] =
768, 614, 512, 409, 307, 230, 230, 230
};
+int firstBitSet(int x)
+{
+ int position=0;
+ while (x!=0)
+ {
+ x>>=1;
+ ++position;
+ }
+ return position;
+}
+
+#ifndef __has_builtin
+#define __has_builtin(x) 0
+#endif
+
+int multiplyCheckOverflow(int a, int b, int *result)
+{
+#if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow))
+ return __builtin_mul_overflow(a, b, result);
+#else
+ if (firstBitSet(a)+firstBitSet(b)>31) // int is signed, so we can't use 32 bits
+ return true;
+ *result = a * b;
+ return false;
+#endif
+}
+
+
// Compute a linear PCM value from the given differential coded value.
static int16_t decodeSample(ms_adpcm_state &state,
- uint8_t code, const int16_t *coefficient)
+ uint8_t code, const int16_t *coefficient, bool *ok=NULL)
{
int linearSample = (state.sample1 * coefficient[0] +
state.sample2 * coefficient[1]) >> 8;
+ int delta;
linearSample += ((code & 0x08) ? (code - 0x10) : code) * state.delta;
linearSample = clamp(linearSample, MIN_INT16, MAX_INT16);
- int delta = (state.delta * adaptationTable[code]) >> 8;
+ if (multiplyCheckOverflow(state.delta, adaptationTable[code], &delta))
+ {
+ if (ok) *ok=false;
+ _af_error(AF_BAD_COMPRESSION, "Error decoding sample");
+ return 0;
+ }
+ delta >>= 8;
if (delta < 16)
delta = 16;
state.delta = delta;
state.sample2 = state.sample1;
state.sample1 = linearSample;
+ if (ok) *ok=true;
return static_cast<int16_t>(linearSample);
}
@@ -212,13 +248,16 @@ int MSADPCM::decodeBlock(const uint8_t *encoded, int16_t *decoded)
{
uint8_t code;
int16_t newSample;
+ bool ok;
code = *encoded >> 4;
- newSample = decodeSample(*state[0], code, coefficient[0]);
+ newSample = decodeSample(*state[0], code, coefficient[0], &ok);
+ if (!ok) return 0;
*decoded++ = newSample;
code = *encoded & 0x0f;
- newSample = decodeSample(*state[1], code, coefficient[1]);
+ newSample = decodeSample(*state[1], code, coefficient[1], &ok);
+ if (!ok) return 0;
*decoded++ = newSample;
encoded++;

66
srcpkgs/audiofile/patches/007-CVE-2017-6830-CVE-2017-6834-CVE-2017-6836-CVE-2017-6838.patch Normal file
View file

@ -0,0 +1,66 @@
From: Antonio Larrosa <larrosa@kde.org>
Date: Mon, 6 Mar 2017 13:54:52 +0100
Subject: Check for multiplication overflow in sfconvert
Checks that a multiplication doesn't overflow when
calculating the buffer size, and if it overflows,
reduce the buffer size instead of failing.
This fixes the 00192-audiofile-signintoverflow-sfconvert case
in #41
---
sfcommands/sfconvert.c | 34 ++++++++++++++++++++++++++++++++--
1 file changed, 32 insertions(+), 2 deletions(-)
diff --git a/sfcommands/sfconvert.c b/sfcommands/sfconvert.c
index 80a1bc4..970a3e4 100644
--- sfcommands/sfconvert.c
+++ sfcommands/sfconvert.c
@@ -45,6 +45,33 @@ void printusage (void);
void usageerror (void);
bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid);
+int firstBitSet(int x)
+{
+ int position=0;
+ while (x!=0)
+ {
+ x>>=1;
+ ++position;
+ }
+ return position;
+}
+
+#ifndef __has_builtin
+#define __has_builtin(x) 0
+#endif
+
+int multiplyCheckOverflow(int a, int b, int *result)
+{
+#if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow))
+ return __builtin_mul_overflow(a, b, result);
+#else
+ if (firstBitSet(a)+firstBitSet(b)>31) // int is signed, so we can't use 32 bits
+ return true;
+ *result = a * b;
+ return false;
+#endif
+}
+
int main (int argc, char **argv)
{
if (argc == 2)
@@ -323,8 +350,11 @@ bool copyaudiodata (AFfilehandle infile, AFfilehandle outfile, int trackid)
{
int frameSize = afGetVirtualFrameSize(infile, trackid, 1);
- const int kBufferFrameCount = 65536;
- void *buffer = malloc(kBufferFrameCount * frameSize);
+ int kBufferFrameCount = 65536;
+ int bufferSize;
+ while (multiplyCheckOverflow(kBufferFrameCount, frameSize, &bufferSize))
+ kBufferFrameCount /= 2;
+ void *buffer = malloc(bufferSize);
AFframecount totalFrames = afGetFrameCount(infile, AF_DEFAULT_TRACK);
AFframecount totalFramesWritten = 0;

36
srcpkgs/audiofile/patches/009-CVE-2017-6831.patch Normal file
View file

@ -0,0 +1,36 @@
From: Antonio Larrosa <larrosa@kde.org>
Date: Mon, 6 Mar 2017 18:59:26 +0100
Subject: Actually fail when error occurs in parseFormat
When there's an unsupported number of bits per sample or an invalid
number of samples per block, don't only print an error message using
the error handler, but actually stop parsing the file.
This fixes #35 (also reported at
https://bugzilla.opensuse.org/show_bug.cgi?id=1026983 and
https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-imadecodeblockwave-ima-cpp/
)
---
libaudiofile/WAVE.cpp | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libaudiofile/WAVE.cpp b/libaudiofile/WAVE.cpp
index 0fc48e8..d04b796 100644
--- libaudiofile/WAVE.cpp
+++ libaudiofile/WAVE.cpp
@@ -332,6 +332,7 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
{
_af_error(AF_BAD_NOT_IMPLEMENTED,
"IMA ADPCM compression supports only 4 bits per sample");
+ return AF_FAIL;
}
int bytesPerBlock = (samplesPerBlock + 14) / 8 * 4 * channelCount;
@@ -339,6 +340,7 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
{
_af_error(AF_BAD_CODEC_CONFIG,
"Invalid samples per block for IMA ADPCM compression");
+ return AF_FAIL;
}
track->f.sampleWidth = 16;

24
srcpkgs/audiofile/template
View file

@ -1,31 +1,31 @@
# Template file for 'audiofile'
pkgname=audiofile
version=0.3.6
revision=2
wrksrc=$pkgname-$pkgname-$version
revision=3
wrksrc="$pkgname-$pkgname-$version"
build_style=gnu-configure
hostmakedepends="automake libtool asciidoc pkg-config"
makedepends="gtk+-devel alsa-lib-devel"
makedepends="alsa-lib-devel libflac-devel"
short_desc="C library for reading and writing audio files"
maintainer="Michael Aldridge <maldridge@VoidLinux.eu>"
license="LGPL-2.1"
license="LGPL-2.1-or-later"
homepage="http://audiofile.68k.org"
disable_parallel_build=1
distfiles="http://github.com/mpruett/audiofile/archive/audiofile-$version.tar.gz"
distfiles="http://github.com/mpruett/audiofile/archive/audiofile-${version}.tar.gz"
checksum=52125fee6c7454d743acdc27ebda194c6b5c7b9111426c7d5fdea0754cd366cc
disable_parallel_build=1
pre_configure() {
./autogen.sh
autoreconf -fi
}
audiofile-devel_package() {
short_desc+=" - development files"
depends="audiofile>=${version}_${revision}"
pkg_install() {
vmove usr/lib/*.so
vmove usr/lib/*.a
vmove usr/lib/pkgconfig/
vmove usr/include/
vmove usr/share/man/man3/
vmove "usr/lib/*.so"
vmove "usr/lib/*.a"
vmove usr/lib/pkgconfig
vmove usr/include
vmove usr/share/man/man3
}
}