Attachment 512812 Details for Bug 721234 – Promised local copy of upstream patch

Promised local copy of upstream patch

SASA45125_revno1609_1610.diff (text/plain), 1.92 KB, created by Jan Lieskovsky on 2011-07-14 06:29:16 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jan Lieskovsky

Created: 2011-07-14 06:29:16 UTC

Size: 1.92 KB

patch

obsolete

>=== modified file 'ChangeLog'
>--- ChangeLog	2011-07-06 09:28:50 +0000
>+++ ChangeLog	2011-07-06 09:40:05 +0000
>@@ -3,6 +3,10 @@
>     * src/common.h src/sndfile.c
>     Purge SF_ASSERT macro. Use standard C assert instead.
> 
>+    * src/paf.c src/common.h src/sndfile.c
>+    Fix for Secunia Advisory SA45125, heap overflow (heap gets overwritten with
>+    byte value of 0) due to integer overflow if PAF file handler.
>+
> 2011-07-05  Erik de Castro Lopo  <erikd AT mega-nerd DOT com>
> 
>     * src/ogg.c
>
>=== modified file 'src/common.h'
>--- src/common.h	2011-07-06 09:28:50 +0000
>+++ src/common.h	2011-07-06 09:40:05 +0000
>@@ -552,6 +552,7 @@
> 	SFE_PAF_VERSION,
> 	SFE_PAF_UNKNOWN_FORMAT,
> 	SFE_PAF_SHORT_HEADER,
>+	SFE_PAF_BAD_CHANNELS,
> 
> 	SFE_SVX_NO_FORM,
> 	SFE_SVX_NO_BODY,
>
>=== modified file 'src/paf.c'
>--- src/paf.c	2011-01-19 10:36:56 +0000
>+++ src/paf.c	2011-07-06 09:40:05 +0000
>@@ -163,6 +163,9 @@
> {	PAF_FMT		paf_fmt ;
> 	int			marker ;
> 
>+	if (psf->filelength < PAF_HEADER_LENGTH)
>+		return SFE_PAF_SHORT_HEADER ;
>+
> 	memset (&paf_fmt, 0, sizeof (paf_fmt)) ;
> 	psf_binheader_readf (psf, "pm", 0, &marker) ;
> 
>@@ -199,8 +202,8 @@
> 		psf->endian = SF_ENDIAN_BIG ;
> 		} ;
> 
>-	if (psf->filelength < PAF_HEADER_LENGTH)
>-		return SFE_PAF_SHORT_HEADER ;
>+	if (paf_fmt.channels > SF_MAX_CHANNELS)
>+		return SFE_PAF_BAD_CHANNELS ;
> 
> 	psf->datalength = psf->filelength - psf->dataoffset ;
> 
>
>=== modified file 'src/sndfile.c'
>--- src/sndfile.c	2011-07-06 09:28:50 +0000
>+++ src/sndfile.c	2011-07-06 09:40:05 +0000
>@@ -174,6 +174,7 @@
> 	{	SFE_PAF_VERSION			, "Error in PAF file, bad version." },
> 	{	SFE_PAF_UNKNOWN_FORMAT	, "Error in PAF file, unknown format." },
> 	{	SFE_PAF_SHORT_HEADER	, "Error in PAF file. File shorter than minimal header." },
>+	{	SFE_PAF_BAD_CHANNELS	, "Error in PAF file. Bad channel count." },
> 
> 	{	SFE_SVX_NO_FORM			, "Error in 8SVX / 16SV file, no 'FORM' marker." },
> 	{	SFE_SVX_NO_BODY			, "Error in 8SVX / 16SV file, no 'BODY' marker." },
>

Actions: View

Attachments on bug 721234: 512812