Bug 1726067 (CVE-2019-13147)

Summary:	CVE-2019-13147 audiofile: a NULL pointer dereference in ulaw2linear_buf in G711.cpp in libmodules.a leading to DoS
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ajax, caillon+fedoraproject, gnome-sig, gwync, john.j5live, mclasen, rhughes, rstrode, sandmann, scorneli, wtaymans
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-05 14:28:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1726068
Bug Blocks:	1726080

Description Marian Rehak 2019-07-02 07:24:14 UTC

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.

Upstream Issue:

https://github.com/mpruett/audiofile/issues/54

Comment 1 Marian Rehak 2019-07-02 07:24:24 UTC

Created audiofile tracking bugs for this issue:

Affects: fedora-all [bug 1726068]

Comment 2 Agostino Sarubbo 2019-07-02 13:23:33 UTC

This may be a duplicate of the existing bugs about ulaw2linear_buf
https://github.com/mpruett/audiofile/issues?utf8=%E2%9C%93&q=ulaw2linear_buf

Comment 3 Stefan Cornelius 2020-03-05 14:02:25 UTC

There is an integer overflow within the copyaudiodata() function in sfcommands/sfconvert.c when multiplying malloc(kBufferFrameCount * frameSize);

Combined with making frameSize unsigned, this fixes crashes for
https://github.com/mpruett/audiofile/issues/54
https://github.com/mpruett/audiofile/issues/46
https://github.com/mpruett/audiofile/issues/38

Further issues in the code:

The ModuleState::setup() function in modules/ModuleState.cpp has integer overflows when multiplying
int bufsize = outChunk->frameCount * outChunk->f.bytesPerFrame(true);

and further down
int bufsize = inChunk->frameCount * inChunk->f.bytesPerFrame(true);

It's probably also a good idea to use unsigned types for bufsize and maxbufsize.

The copyaudiodata() function in sfcommands/sfconvert.c also fails to check for the success of malloc(), causing some of the NULL ptr dereferences seen. Module chunk allocation could possibly need checks, too.

Comment 4 Stefan Cornelius 2020-03-05 14:28:58 UTC


*** This bug has been marked as a duplicate of bug 1432943 ***

Comment 5 Doran Moppert 2020-06-17 03:21:50 UTC

Statement:

This flaw was found to be a duplicate of CVE-2017-6838. Please see https://access.redhat.com/security/cve/CVE-2017-6838 for information about affected products and security errata.