Bug 1677216 (CVE-2019-3832) - CVE-2019-3832 libsndfile: incomplete fix for CVE-2018-19758 still allow to read beyond buffer limits
Summary: CVE-2019-3832 libsndfile: incomplete fix for CVE-2018-19758 still allow to re...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-3832
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1677219 1677220 1677221
Blocks: 1677222
TreeView+ depends on / blocked
 
Reported: 2019-02-14 10:01 UTC by Riccardo Schirone
Modified: 2021-10-27 03:24 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: ---
Doc Text:
It was discovered the fix for CVE-2018-19758 was not complete and still allows a read beyond the limits of a buffer in wav_write_header() function in wav.c. A local attacker may use this flaw to make the application crash.
Clone Of:
Environment:
Last Closed: 2021-10-27 03:24:18 UTC
Embargoed:

Attachments (Terms of Use)

Description Riccardo Schirone 2019-02-14 10:01:18 UTC 
It was discovered the fix for CVE-2018-19758 is not complete and it still allows to read beyond the limit of the buffer in function wav_write_header() in wav.c. Function wav_write_header() iterates through the `loops` array for an amount of times read from the file itself. However, this value is not correctly checked and the library can read beyond the limits of the `loops` array, possibly making the application crash.

Upstream issue:
https://github.com/erikd/libsndfile/issues/456#issuecomment-463542436
Comment 1 Riccardo Schirone 2019-02-14 10:01:21 UTC 
Acknowledgments:

Name: Riccardo Schirone (Red Hat)
Comment 2 Riccardo Schirone 2019-02-14 10:02:46 UTC 
Created libsndfile tracking bugs for this issue:

Affects: fedora-all [bug 1677219]
Comment 7 Riccardo Schirone 2019-03-05 11:09:35 UTC 
A PR has been submitted upstream to fix this issue: https://github.com/erikd/libsndfile/pull/460
Comment 8 Riccardo Schirone 2019-03-07 07:50:45 UTC 
Upstream patch:
https://github.com/erikd/libsndfile/commit/6d7ce94c020cc720a6b28719d1a7879181790008
Note You need to log in before you can comment on or make changes to this bug.