Will Drewry of the Google Security Team created a set of fuzzed OGG test files to test OGG Vorbis and Tremor implementations. Some of them were causing memory corruption and crash on old libvorbis versions (prior to 1.0). Crash / corruption occurred in _make_decode_tree(). This function was removed prior to the release of upstream version 1.0 in following changes: https://trac.xiph.org/changeset/2959 https://trac.xiph.org/changeset/2960 Test files do not crash libvobis revision 2960 or later.
Created attachment 303976 [details] Patch from Monty (xiphmont) Patch adds _check_words, a dry-run variant of _make_words, that does performs huffman tree validation early in the stream decoding.
Similar additional checks were committed to libvorbis trunk to reject underpopulated Huffman trees early in the file parsing: https://trac.xiph.org/changeset/14811
Lifting embargo.
This issue was addressed in: Red Hat Enterprise Linux: http://rhn.redhat.com/errata/RHSA-2008-0271.html