Bug 1726067 (CVE-2019-13147) - CVE-2019-13147 audiofile: a NULL pointer dereference in ulaw2linear_buf in G711.cpp in libmodules.a leading to DoS
Summary: CVE-2019-13147 audiofile: a NULL pointer dereference in ulaw2linear_buf in G7...
Status: CLOSED DUPLICATE of bug 1432943
Alias: CVE-2019-13147
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1726068
Blocks: 1726080
TreeView+ depends on / blocked
Reported: 2019-07-02 07:24 UTC by Marian Rehak
Modified: 2021-02-16 21:47 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2020-03-05 14:28:58 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github mpruett audiofile issues 54 0 None open NULL pointer dereference bug in ulaw2linear_buf, in G711.cpp 2020-03-05 14:29:28 UTC

Description Marian Rehak 2019-07-02 07:24:14 UTC
In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.

Upstream Issue:


Comment 1 Marian Rehak 2019-07-02 07:24:24 UTC
Created audiofile tracking bugs for this issue:

Affects: fedora-all [bug 1726068]

Comment 2 Agostino Sarubbo 2019-07-02 13:23:33 UTC
This may be a duplicate of the existing bugs about ulaw2linear_buf

Comment 3 Stefan Cornelius 2020-03-05 14:02:25 UTC
There is an integer overflow within the copyaudiodata() function in sfcommands/sfconvert.c when multiplying malloc(kBufferFrameCount * frameSize);

Combined with making frameSize unsigned, this fixes crashes for

Further issues in the code:

The ModuleState::setup() function in modules/ModuleState.cpp has integer overflows when multiplying
int bufsize = outChunk->frameCount * outChunk->f.bytesPerFrame(true);

and further down
int bufsize = inChunk->frameCount * inChunk->f.bytesPerFrame(true);

It's probably also a good idea to use unsigned types for bufsize and maxbufsize.

The copyaudiodata() function in sfcommands/sfconvert.c also fails to check for the success of malloc(), causing some of the NULL ptr dereferences seen. Module chunk allocation could possibly need checks, too.

Comment 4 Stefan Cornelius 2020-03-05 14:28:58 UTC

*** This bug has been marked as a duplicate of bug 1432943 ***

Comment 5 Doran Moppert 2020-06-17 03:21:50 UTC

This flaw was found to be a duplicate of CVE-2017-6838. Please see https://access.redhat.com/security/cve/CVE-2017-6838 for information about affected products and security errata.

Note You need to log in before you can comment on or make changes to this bug.