From: Mans Rullgard <mans@mansr.com>
To: sox-devel@lists.sourceforge.net
Subject: [PATCH] adpcm: fix stack overflow with >4 channels (CVE-2017-15372)
Date: Wed, 8 Nov 2017 00:29:14 +0000 [thread overview]
Message-ID: <20171108002914.782-1-mans@mansr.com> (raw)
In-Reply-To: <yw1xfu9p8wuw.fsf@mansr.com>
---
src/adpcm.c | 8 +++++++-
src/adpcm.h | 3 +++
src/wav.c | 5 ++++-
3 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/src/adpcm.c b/src/adpcm.c
index 2e13867e94b0..f64b7d5c2787 100644
--- a/src/adpcm.c
+++ b/src/adpcm.c
@@ -71,6 +71,11 @@ const short lsx_ms_adpcm_i_coef[7][2] = {
{ 392,-232}
};
+extern void *lsx_ms_adpcm_alloc(unsigned chans)
+{
+ return lsx_malloc(chans * sizeof(MsState_t));
+}
+
static inline sox_sample_t AdpcmDecode(sox_sample_t c, MsState_t *state,
sox_sample_t sample1, sox_sample_t sample2)
{
@@ -102,6 +107,7 @@ static inline sox_sample_t AdpcmDecode(sox_sample_t c, MsState_t *state,
/* lsx_ms_adpcm_block_expand_i() outputs interleaved samples into one output buffer */
const char *lsx_ms_adpcm_block_expand_i(
+ void *priv,
unsigned chans, /* total channels */
int nCoef,
const short *coef,
@@ -113,7 +119,7 @@ const char *lsx_ms_adpcm_block_expand_i(
const unsigned char *ip;
unsigned ch;
const char *errmsg = NULL;
- MsState_t state[4]; /* One decompressor state for each channel */
+ MsState_t *state = priv; /* One decompressor state for each channel */
/* Read the four-byte header for each channel */
ip = ibuff;
diff --git a/src/adpcm.h b/src/adpcm.h
index af4d6f08117d..db5cc6152196 100644
--- a/src/adpcm.h
+++ b/src/adpcm.h
@@ -29,8 +29,11 @@
/* default coef sets */
extern const short lsx_ms_adpcm_i_coef[7][2];
+extern void *lsx_ms_adpcm_alloc(unsigned chans);
+
/* lsx_ms_adpcm_block_expand_i() outputs interleaved samples into one output buffer */
extern const char *lsx_ms_adpcm_block_expand_i(
+ void *priv,
unsigned chans, /* total channels */
int nCoef,
const short *coef,
diff --git a/src/wav.c b/src/wav.c
index fad334cf56e9..066be6d7732d 100644
--- a/src/wav.c
+++ b/src/wav.c
@@ -82,6 +82,7 @@ typedef struct {
/* following used by *ADPCM wav files */
unsigned short nCoefs; /* ADPCM: number of coef sets */
short *lsx_ms_adpcm_i_coefs; /* ADPCM: coef sets */
+ void *ms_adpcm_data; /* Private data of adpcm decoder */
unsigned char *packet; /* Temporary buffer for packets */
short *samples; /* interleaved samples buffer */
short *samplePtr; /* Pointer to current sample */
@@ -175,7 +176,7 @@ static unsigned short AdpcmReadBlock(sox_format_t * ft)
}
}
- errmsg = lsx_ms_adpcm_block_expand_i(ft->signal.channels, wav->nCoefs, wav->lsx_ms_adpcm_i_coefs, wav->packet, wav->samples, samplesThisBlock);
+ errmsg = lsx_ms_adpcm_block_expand_i(wav->ms_adpcm_data, ft->signal.channels, wav->nCoefs, wav->lsx_ms_adpcm_i_coefs, wav->packet, wav->samples, samplesThisBlock);
if (errmsg)
lsx_warn("%s", errmsg);
@@ -791,6 +792,7 @@ static int startread(sox_format_t * ft)
/* nCoefs, lsx_ms_adpcm_i_coefs used by adpcm.c */
wav->lsx_ms_adpcm_i_coefs = lsx_malloc(wav->nCoefs * 2 * sizeof(short));
+ wav->ms_adpcm_data = lsx_ms_adpcm_alloc(wChannels);
{
int i, errct=0;
for (i=0; len>=2 && i < 2*wav->nCoefs; i++) {
@@ -1216,6 +1218,7 @@ static int stopread(sox_format_t * ft)
free(wav->packet);
free(wav->samples);
free(wav->lsx_ms_adpcm_i_coefs);
+ free(wav->ms_adpcm_data);
free(wav->comment);
wav->comment = NULL;
--
2.15.0
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
SoX-devel mailing list
SoX-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/sox-devel
next prev parent reply other threads:[~2017-11-08 0:29 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-04 9:46 sox debian package Jaromír Mikeš
2017-11-04 18:23 ` Eric Wong
2017-11-04 20:10 ` Måns Rullgård
2017-11-04 20:43 ` Jaromír Mikeš
2017-11-05 1:40 ` Jaromír Mikeš
2017-11-05 12:32 ` Måns Rullgård
2017-11-05 15:03 ` Jaromír Mikeš
2017-11-05 15:42 ` Måns Rullgård
2017-11-05 17:12 ` Måns Rullgård
2017-11-05 17:19 ` Jaromír Mikeš
2017-11-05 22:37 ` Jaromír Mikeš
2017-11-07 1:14 ` [PATCH] adpcm: fix stack overflow (CVE-2017-15372) Eric Wong
2017-11-07 9:26 ` Måns Rullgård
2017-11-07 9:41 ` Jaromír Mikeš
2017-11-07 9:53 ` Måns Rullgård
2017-11-07 17:54 ` Eric Wong
2017-11-07 18:12 ` Måns Rullgård
2017-11-07 23:37 ` Eric Wong
2017-11-07 23:38 ` [PATCH v2] " Eric Wong
2017-11-08 7:43 ` Hans Petter Selasky
2017-11-08 11:07 ` Måns Rullgård
2017-11-08 11:15 ` Hans Petter Selasky
2017-11-08 11:33 ` Måns Rullgård
2017-11-07 23:43 ` [PATCH] " Måns Rullgård
2017-11-07 23:55 ` Eric Wong
2017-11-07 23:58 ` Måns Rullgård
2017-11-08 0:29 ` Mans Rullgard [this message]
2017-11-08 0:42 ` [PATCH] adpcm: fix stack overflow with >4 channels (CVE-2017-15372) Eric Wong
2017-11-08 0:52 ` Måns Rullgård
2017-11-08 3:24 ` Eric Wong
2017-11-08 10:54 ` Måns Rullgård
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://lists.sourceforge.net/lists/listinfo/sox-devel
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171108002914.782-1-mans@mansr.com \
--to=sox-devel@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/sox.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).