1
0
Fork 0
mirror of https://gitlab.alpinelinux.org/alpine/aports.git synced 2025-07-21 02:05:16 +03:00
aports/community/sox/fix-regression-in-CVE-2017-11358.patch

36 lines
1.8 KiB
Diff

From: Helmut Grohne <helmut@subdivi.de>
Subject: hcom: fix parsing of valid huffman dictionaries
Bug-Debian: https://bugs.debian.org/933372
This is a regression update for the fix applied for CVE-2017-11358.
--- a/src/hcom.c
+++ b/src/hcom.c
@@ -150,11 +150,24 @@
lsx_debug("%d %d",
p->dictionary[i].dict_leftson,
p->dictionary[i].dict_rightson);
- if ((unsigned) p->dictionary[i].dict_leftson >= dictsize ||
- (unsigned) p->dictionary[i].dict_rightson >= dictsize) {
+ if (p->dictionary[i].dict_leftson < 0) {
+ if (i == 0) {
+ free(p->dictionary);
+ p->dictionary = NULL;
+ lsx_fail_errno(ft, SOX_EHDR, "Invalid dictionary: root node is leaf");
+ return SOX_EOF;
+ }
+ if ((unsigned)p->dictionary[i].dict_rightson > 0xff) {
+ free(p->dictionary);
+ p->dictionary = NULL;
+ lsx_fail_errno(ft, SOX_EHDR, "Invalid dictionary: invalid leaf value");
+ return SOX_EOF;
+ }
+ } else if ((unsigned) p->dictionary[i].dict_leftson >= dictsize ||
+ (unsigned) p->dictionary[i].dict_rightson >= dictsize) {
free(p->dictionary);
p->dictionary = NULL;
- lsx_fail_errno(ft, SOX_EHDR, "Invalid dictionary");
+ lsx_fail_errno(ft, SOX_EHDR, "Invalid dictionary: invalid branch node");
return SOX_EOF;
}
}