diff options
Diffstat (limited to 'meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065.patch')
-rw-r--r-- | meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065.patch | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065.patch new file mode 100644 index 0000000000..e22b4e9389 --- /dev/null +++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065.patch | |||
@@ -0,0 +1,46 @@ | |||
1 | From 0754562e13d2e63a248a1c82f90b30bc0ffe307c Mon Sep 17 00:00:00 2001 | ||
2 | From: Alex Stewart <alex.stewart@ni.com> | ||
3 | Date: Tue, 10 Oct 2023 16:10:34 -0400 | ||
4 | Subject: [PATCH] mat4/mat5: fix int overflow in dataend calculation | ||
5 | |||
6 | The clang sanitizer warns of a possible signed integer overflow when | ||
7 | calculating the `dataend` value in `mat4_read_header()`. | ||
8 | |||
9 | ``` | ||
10 | src/mat4.c:323:41: runtime error: signed integer overflow: 205 * -100663296 cannot be represented in type 'int' | ||
11 | SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:41 in | ||
12 | src/mat4.c:323:48: runtime error: signed integer overflow: 838860800 * 4 cannot be represented in type 'int' | ||
13 | SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:48 in | ||
14 | ``` | ||
15 | |||
16 | Cast the offending `rows` and `cols` ints to `sf_count_t` (the type of | ||
17 | `dataend` before performing the calculation, to avoid the issue. | ||
18 | |||
19 | CVE: CVE-2022-33065 | ||
20 | Fixes: https://github.com/libsndfile/libsndfile/issues/789 | ||
21 | Fixes: https://github.com/libsndfile/libsndfile/issues/833 | ||
22 | |||
23 | Signed-off-by: Alex Stewart <alex.stewart@ni.com> | ||
24 | |||
25 | Upstream-Status: Backport [https://github.com/libsndfile/libsndfile/commit/0754562e13d2e63a248a1c82f90b30bc0ffe307c] | ||
26 | CVE: CVE-2022-33065 | ||
27 | Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> | ||
28 | --- | ||
29 | src/mat4.c | 2 +- | ||
30 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
31 | |||
32 | diff --git a/src/mat4.c b/src/mat4.c | ||
33 | index 3c73680..e2f98b7 100644 | ||
34 | --- a/src/mat4.c | ||
35 | +++ b/src/mat4.c | ||
36 | @@ -320,7 +320,7 @@ mat4_read_header (SF_PRIVATE *psf) | ||
37 | psf->filelength - psf->dataoffset, psf->sf.channels * psf->sf.frames * psf->bytewidth) ; | ||
38 | } | ||
39 | else if ((psf->filelength - psf->dataoffset) > psf->sf.channels * psf->sf.frames * psf->bytewidth) | ||
40 | - psf->dataend = psf->dataoffset + rows * cols * psf->bytewidth ; | ||
41 | + psf->dataend = psf->dataoffset + (sf_count_t) rows * (sf_count_t) cols * psf->bytewidth ; | ||
42 | |||
43 | psf->datalength = psf->filelength - psf->dataoffset - psf->dataend ; | ||
44 | |||
45 | -- | ||
46 | 2.40.1 | ||