From 2d54514a4f6437b67829717c05472d2e3300a258 Mon Sep 17 00:00:00 2001 From: Fabian Greffrath Date: Wed, 27 Sep 2017 14:46:17 +0200 Subject: [PATCH] sfe_copy_data_fp: check value of "max" variable for being normal and check elements of the data[] array for being finite. Both checks use functions provided by the header as declared by the C99 standard. Fixes #317 CVE: CVE-2017-14245 CVE: CVE-2017-14246 Upstream-Status: Backport [https://github.com/fabiangreffrath/libsndfile/commit/2d54514a4f6437b67829717c05472d2e3300a258] Signed-off-by: Fabian Greffrath Signed-off-by: Jagadeesh Krishnanjanappa --- programs/common.c | 20 ++++++++++++++++---- programs/common.h | 2 +- programs/sndfile-convert.c | 6 +++++- 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/programs/common.c b/programs/common.c index a21e62c..a249a58 100644 --- a/programs/common.c +++ b/programs/common.c @@ -36,6 +36,7 @@ #include #include #include +#include #include @@ -45,7 +46,7 @@ #define MIN(x, y) ((x) < (y) ? (x) : (y)) -void +int sfe_copy_data_fp (SNDFILE *outfile, SNDFILE *infile, int channels, int normalize) { static double data [BUFFER_LEN], max ; int frames, readcount, k ; @@ -54,6 +55,8 @@ sfe_copy_data_fp (SNDFILE *outfile, SNDFILE *infile, int channels, int normalize readcount = frames ; sf_command (infile, SFC_CALC_SIGNAL_MAX, &max, sizeof (max)) ; + if (!isnormal (max)) /* neither zero, subnormal, infinite, nor NaN */ + return 1 ; if (!normalize && max < 1.0) { while (readcount > 0) @@ -67,12 +70,16 @@ sfe_copy_data_fp (SNDFILE *outfile, SNDFILE *infile, int channels, int normalize while (readcount > 0) { readcount = sf_readf_double (infile, data, frames) ; for (k = 0 ; k < readcount * channels ; k++) - data [k] /= max ; + { data [k] /= max ; + + if (!isfinite (data [k])) /* infinite or NaN */ + return 1; + } sf_writef_double (outfile, data, readcount) ; } ; } ; - return ; + return 0 ; } /* sfe_copy_data_fp */ void @@ -252,7 +259,12 @@ sfe_apply_metadata_changes (const char * filenames [2], const METADATA_INFO * in /* If the input file is not the same as the output file, copy the data. */ if ((infileminor == SF_FORMAT_DOUBLE) || (infileminor == SF_FORMAT_FLOAT)) - sfe_copy_data_fp (outfile, infile, sfinfo.channels, SF_FALSE) ; + { if (sfe_copy_data_fp (outfile, infile, sfinfo.channels, SF_FALSE) != 0) + { printf ("Error : Not able to decode input file '%s'\n", filenames [0]) ; + error_code = 1 ; + goto cleanup_exit ; + } ; + } else sfe_copy_data_int (outfile, infile, sfinfo.channels) ; } ; diff --git a/programs/common.h b/programs/common.h index eda2d7d..986277e 100644 --- a/programs/common.h +++ b/programs/common.h @@ -62,7 +62,7 @@ typedef SF_BROADCAST_INFO_VAR (2048) SF_BROADCAST_INFO_2K ; void sfe_apply_metadata_changes (const char * filenames [2], const METADATA_INFO * info) ; -void sfe_copy_data_fp (SNDFILE *outfile, SNDFILE *infile, int channels, int normalize) ; +int sfe_copy_data_fp (SNDFILE *outfile, SNDFILE *infile, int channels, int normalize) ; void sfe_copy_data_int (SNDFILE *outfile, SNDFILE *infile, int channels) ; diff --git a/programs/sndfile-convert.c b/programs/sndfile-convert.c index dff7f79..e6de593 100644 --- a/programs/sndfile-convert.c +++ b/programs/sndfile-convert.c @@ -335,7 +335,11 @@ main (int argc, char * argv []) || (outfileminor == SF_FORMAT_DOUBLE) || (outfileminor == SF_FORMAT_FLOAT) || (infileminor == SF_FORMAT_DOUBLE) || (infileminor == SF_FORMAT_FLOAT) || (infileminor == SF_FORMAT_VORBIS) || (outfileminor == SF_FORMAT_VORBIS)) - sfe_copy_data_fp (outfile, infile, sfinfo.channels, normalize) ; + { if (sfe_copy_data_fp (outfile, infile, sfinfo.channels, normalize) != 0) + { printf ("Error : Not able to decode input file %s.\n", infilename) ; + return 1 ; + } ; + } else sfe_copy_data_int (outfile, infile, sfinfo.channels) ; -- 2.7.4