summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorVijay Anusuri <vanusuri@mvista.com>2024-12-19 17:27:04 +0530
committerSteve Sakoman <steve@sakoman.com>2025-01-09 08:41:03 -0800
commit284b56a2e2e51dfafd412b8db4668f852deeeb7a (patch)
treed0965e1392e686646c34afa25c4892f3ec8d4624
parentdb0505b9ba33015038eaecce835fd991db32ed20 (diff)
downloadpoky-284b56a2e2e51dfafd412b8db4668f852deeeb7a.tar.gz
libsndfile1: Backport fix for CVE-2022-33065
Added missing commits for complete CVE fix Ref: https://github.com/libsndfile/libsndfile/issues/833 https://ubuntu.com/security/CVE-2022-33065 (From OE-Core rev: fc34dde58e8be19d703479c8e025e27294cdb579) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-1.patch (renamed from meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065.patch)0
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-10.patch39
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-11.patch35
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-12.patch40
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-13.patch58
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-2.patch58
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-3.patch34
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-4.patch60
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-5.patch39
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-6.patch82
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-7.patch48
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-8.patch179
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-9.patch231
-rw-r--r--meta/recipes-multimedia/libsndfile/libsndfile1_1.0.31.bb14
14 files changed, 916 insertions, 1 deletions
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-1.patch
index c5fba4d6b5..c5fba4d6b5 100644
--- a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065.patch
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-1.patch
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-10.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-10.patch
new file mode 100644
index 0000000000..17867fc308
--- /dev/null
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-10.patch
@@ -0,0 +1,39 @@
1From cd44bfaf3708e778c8670cb7f707a597c3334376 Mon Sep 17 00:00:00 2001
2From: Alex Stewart <alex.stewart@ni.com>
3Date: Tue, 17 Oct 2023 11:50:53 -0400
4Subject: [PATCH 14/17] nms_adpcm: fix int overflow in sf.frames calc
5
6When calculating sf.frames from the blocks_total PNMS variable, it is
7theoretically possible to overflow the blocks_total int boundaries,
8leading to undefined behavior.
9
10Cast blocks_total to a long-sized sf_count_t before the calculation, to
11provide it with enough numeric space and because that is the final
12typing regardless.
13
14CVE: CVE-2022-33065
15Fixes: https://github.com/libsndfile/libsndfile/issues/833
16
17Signed-off-by: Alex Stewart <alex.stewart@ni.com>
18
19Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-10.patch?h=ubuntu/jammy-security
20Upstream commit https://github.com/libsndfile/libsndfile/commit/cd44bfaf3708e778c8670cb7f707a597c3334376]
21CVE: CVE-2022-33065
22Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
23---
24 src/nms_adpcm.c | 2 +-
25 1 file changed, 1 insertion(+), 1 deletion(-)
26
27diff --git a/src/nms_adpcm.c b/src/nms_adpcm.c
28index dca85f0b0..61d171c73 100644
29--- a/src/nms_adpcm.c
30+++ b/src/nms_adpcm.c
31@@ -1090,7 +1090,7 @@ nms_adpcm_init (SF_PRIVATE *psf)
32 else
33 pnms->blocks_total = psf->datalength / (pnms->shortsperblock * sizeof (short)) ;
34
35- psf->sf.frames = pnms->blocks_total * NMS_SAMPLES_PER_BLOCK ;
36+ psf->sf.frames = (sf_count_t) pnms->blocks_total * NMS_SAMPLES_PER_BLOCK ;
37 psf->codec_close = nms_adpcm_close ;
38 psf->seek = nms_adpcm_seek ;
39
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-11.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-11.patch
new file mode 100644
index 0000000000..a147a0d593
--- /dev/null
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-11.patch
@@ -0,0 +1,35 @@
1From 915e154e2deb327612ca413c838365b7c9bfbf16 Mon Sep 17 00:00:00 2001
2From: Alex Stewart <alex.stewart@ni.com>
3Date: Tue, 17 Oct 2023 11:57:23 -0400
4Subject: [PATCH 15/17] pcm: fix int overflow in pcm_init()
5
6Cast the int-sized bytewidth variable to a long-sized sf_count_t type
7prior to calculating the blockwidth, to provide the calculation with
8enough numeric space and sf_count_t is the final typing regardless.
9
10CVE: CVE-2022-33065
11Fixes: https://github.com/libsndfile/libsndfile/issues/833
12
13Signed-off-by: Alex Stewart <alex.stewart@ni.com>
14
15Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-11.patch?h=ubuntu/jammy-security
16Upstream commit https://github.com/libsndfile/libsndfile/commit/915e154e2deb327612ca413c838365b7c9bfbf16]
17CVE: CVE-2022-33065
18Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
19---
20 src/pcm.c | 2 +-
21 1 file changed, 1 insertion(+), 1 deletion(-)
22
23diff --git a/src/pcm.c b/src/pcm.c
24index bdf461839..a42e48681 100644
25--- a/src/pcm.c
26+++ b/src/pcm.c
27@@ -127,7 +127,7 @@ pcm_init (SF_PRIVATE *psf)
28 return SFE_INTERNAL ;
29 } ;
30
31- psf->blockwidth = psf->bytewidth * psf->sf.channels ;
32+ psf->blockwidth = (sf_count_t) psf->bytewidth * psf->sf.channels ;
33
34 if ((SF_CODEC (psf->sf.format)) == SF_FORMAT_PCM_S8)
35 chars = SF_CHARS_SIGNED ;
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-12.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-12.patch
new file mode 100644
index 0000000000..659a6a4c22
--- /dev/null
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-12.patch
@@ -0,0 +1,40 @@
1From ec149a79d457916479489d71b55e4d63015a08ea Mon Sep 17 00:00:00 2001
2From: Alex Stewart <alex.stewart@ni.com>
3Date: Tue, 17 Oct 2023 12:01:00 -0400
4Subject: [PATCH 16/17] rf64: fix int overflow in rf64_read_header()
5
6When checking for mismatches between the filelength and riff_size, it is
7possible to overflow the temporary riff_size value used in the
8comparison by adding a static offset; which is probably fine, but it is
9offensive to overflow fuzzers.
10
11Since filelength is always a positive value, simply move the offset to
12the other side of the comparison operator as a negative value, avoid the
13possibility of an overflow.
14
15CVE: CVE-2022-33065
16Fixes: https://github.com/libsndfile/libsndfile/issues/833
17
18Signed-off-by: Alex Stewart <alex.stewart@ni.com>
19
20Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-12.patch?h=ubuntu/jammy-security
21Upstream commit https://github.com/libsndfile/libsndfile/commit/ec149a79d457916479489d71b55e4d63015a08ea]
22CVE: CVE-2022-33065
23Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
24---
25 src/rf64.c | 2 +-
26 1 file changed, 1 insertion(+), 1 deletion(-)
27
28diff --git a/src/rf64.c b/src/rf64.c
29index 123db445a..c60399fb3 100644
30--- a/src/rf64.c
31+++ b/src/rf64.c
32@@ -242,7 +242,7 @@ rf64_read_header (SF_PRIVATE *psf, int *blockalign, int *framesperblock)
33 } ;
34 } ;
35
36- if (psf->filelength != riff_size + 8)
37+ if (psf->filelength - 8 != riff_size)
38 psf_log_printf (psf, " Riff size : %D (should be %D)\n", riff_size, psf->filelength - 8) ;
39 else
40 psf_log_printf (psf, " Riff size : %D\n", riff_size) ;
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-13.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-13.patch
new file mode 100644
index 0000000000..107b1dcae4
--- /dev/null
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-13.patch
@@ -0,0 +1,58 @@
1From 9f097e492a07c96e3b250d6ac0044499f64f6cea Mon Sep 17 00:00:00 2001
2From: Alex Stewart <alex.stewart@ni.com>
3Date: Tue, 17 Oct 2023 12:19:12 -0400
4Subject: [PATCH 17/17] ima_adpcm: fix int overflow in ima_reader_init()
5
6When calculating sf.frames, pre-cast samplesperblock to sf_count_t, to
7provide the calculation with enough numeric space to avoid overflows.
8
9Other changes in this commit are syntactic, and only to satisfy the git
10pre-commit syntax checker.
11
12CVE: CVE-2022-33065
13Fixes: https://github.com/libsndfile/libsndfile/issues/833
14
15Signed-off-by: Alex Stewart <alex.stewart@ni.com>
16
17Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-13.patch?h=ubuntu/jammy-security
18Upstream commit https://github.com/libsndfile/libsndfile/commit/9f097e492a07c96e3b250d6ac0044499f64f6cea]
19CVE: CVE-2022-33065
20Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
21---
22 src/ima_adpcm.c | 6 +++---
23 1 file changed, 3 insertions(+), 3 deletions(-)
24
25--- libsndfile-1.0.31.orig/src/ima_adpcm.c
26+++ libsndfile-1.0.31/src/ima_adpcm.c
27@@ -182,7 +182,12 @@ ima_reader_init (SF_PRIVATE *psf, int bl
28 if (psf->file.mode != SFM_READ)
29 return SFE_BAD_MODE_RW ;
30
31- pimasize = sizeof (IMA_ADPCM_PRIVATE) + blockalign * psf->sf.channels + 3 * psf->sf.channels * samplesperblock ;
32+ /*
33+ ** Allocate enough space for 1 more than a multiple of 8 samples
34+ ** to avoid having to branch when pulling apart the nibbles.
35+ */
36+ count = ((samplesperblock - 2) | 7) + 2 ;
37+ pimasize = sizeof (IMA_ADPCM_PRIVATE) + psf->sf.channels * (blockalign + samplesperblock + sizeof (short) * count) ;
38
39 if (! (pima = calloc (1, pimasize)))
40 return SFE_MALLOC_FAILED ;
41@@ -233,7 +238,7 @@ ima_reader_init (SF_PRIVATE *psf, int bl
42 case SF_FORMAT_AIFF :
43 psf_log_printf (psf, "still need to check block count\n") ;
44 pima->decode_block = aiff_ima_decode_block ;
45- psf->sf.frames = pima->samplesperblock * pima->blocks / pima->channels ;
46+ psf->sf.frames = (sf_count_t) pima->samplesperblock * pima->blocks / pima->channels ;
47 break ;
48
49 default :
50@@ -386,7 +391,7 @@ aiff_ima_encode_block (SF_PRIVATE *psf,
51 static int
52 wavlike_ima_decode_block (SF_PRIVATE *psf, IMA_ADPCM_PRIVATE *pima)
53 { int chan, k, predictor, blockindx, indx, indxstart, diff ;
54- short step, bytecode, stepindx [2] ;
55+ short step, bytecode, stepindx [2] = { 0 } ;
56
57 pima->blockcount ++ ;
58 pima->samplecount = 0 ;
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-2.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-2.patch
new file mode 100644
index 0000000000..93b8856e41
--- /dev/null
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-2.patch
@@ -0,0 +1,58 @@
1From 56e6c5408f1ee6d476b234c105fb28b4998e811b Mon Sep 17 00:00:00 2001
2From: Alex Stewart <alex.stewart@ni.com>
3Date: Wed, 11 Oct 2023 16:36:02 -0400
4Subject: [PATCH 06/17] au: avoid int overflow while calculating data_end
5
6At several points in au_read_header(), we calculate the functional end
7of the data segment by adding the (int)au_fmt.dataoffset and the
8(int)au_fmt.datasize. This can overflow the implicit int_32 return value
9and cause undefined behavior.
10
11Instead, precalculate the value and assign it to a 64-bit
12(sf_count_t)data_end variable.
13
14CVE: CVE-2022-33065
15Fixes: https://github.com/libsndfile/libsndfile/issues/833
16
17Signed-off-by: Alex Stewart <alex.stewart@ni.com>
18
19Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-2.patch?h=ubuntu/jammy-security
20Upstream commit https://github.com/libsndfile/libsndfile/commit/56e6c5408f1ee6d476b234c105fb28b4998e811b]
21CVE: CVE-2022-33065
22Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
23---
24 src/au.c | 10 ++++++----
25 1 file changed, 6 insertions(+), 4 deletions(-)
26
27diff --git a/src/au.c b/src/au.c
28index 62bd691d6..f68f25871 100644
29--- a/src/au.c
30+++ b/src/au.c
31@@ -291,6 +291,7 @@ static int
32 au_read_header (SF_PRIVATE *psf)
33 { AU_FMT au_fmt ;
34 int marker, dword ;
35+ sf_count_t data_end ;
36
37 memset (&au_fmt, 0, sizeof (au_fmt)) ;
38 psf_binheader_readf (psf, "pm", 0, &marker) ;
39@@ -317,14 +318,15 @@ au_read_header (SF_PRIVATE *psf)
40 return SFE_AU_EMBED_BAD_LEN ;
41 } ;
42
43+ data_end = (sf_count_t) au_fmt.dataoffset + (sf_count_t) au_fmt.datasize ;
44 if (psf->fileoffset > 0)
45- { psf->filelength = au_fmt.dataoffset + au_fmt.datasize ;
46+ { psf->filelength = data_end ;
47 psf_log_printf (psf, " Data Size : %d\n", au_fmt.datasize) ;
48 }
49- else if (au_fmt.datasize == -1 || au_fmt.dataoffset + au_fmt.datasize == psf->filelength)
50+ else if (au_fmt.datasize == -1 || data_end == psf->filelength)
51 psf_log_printf (psf, " Data Size : %d\n", au_fmt.datasize) ;
52- else if (au_fmt.dataoffset + au_fmt.datasize < psf->filelength)
53- { psf->filelength = au_fmt.dataoffset + au_fmt.datasize ;
54+ else if (data_end < psf->filelength)
55+ { psf->filelength = data_end ;
56 psf_log_printf (psf, " Data Size : %d\n", au_fmt.datasize) ;
57 }
58 else
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-3.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-3.patch
new file mode 100644
index 0000000000..80af387081
--- /dev/null
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-3.patch
@@ -0,0 +1,34 @@
1From 839fa9131820d689b2038c81531b618b2932fbe3 Mon Sep 17 00:00:00 2001
2From: Alex Stewart <alex.stewart@ni.com>
3Date: Wed, 11 Oct 2023 16:46:29 -0400
4Subject: [PATCH 07/17] avr: fix int overflow in avr_read_header()
5
6Pre-cast hdr.frames to sf_count_t, to provide the calculation with
7enough numeric space to avoid an int-overflow.
8
9CVE: CVE-2022-33065
10Fixes: https://github.com/libsndfile/libsndfile/issues/833
11
12Signed-off-by: Alex Stewart <alex.stewart@ni.com>
13
14Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-3.patch?h=ubuntu/jammy-security
15Upstream commit https://github.com/libsndfile/libsndfile/commit/839fa9131820d689b2038c81531b618b2932fbe3]
16CVE: CVE-2022-33065
17Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
18---
19 src/avr.c | 2 +-
20 1 file changed, 1 insertion(+), 1 deletion(-)
21
22diff --git a/src/avr.c b/src/avr.c
23index 6c78ff69b..1bc1ffc90 100644
24--- a/src/avr.c
25+++ b/src/avr.c
26@@ -162,7 +162,7 @@ avr_read_header (SF_PRIVATE *psf)
27 psf->endian = SF_ENDIAN_BIG ;
28
29 psf->dataoffset = AVR_HDR_SIZE ;
30- psf->datalength = hdr.frames * (hdr.rez / 8) ;
31+ psf->datalength = (sf_count_t) hdr.frames * (hdr.rez / 8) ;
32
33 if (psf->fileoffset > 0)
34 psf->filelength = AVR_HDR_SIZE + psf->datalength ;
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-4.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-4.patch
new file mode 100644
index 0000000000..2c1e10f66c
--- /dev/null
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-4.patch
@@ -0,0 +1,60 @@
1From 1116fa173ea8785c9d881936b2174be6a58c0055 Mon Sep 17 00:00:00 2001
2From: Alex Stewart <alex.stewart@ni.com>
3Date: Wed, 11 Oct 2023 16:54:21 -0400
4Subject: [PATCH 08/17] sds: fix int overflow warning in sample calculations
5
6The sds_*byte_read() functions compose their uint_32 sample buffers by
7shifting 7bit samples into a 32bit wide buffer, and adding them
8together. Because the 7bit samples are stored in 32bit ints, code
9fuzzers become concerned that the addition operation can overflow and
10cause undefined behavior.
11
12Instead, bitwise-OR the bytes together - which should accomplish the
13same arithmetic operation, without risking an int-overflow.
14
15CVE: CVE-2022-33065
16Fixes: https://github.com/libsndfile/libsndfile/issues/833
17
18Signed-off-by: Alex Stewart <alex.stewart@ni.com>
19
20Do the same for the 3byte and 4byte read functions.
21
22Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-4.patch?h=ubuntu/jammy-security
23Upstream commit https://github.com/libsndfile/libsndfile/commit/1116fa173ea8785c9d881936b2174be6a58c0055]
24CVE: CVE-2022-33065
25Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
26---
27 src/sds.c | 6 +++---
28 1 file changed, 3 insertions(+), 3 deletions(-)
29
30diff --git a/src/sds.c b/src/sds.c
31index 6bc761716..2a0f164c3 100644
32--- a/src/sds.c
33+++ b/src/sds.c
34@@ -454,7 +454,7 @@ sds_2byte_read (SF_PRIVATE *psf, SDS_PRIVATE *psds)
35
36 ucptr = psds->read_data + 5 ;
37 for (k = 0 ; k < 120 ; k += 2)
38- { sample = arith_shift_left (ucptr [k], 25) + arith_shift_left (ucptr [k + 1], 18) ;
39+ { sample = arith_shift_left (ucptr [k], 25) | arith_shift_left (ucptr [k + 1], 18) ;
40 psds->read_samples [k / 2] = (int) (sample - 0x80000000) ;
41 } ;
42
43@@ -498,7 +498,7 @@ sds_3byte_read (SF_PRIVATE *psf, SDS_PRIVATE *psds)
44
45 ucptr = psds->read_data + 5 ;
46 for (k = 0 ; k < 120 ; k += 3)
47- { sample = (((uint32_t) ucptr [k]) << 25) + (ucptr [k + 1] << 18) + (ucptr [k + 2] << 11) ;
48+ { sample = (((uint32_t) ucptr [k]) << 25) | (ucptr [k + 1] << 18) | (ucptr [k + 2] << 11) ;
49 psds->read_samples [k / 3] = (int) (sample - 0x80000000) ;
50 } ;
51
52@@ -542,7 +542,7 @@ sds_4byte_read (SF_PRIVATE *psf, SDS_PRIVATE *psds)
53
54 ucptr = psds->read_data + 5 ;
55 for (k = 0 ; k < 120 ; k += 4)
56- { sample = (((uint32_t) ucptr [k]) << 25) + (ucptr [k + 1] << 18) + (ucptr [k + 2] << 11) + (ucptr [k + 3] << 4) ;
57+ { sample = (((uint32_t) ucptr [k]) << 25) | (ucptr [k + 1] << 18) | (ucptr [k + 2] << 11) | (ucptr [k + 3] << 4) ;
58 psds->read_samples [k / 4] = (int) (sample - 0x80000000) ;
59 } ;
60
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-5.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-5.patch
new file mode 100644
index 0000000000..a96e5fefa4
--- /dev/null
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-5.patch
@@ -0,0 +1,39 @@
1From 23188c9b1c34f06ca7f17243425d59403e9eb0db Mon Sep 17 00:00:00 2001
2From: Alex Stewart <alex.stewart@ni.com>
3Date: Wed, 11 Oct 2023 17:26:51 -0400
4Subject: [PATCH 09/17] aiff: fix int overflow when counting header elements
5
6aiff_read_basc_chunk() tries to count the AIFF header size by keeping
7track of the bytes returned by psf_binheader_readf(). Though improbable,
8it is technically possible for these added bytes to exceed the int-sized
9`count` accumulator.
10
11Use a 64-bit sf_count_t type for `count`, to ensure that it always has
12enough numeric space.
13
14CVE: CVE-2022-33065
15Fixes: https://github.com/libsndfile/libsndfile/issues/833
16
17Signed-off-by: Alex Stewart <alex.stewart@ni.com>
18
19Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-5.patch?h=ubuntu/jammy-security
20Upstream commit https://github.com/libsndfile/libsndfile/commit/23188c9b1c34f06ca7f17243425d59403e9eb0db]
21CVE: CVE-2022-33065
22Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
23---
24 src/aiff.c | 2 +-
25 1 file changed, 1 insertion(+), 1 deletion(-)
26
27diff --git a/src/aiff.c b/src/aiff.c
28index ac3655e9d..6d8f1bc83 100644
29--- a/src/aiff.c
30+++ b/src/aiff.c
31@@ -1702,7 +1702,7 @@ static int
32 aiff_read_basc_chunk (SF_PRIVATE * psf, int datasize)
33 { const char * type_str ;
34 basc_CHUNK bc ;
35- int count ;
36+ sf_count_t count ;
37
38 count = psf_binheader_readf (psf, "E442", &bc.version, &bc.numBeats, &bc.rootNote) ;
39 count += psf_binheader_readf (psf, "E222", &bc.scaleType, &bc.sigNumerator, &bc.sigDenominator) ;
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-6.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-6.patch
new file mode 100644
index 0000000000..0f89c47d59
--- /dev/null
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-6.patch
@@ -0,0 +1,82 @@
1From 00bd0320d895ef5f3027c75a9df26546bc18f8b7 Mon Sep 17 00:00:00 2001
2From: Alex Stewart <alex.stewart@ni.com>
3Date: Wed, 11 Oct 2023 17:43:02 -0400
4Subject: [PATCH 10/17] ircam: fix int overflow in ircam_read_header()
5
6When reading the IRCAM header, it is possible for the calculated
7blockwidth to exceed the bounds of a signed int32.
8
9Use a 64bit sf_count_t to store the blockwidth.
10
11CVE: CVE-2022-33065
12Fixes: https://github.com/libsndfile/libsndfile/issues/833
13
14Signed-off-by: Alex Stewart <alex.stewart@ni.com>
15
16Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-6.patch?h=ubuntu/jammy-security
17Upstream commit https://github.com/libsndfile/libsndfile/commit/00bd0320d895ef5f3027c75a9df26546bc18f8b7]
18CVE: CVE-2022-33065
19Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
20---
21 src/common.h | 2 +-
22 src/ircam.c | 10 +++++-----
23 2 files changed, 6 insertions(+), 6 deletions(-)
24
25diff --git a/src/common.h b/src/common.h
26index cd9ac8b07..01f6ae095 100644
27--- a/src/common.h
28+++ b/src/common.h
29@@ -439,7 +439,7 @@ typedef struct sf_private_tag
30 sf_count_t datalength ; /* Length in bytes of the audio data. */
31 sf_count_t dataend ; /* Offset to file tailer. */
32
33- int blockwidth ; /* Size in bytes of one set of interleaved samples. */
34+ sf_count_t blockwidth ; /* Size in bytes of one set of interleaved samples. */
35 int bytewidth ; /* Size in bytes of one sample (one channel). */
36
37 void *dither ;
38diff --git a/src/ircam.c b/src/ircam.c
39index 8e7cdba81..3d73ba442 100644
40--- a/src/ircam.c
41+++ b/src/ircam.c
42@@ -171,35 +171,35 @@ ircam_read_header (SF_PRIVATE *psf)
43 switch (encoding)
44 { case IRCAM_PCM_16 :
45 psf->bytewidth = 2 ;
46- psf->blockwidth = psf->sf.channels * psf->bytewidth ;
47+ psf->blockwidth = (sf_count_t) psf->sf.channels * psf->bytewidth ;
48
49 psf->sf.format = SF_FORMAT_IRCAM | SF_FORMAT_PCM_16 ;
50 break ;
51
52 case IRCAM_PCM_32 :
53 psf->bytewidth = 4 ;
54- psf->blockwidth = psf->sf.channels * psf->bytewidth ;
55+ psf->blockwidth = (sf_count_t) psf->sf.channels * psf->bytewidth ;
56
57 psf->sf.format = SF_FORMAT_IRCAM | SF_FORMAT_PCM_32 ;
58 break ;
59
60 case IRCAM_FLOAT :
61 psf->bytewidth = 4 ;
62- psf->blockwidth = psf->sf.channels * psf->bytewidth ;
63+ psf->blockwidth = (sf_count_t) psf->sf.channels * psf->bytewidth ;
64
65 psf->sf.format = SF_FORMAT_IRCAM | SF_FORMAT_FLOAT ;
66 break ;
67
68 case IRCAM_ALAW :
69 psf->bytewidth = 1 ;
70- psf->blockwidth = psf->sf.channels * psf->bytewidth ;
71+ psf->blockwidth = (sf_count_t) psf->sf.channels * psf->bytewidth ;
72
73 psf->sf.format = SF_FORMAT_IRCAM | SF_FORMAT_ALAW ;
74 break ;
75
76 case IRCAM_ULAW :
77 psf->bytewidth = 1 ;
78- psf->blockwidth = psf->sf.channels * psf->bytewidth ;
79+ psf->blockwidth = (sf_count_t) psf->sf.channels * psf->bytewidth ;
80
81 psf->sf.format = SF_FORMAT_IRCAM | SF_FORMAT_ULAW ;
82 break ;
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-7.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-7.patch
new file mode 100644
index 0000000000..a26c14294d
--- /dev/null
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-7.patch
@@ -0,0 +1,48 @@
1From 590608bbbded2ca0966dc89c5d9b6bf659f4cb71 Mon Sep 17 00:00:00 2001
2From: Alex Stewart <alex.stewart@ni.com>
3Date: Wed, 11 Oct 2023 16:12:22 -0400
4Subject: [PATCH 11/17] mat4/mat5: fix int overflow when calculating blockwidth
5
6Pre-cast the components of the blockwidth calculation to sf_count_t to
7avoid overflowing integers during calculation.
8
9CVE: CVE-2022-33065
10Fixes: https://github.com/libsndfile/libsndfile/issues/833
11
12Signed-off-by: Alex Stewart <alex.stewart@ni.com>
13
14Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-7.patch?h=ubuntu/jammy-security
15Upstream commit https://github.com/libsndfile/libsndfile/commit/590608bbbded2ca0966dc89c5d9b6bf659f4cb71]
16CVE: CVE-2022-33065
17Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
18---
19 src/mat4.c | 2 +-
20 src/mat5.c | 2 +-
21 2 files changed, 2 insertions(+), 2 deletions(-)
22
23diff --git a/src/mat4.c b/src/mat4.c
24index 575683ba1..9f046f0c6 100644
25--- a/src/mat4.c
26+++ b/src/mat4.c
27@@ -104,7 +104,7 @@ mat4_open (SF_PRIVATE *psf)
28
29 psf->container_close = mat4_close ;
30
31- psf->blockwidth = psf->bytewidth * psf->sf.channels ;
32+ psf->blockwidth = (sf_count_t) psf->bytewidth * psf->sf.channels ;
33
34 switch (subformat)
35 { case SF_FORMAT_PCM_16 :
36diff --git a/src/mat5.c b/src/mat5.c
37index da5a6eca0..20f0ea64b 100644
38--- a/src/mat5.c
39+++ b/src/mat5.c
40@@ -114,7 +114,7 @@ mat5_open (SF_PRIVATE *psf)
41
42 psf->container_close = mat5_close ;
43
44- psf->blockwidth = psf->bytewidth * psf->sf.channels ;
45+ psf->blockwidth = (sf_count_t) psf->bytewidth * psf->sf.channels ;
46
47 switch (subformat)
48 { case SF_FORMAT_PCM_U8 :
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-8.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-8.patch
new file mode 100644
index 0000000000..641f73ad55
--- /dev/null
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-8.patch
@@ -0,0 +1,179 @@
1From 4ec860910a4ee91ed4fdf1c0a49f2dad96d595c9 Mon Sep 17 00:00:00 2001
2From: Alex Stewart <alex.stewart@ni.com>
3Date: Mon, 16 Oct 2023 12:37:47 -0400
4Subject: [PATCH 12/17] common: fix int overflow in psf_binheader_readf()
5
6The psf_binheader_readf() function attempts to count and return the
7number of bytes traversed in the header. During this accumulation, it is
8possible to overflow the int-sized byte_count variable.
9
10Avoid this overflow by checking that the accumulated bytes do not exceed
11INT_MAX and throwing an error if they do. This implies that files with
12multi-gigabyte headers threaten to produce this error, but I imagine
13those files don't really exist - and this error is better than the
14undefined behavior which would have resulted previously.
15
16CVE: CVE-2022-33065
17Fixes: https://github.com/libsndfile/libsndfile/issues/833
18
19Signed-off-by: Alex Stewart <alex.stewart@ni.com>
20
21Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-8.patch?h=ubuntu/jammy-security
22Upstream commit https://github.com/libsndfile/libsndfile/commit/4ec860910a4ee91ed4fdf1c0a49f2dad96d595c9]
23CVE: CVE-2022-33065
24Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
25---
26 src/common.c | 36 ++++++++++++++++++++++++------------
27 1 file changed, 24 insertions(+), 12 deletions(-)
28
29--- libsndfile-1.0.31.orig/src/common.c
30+++ libsndfile-1.0.31/src/common.c
31@@ -18,6 +18,7 @@
32
33 #include <config.h>
34
35+#include <limits.h>
36 #include <stdarg.h>
37 #include <string.h>
38 #if HAVE_UNISTD_H
39@@ -962,6 +963,7 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
40 double *doubleptr ;
41 char c ;
42 int byte_count = 0, count = 0 ;
43+ int read_bytes = 0 ;
44
45 if (! format)
46 return psf_ftell (psf) ;
47@@ -970,6 +972,7 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
48
49 while ((c = *format++))
50 {
51+ read_bytes = 0 ;
52 if (psf->header.indx + 16 >= psf->header.len && psf_bump_header_allocation (psf, 16))
53 return count ;
54
55@@ -986,7 +989,7 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
56 intptr = va_arg (argptr, unsigned int*) ;
57 *intptr = 0 ;
58 ucptr = (unsigned char*) intptr ;
59- byte_count += header_read (psf, ucptr, sizeof (int)) ;
60+ read_bytes = header_read (psf, ucptr, sizeof (int)) ;
61 *intptr = GET_MARKER (ucptr) ;
62 break ;
63
64@@ -994,7 +997,7 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
65 intptr = va_arg (argptr, unsigned int*) ;
66 *intptr = 0 ;
67 ucptr = (unsigned char*) intptr ;
68- byte_count += header_read (psf, sixteen_bytes, sizeof (sixteen_bytes)) ;
69+ read_bytes = header_read (psf, sixteen_bytes, sizeof (sixteen_bytes)) ;
70 { int k ;
71 intdata = 0 ;
72 for (k = 0 ; k < 16 ; k++)
73@@ -1006,14 +1009,14 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
74 case '1' :
75 charptr = va_arg (argptr, char*) ;
76 *charptr = 0 ;
77- byte_count += header_read (psf, charptr, sizeof (char)) ;
78+ read_bytes = header_read (psf, charptr, sizeof (char)) ;
79 break ;
80
81 case '2' : /* 2 byte value with the current endian-ness */
82 shortptr = va_arg (argptr, unsigned short*) ;
83 *shortptr = 0 ;
84 ucptr = (unsigned char*) shortptr ;
85- byte_count += header_read (psf, ucptr, sizeof (short)) ;
86+ read_bytes = header_read (psf, ucptr, sizeof (short)) ;
87 if (psf->rwf_endian == SF_ENDIAN_BIG)
88 *shortptr = GET_BE_SHORT (ucptr) ;
89 else
90@@ -1023,7 +1026,7 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
91 case '3' : /* 3 byte value with the current endian-ness */
92 intptr = va_arg (argptr, unsigned int*) ;
93 *intptr = 0 ;
94- byte_count += header_read (psf, sixteen_bytes, 3) ;
95+ read_bytes = header_read (psf, sixteen_bytes, 3) ;
96 if (psf->rwf_endian == SF_ENDIAN_BIG)
97 *intptr = GET_BE_3BYTE (sixteen_bytes) ;
98 else
99@@ -1034,7 +1037,7 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
100 intptr = va_arg (argptr, unsigned int*) ;
101 *intptr = 0 ;
102 ucptr = (unsigned char*) intptr ;
103- byte_count += header_read (psf, ucptr, sizeof (int)) ;
104+ read_bytes = header_read (psf, ucptr, sizeof (int)) ;
105 if (psf->rwf_endian == SF_ENDIAN_BIG)
106 *intptr = psf_get_be32 (ucptr, 0) ;
107 else
108@@ -1044,7 +1047,7 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
109 case '8' : /* 8 byte value with the current endian-ness */
110 countptr = va_arg (argptr, sf_count_t *) ;
111 *countptr = 0 ;
112- byte_count += header_read (psf, sixteen_bytes, 8) ;
113+ read_bytes = header_read (psf, sixteen_bytes, 8) ;
114 if (psf->rwf_endian == SF_ENDIAN_BIG)
115 countdata = psf_get_be64 (sixteen_bytes, 0) ;
116 else
117@@ -1055,7 +1058,7 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
118 case 'f' : /* Float conversion */
119 floatptr = va_arg (argptr, float *) ;
120 *floatptr = 0.0 ;
121- byte_count += header_read (psf, floatptr, sizeof (float)) ;
122+ read_bytes = header_read (psf, floatptr, sizeof (float)) ;
123 if (psf->rwf_endian == SF_ENDIAN_BIG)
124 *floatptr = float32_be_read ((unsigned char*) floatptr) ;
125 else
126@@ -1065,7 +1068,7 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
127 case 'd' : /* double conversion */
128 doubleptr = va_arg (argptr, double *) ;
129 *doubleptr = 0.0 ;
130- byte_count += header_read (psf, doubleptr, sizeof (double)) ;
131+ read_bytes = header_read (psf, doubleptr, sizeof (double)) ;
132 if (psf->rwf_endian == SF_ENDIAN_BIG)
133 *doubleptr = double64_be_read ((unsigned char*) doubleptr) ;
134 else
135@@ -1089,7 +1092,7 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
136 charptr = va_arg (argptr, char*) ;
137 count = va_arg (argptr, size_t) ;
138 memset (charptr, 0, count) ;
139- byte_count += header_read (psf, charptr, count) ;
140+ read_bytes = header_read (psf, charptr, count) ;
141 break ;
142
143 case 'G' :
144@@ -1100,7 +1103,7 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
145 if (psf->header.indx + count >= psf->header.len && psf_bump_header_allocation (psf, count))
146 return 0 ;
147
148- byte_count += header_gets (psf, charptr, count) ;
149+ read_bytes = header_gets (psf, charptr, count) ;
150 break ;
151
152 case 'z' :
153@@ -1124,7 +1127,7 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
154 case 'j' : /* Seek to position from current position. */
155 count = va_arg (argptr, size_t) ;
156 header_seek (psf, count, SEEK_CUR) ;
157- byte_count += count ;
158+ read_bytes = count ;
159 break ;
160
161 default :
162@@ -1132,8 +1135,17 @@ psf_binheader_readf (SF_PRIVATE *psf, ch
163 psf->error = SFE_INTERNAL ;
164 break ;
165 } ;
166+
167+ if (read_bytes > 0 && byte_count > (INT_MAX - read_bytes))
168+ { psf_log_printf (psf, "Header size exceeds INT_MAX. Aborting.", c) ;
169+ psf->error = SFE_INTERNAL ;
170+ break ;
171+ } else
172+ { byte_count += read_bytes ;
173 } ;
174
175+ } ; /*end while*/
176+
177 va_end (argptr) ;
178
179 return byte_count ;
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-9.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-9.patch
new file mode 100644
index 0000000000..88dc80addf
--- /dev/null
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065-9.patch
@@ -0,0 +1,231 @@
1From 6e162cb767e81cd15f4dc2a2fa253d2e36adfd70 Mon Sep 17 00:00:00 2001
2From: Alex Stewart <alex.stewart@ni.com>
3Date: Thu, 19 Oct 2023 14:07:19 -0400
4Subject: [PATCH 13/17] nms_adpcm: fix int overflow in signal estimate
5
6It is possible (though functionally incorrect) for the signal estimate
7calculation in nms_adpcm_update() to overflow the int value of s_e,
8resulting in undefined behavior.
9
10Since adpcm state signal values are never practically larger than
1116 bits, use smaller numeric sizes throughout the file to avoid the
12overflow.
13
14CVE: CVE-2022-33065
15Fixes: https://github.com/libsndfile/libsndfile/issues/833
16
17Authored-by: Arthur Taylor <art@ified.ca>
18Signed-off-by: Alex Stewart <alex.stewart@ni.com>
19
20Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-9.patch?h=ubuntu/jammy-security
21Upstream commit https://github.com/libsndfile/libsndfile/commit/6e162cb767e81cd15f4dc2a2fa253d2e36adfd70]
22CVE: CVE-2022-33065
23Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
24---
25 src/nms_adpcm.c | 81 ++++++++++++++++++++++++-------------------------
26 1 file changed, 40 insertions(+), 41 deletions(-)
27
28--- libsndfile-1.2.0.orig/src/nms_adpcm.c
29+++ libsndfile-1.2.0/src/nms_adpcm.c
30@@ -48,36 +48,36 @@
31 /* Variable names from ITU G.726 spec */
32 struct nms_adpcm_state
33 { /* Log of the step size multiplier. Operated on by codewords. */
34- int yl ;
35+ short yl ;
36
37 /* Quantizer step size multiplier. Generated from yl. */
38- int y ;
39+ short y ;
40
41 /* Coefficents of the pole predictor */
42- int a [2] ;
43+ short a [2] ;
44
45 /* Coefficents of the zero predictor */
46- int b [6] ;
47+ short b [6] ;
48
49 /* Previous quantized deltas (multiplied by 2^14) */
50- int d_q [7] ;
51+ short d_q [7] ;
52
53 /* d_q [x] + s_ez [x], used by the pole-predictor for signs only. */
54- int p [3] ;
55+ short p [3] ;
56
57 /* Previous reconstructed signal values. */
58- int s_r [2] ;
59+ short s_r [2] ;
60
61 /* Zero predictor components of the signal estimate. */
62- int s_ez ;
63+ short s_ez ;
64
65 /* Signal estimate, (including s_ez). */
66- int s_e ;
67+ short s_e ;
68
69 /* The most recent codeword (enc:generated, dec:inputted) */
70- int Ik ;
71+ char Ik ;
72
73- int parity ;
74+ char parity ;
75
76 /*
77 ** Offset into code tables for the bitrate.
78@@ -109,7 +109,7 @@ typedef struct
79 } NMS_ADPCM_PRIVATE ;
80
81 /* Pre-computed exponential interval used in the antilog approximation. */
82-static unsigned int table_expn [] =
83+static unsigned short table_expn [] =
84 { 0x4000, 0x4167, 0x42d5, 0x444c, 0x45cb, 0x4752, 0x48e2, 0x4a7a,
85 0x4c1b, 0x4dc7, 0x4f7a, 0x5138, 0x52ff, 0x54d1, 0x56ac, 0x5892,
86 0x5a82, 0x5c7e, 0x5e84, 0x6096, 0x62b4, 0x64dd, 0x6712, 0x6954,
87@@ -117,21 +117,21 @@ static unsigned int table_expn [] =
88 } ;
89
90 /* Table mapping codewords to scale factor deltas. */
91-static int table_scale_factor_step [] =
92+static short table_scale_factor_step [] =
93 { 0x0, 0x0, 0x0, 0x0, 0x4b0, 0x0, 0x0, 0x0, /* 2-bit */
94 -0x3c, 0x0, 0x90, 0x0, 0x2ee, 0x0, 0x898, 0x0, /* 3-bit */
95 -0x30, 0x12, 0x6b, 0xc8, 0x188, 0x2e0, 0x551, 0x1150, /* 4-bit */
96 } ;
97
98 /* Table mapping codewords to quantized delta interval steps. */
99-static unsigned int table_step [] =
100+static unsigned short table_step [] =
101 { 0x73F, 0, 0, 0, 0x1829, 0, 0, 0, /* 2-bit */
102 0x3EB, 0, 0xC18, 0, 0x1581, 0, 0x226E, 0, /* 3-bit */
103 0x20C, 0x635, 0xA83, 0xF12, 0x1418, 0x19E3, 0x211A, 0x2BBA, /* 4-bit */
104 } ;
105
106 /* Binary search lookup table for quantizing using table_step. */
107-static int table_step_search [] =
108+static short table_step_search [] =
109 { 0, 0x1F6D, 0, -0x1F6D, 0, 0, 0, 0, /* 2-bit */
110 0x1008, 0x1192, 0, -0x219A, 0x1656, -0x1656, 0, 0, /* 3-bit */
111 0x872, 0x1277, -0x8E6, -0x232B, 0xD06, -0x17D7, -0x11D3, 0, /* 4-bit */
112@@ -179,23 +179,23 @@ static sf_count_t nms_adpcm_seek (SF_PRI
113 ** Maps [1,20480] to [1,1024] in an exponential relationship. This is
114 ** approximately ret = b^exp where b = e^(ln(1024)/ln(20480)) ~= 1.0003385
115 */
116-static inline int
117-nms_adpcm_antilog (int exp)
118-{ int ret ;
119-
120- ret = 0x1000 ;
121- ret += (((exp & 0x3f) * 0x166b) >> 12) ;
122- ret *= table_expn [(exp & 0x7c0) >> 6] ;
123- ret >>= (26 - (exp >> 11)) ;
124+static inline short
125+nms_adpcm_antilog (short exp)
126+{ int_fast32_t r ;
127+
128+ r = 0x1000 ;
129+ r += (((int_fast32_t) (exp & 0x3f) * 0x166b) >> 12) ;
130+ r *= table_expn [(exp & 0x7c0) >> 6] ;
131+ r >>= (26 - (exp >> 11)) ;
132
133- return ret ;
134+ return (short) r ;
135 } /* nms_adpcm_antilog */
136
137 static void
138 nms_adpcm_update (struct nms_adpcm_state *s)
139 { /* Variable names from ITU G.726 spec */
140- int a1ul ;
141- int fa1 ;
142+ short a1ul, fa1 ;
143+ int_fast32_t se ;
144 int i ;
145
146 /* Decay and Modify the scale factor in the log domain based on the codeword. */
147@@ -222,7 +222,7 @@ nms_adpcm_update (struct nms_adpcm_state
148 else if (fa1 > 256)
149 fa1 = 256 ;
150
151- s->a [0] = (0xff * s->a [0]) >> 8 ;
152+ s->a [0] = (s->a [0] * 0xff) >> 8 ;
153 if (s->p [0] != 0 && s->p [1] != 0 && ((s->p [0] ^ s->p [1]) < 0))
154 s->a [0] -= 192 ;
155 else
156@@ -230,7 +230,7 @@ nms_adpcm_update (struct nms_adpcm_state
157 fa1 = -fa1 ;
158 }
159
160- s->a [1] = fa1 + ((0xfe * s->a [1]) >> 8) ;
161+ s->a [1] = fa1 + ((s->a [1] * 0xfe) >> 8) ;
162 if (s->p [0] != 0 && s->p [2] != 0 && ((s->p [0] ^ s->p [2]) < 0))
163 s->a [1] -= 128 ;
164 else
165@@ -250,19 +250,18 @@ nms_adpcm_update (struct nms_adpcm_state
166 s->a [0] = a1ul ;
167 } ;
168
169- /* Compute the zero predictor estimate. Rotate past deltas too. */
170- s->s_ez = 0 ;
171+ /* Compute the zero predictor estimate and rotate past deltas. */
172+ se = 0 ;
173 for (i = 5 ; i >= 0 ; i--)
174- { s->s_ez += s->d_q [i] * s->b [i] ;
175+ { se += (int_fast32_t) s->d_q [i] * s->b [i] ;
176 s->d_q [i + 1] = s->d_q [i] ;
177 } ;
178+ s->s_ez = se >> 14 ;
179
180- /* Compute the signal estimate. */
181- s->s_e = s->a [0] * s->s_r [0] + s->a [1] * s->s_r [1] + s->s_ez ;
182-
183- /* Return to scale */
184- s->s_ez >>= 14 ;
185- s->s_e >>= 14 ;
186+ /* Complete the signal estimate. */
187+ se += (int_fast32_t) s->a [0] * s->s_r [0] ;
188+ se += (int_fast32_t) s->a [1] * s->s_r [1] ;
189+ s->s_e = se >> 14 ;
190
191 /* Rotate members to prepare for next iteration. */
192 s->s_r [1] = s->s_r [0] ;
193@@ -274,7 +273,7 @@ nms_adpcm_update (struct nms_adpcm_state
194 static int16_t
195 nms_adpcm_reconstruct_sample (struct nms_adpcm_state *s, uint8_t I)
196 { /* Variable names from ITU G.726 spec */
197- int dqx ;
198+ int_fast32_t dqx ;
199
200 /*
201 ** The ordering of the 12-bit right-shift is a precision loss. It agrees
202@@ -308,17 +307,17 @@ nms_adpcm_codec_init (struct nms_adpcm_s
203 /*
204 ** nms_adpcm_encode_sample()
205 **
206-** Encode a linear 16-bit pcm sample into a 2,3, or 4 bit NMS-ADPCM codeword
207+** Encode a linear 16-bit pcm sample into a 2, 3, or 4 bit NMS-ADPCM codeword
208 ** using and updating the predictor state.
209 */
210 static uint8_t
211 nms_adpcm_encode_sample (struct nms_adpcm_state *s, int16_t sl)
212 { /* Variable names from ITU G.726 spec */
213- int d ;
214+ int_fast32_t d ;
215 uint8_t I ;
216
217 /* Down scale the sample from 16 => ~14 bits. */
218- sl = (sl * 0x1fdf) / 0x7fff ;
219+ sl = ((int_fast32_t) sl * 0x1fdf) / 0x7fff ;
220
221 /* Compute estimate, and delta from actual value */
222 nms_adpcm_update (s) ;
223@@ -407,7 +406,7 @@ nms_adpcm_encode_sample (struct nms_adpc
224 */
225 static int16_t
226 nms_adpcm_decode_sample (struct nms_adpcm_state *s, uint8_t I)
227-{ int sl ;
228+{ int_fast32_t sl ;
229
230 nms_adpcm_update (s) ;
231 sl = nms_adpcm_reconstruct_sample (s, I) ;
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.31.bb b/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.31.bb
index 20240635f7..6a6ccf7567 100644
--- a/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.31.bb
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1_1.0.31.bb
@@ -11,7 +11,19 @@ LICENSE = "LGPL-2.1-only"
11SRC_URI = "https://github.com/libsndfile/libsndfile/releases/download/${PV}/libsndfile-${PV}.tar.bz2 \ 11SRC_URI = "https://github.com/libsndfile/libsndfile/releases/download/${PV}/libsndfile-${PV}.tar.bz2 \
12 file://noopus.patch \ 12 file://noopus.patch \
13 file://0001-flac-Fix-improper-buffer-reusing-732.patch \ 13 file://0001-flac-Fix-improper-buffer-reusing-732.patch \
14 file://CVE-2022-33065.patch \ 14 file://CVE-2022-33065-1.patch \
15 file://CVE-2022-33065-2.patch \
16 file://CVE-2022-33065-3.patch \
17 file://CVE-2022-33065-4.patch \
18 file://CVE-2022-33065-5.patch \
19 file://CVE-2022-33065-6.patch \
20 file://CVE-2022-33065-7.patch \
21 file://CVE-2022-33065-8.patch \
22 file://CVE-2022-33065-9.patch \
23 file://CVE-2022-33065-10.patch \
24 file://CVE-2022-33065-11.patch \
25 file://CVE-2022-33065-12.patch \
26 file://CVE-2022-33065-13.patch \
15 file://CVE-2024-50612.patch \ 27 file://CVE-2024-50612.patch \
16 " 28 "
17UPSTREAM_CHECK_URI = "https://github.com/libsndfile/libsndfile/releases/" 29UPSTREAM_CHECK_URI = "https://github.com/libsndfile/libsndfile/releases/"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-22 15:21:25 +0000