26 строки
1.0 KiB
Diff
26 строки
1.0 KiB
Diff
From ef3d8be0f80cbb650e4766b545d61e10d7a24c9e Mon Sep 17 00:00:00 2001
|
|
From: Mans Rullgard <mans@mansr.com>
|
|
Date: Sun, 5 Nov 2017 16:21:23 +0000
|
|
Subject: [PATCH] wav: ima_adpcm: fix buffer overflow on corrupt input
|
|
(CVE-2017-15370)
|
|
|
|
Add the same check bad block size as was done for MS adpcm in commit
|
|
f39c574b ("More checks for invalid MS ADPCM blocks").
|
|
---
|
|
src/wav.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/src/wav.c b/src/wav.c
|
|
index 5202556c..3e80e692 100644
|
|
--- a/src/wav.c
|
|
+++ b/src/wav.c
|
|
@@ -127,7 +127,7 @@ static unsigned short ImaAdpcmReadBlock(sox_format_t * ft)
|
|
/* work with partial blocks. Specs say it should be null */
|
|
/* padded but I guess this is better than trailing quiet. */
|
|
samplesThisBlock = lsx_ima_samples_in((size_t)0, (size_t)ft->signal.channels, bytesRead, (size_t) 0);
|
|
- if (samplesThisBlock == 0)
|
|
+ if (samplesThisBlock == 0 || samplesThisBlock > wav->samplesPerBlock)
|
|
{
|
|
lsx_warn("Premature EOF on .wav input file");
|
|
return 0;
|