已开启
fix(cve): 修复 CVE-2017-6836 在 audiofile 中的漏洞 #56
infra_team创建于 5月18日
fix(cve): 修复 CVE-2017-6836 在 audiofile 中的漏洞 #56
已开启
共 2 个文件变更+49-1
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: audiofile | 1 | Name: audiofile |
| 2 | Version: 0.3.6 | 2 | Version: 0.3.6 |
| 3 | -Release: 32 | 3 | +Release: 33 |
| 4 | Summary: Library for reading and writing audio files in many common formats | 4 | Summary: Library for reading and writing audio files in many common formats |
| 5 | License: LGPL-2.1-or-later and GPL-2.0-or-later | 5 | License: LGPL-2.1-or-later and GPL-2.0-or-later |
| 6 | URL: http://audiofile.68k.org/ | 6 | URL: http://audiofile.68k.org/ |
| @@ -19,6 +19,7 @@ Patch10: backport-Partial0-CVE-2019-13147.patch | |||
| 19 | Patch11: backport-Partial1-CVE-2019-13147.patch | 19 | Patch11: backport-Partial1-CVE-2019-13147.patch |
| 20 | Patch12: CVE-2018-13440.patch | 20 | Patch12: CVE-2018-13440.patch |
| 21 | Patch13: CVE-2018-17095.patch | 21 | Patch13: CVE-2018-17095.patch |
| 22 | +Patch14: backport-CVE-2017-6836.patch | ||
| 22 | 23 | ||
| 23 | BuildRequires: gcc-c++ libtool alsa-lib-devel flac-devel chrpath | 24 | BuildRequires: gcc-c++ libtool alsa-lib-devel flac-devel chrpath |
| 24 | 25 | ||
| @@ -75,6 +76,9 @@ chrpath --delete %{buildroot}%{_bindir}/sfconvert | |||
| 75 | %{_mandir}/man3/* | 76 | %{_mandir}/man3/* |
| 76 | 77 | ||
| 77 | %changelog | 78 | %changelog |
| 79 | +* Mon May 18 2026 infra_team <zhaiwenjie1@huawei.com> - 0.3.6-33 | ||
| 80 | +- fix CVE-2017-6836 | ||
| 81 | + | ||
| 78 | * Tue May 12 2026 Funda Wang <fundawang@yeah.net> - 0.3.6-32 | 82 | * Tue May 12 2026 Funda Wang <fundawang@yeah.net> - 0.3.6-32 |
| 79 | - fix CVE-2018-13440, CVE-2018-17095 | 83 | - fix CVE-2018-13440, CVE-2018-17095 |
| 80 | 84 | ||
| @@ -0,0 +1,44 @@ | |||
| 1 | +From e55a45381a2c743cb6c127c5924d268a20d68961 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: HouRunZe <1043170898@qq.com> | ||
| 3 | +Date: Mon, 18 May 2026 15:20:54 +0800 | ||
| 4 | +Subject: [PATCH] fix CVE-2017-6836: Check for multiplication overflow in | ||
| 5 | + Expand3To4Module | ||
| 6 | + | ||
| 7 | +--- | ||
| 8 | + libaudiofile/modules/SimpleModule.h | 13 +++++++++++++ | ||
| 9 | + 1 file changed, 13 insertions(+) | ||
| 10 | + | ||
| 11 | +diff --git a/libaudiofile/modules/SimpleModule.h b/libaudiofile/modules/SimpleModule.h | ||
| 12 | +index 03c6c69..05a8503 100644 | ||
| 13 | +--- a/libaudiofile/modules/SimpleModule.h | ||
| 14 | ++++ b/libaudiofile/modules/SimpleModule.h | ||
| 15 | + | ||
| 16 | + #include <cassert> | ||
| 17 | + #include <climits> | ||
| 18 | + #include <functional> | ||
| 19 | ++#ifndef __has_builtin | ||
| 20 | ++#define __has_builtin(x) 0 | ||
| 21 | ++#endif | ||
| 22 | ++ | ||
| 23 | ++static inline int overflowCheck(int a, int b) | ||
| 24 | ++{ | ||
| 25 | ++ return (a > 0 && b > 0 && a > INT_MAX / b); | ||
| 26 | ++} | ||
| 27 | + | ||
| 28 | + class SimpleModule : public Module | ||
| 29 | + { | ||
| 30 | + public: | ||
| 31 | + } | ||
| 32 | + virtual void run(Chunk &inChunk, Chunk &outChunk) OVERRIDE | ||
| 33 | + { | ||
| 34 | ++ if (overflowCheck(inChunk.f.channelCount, inChunk.frameCount)) | ||
| 35 | ++ { | ||
| 36 | ++ _af_error(AF_BAD_COMPRESSION, "Error in expand3to4: multiplication overflow"); | ||
| 37 | ++ return; | ||
| 38 | ++ } | ||
| 39 | + int count = inChunk.f.channelCount * inChunk.frameCount; | ||
| 40 | + if (m_isSigned) | ||
| 41 | + run<int32_t>(reinterpret_cast<const uint8_t *>(inChunk.buffer), | ||
| 42 | +-- | ||
| 43 | +2.43.0 | ||
| 44 | + | ||