已关闭
fix(cve): 修复 CVE-2017-6835 在 audiofile 中的漏洞 #57
infra_team创建于 5月18日关闭于 21 天前
fix(cve): 修复 CVE-2017-6835 在 audiofile 中的漏洞 #57
已关闭
共 2 个文件变更+54-1
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: audiofile | 1 | Name: audiofile |
| 2 | Version: 0.3.6 | 2 | Version: 0.3.6 |
| 3 | -Release: 32 | 3 | +Release: 34 |
| 4 | Summary: Library for reading and writing audio files in many common formats | 4 | Summary: Library for reading and writing audio files in many common formats |
| 5 | License: LGPL-2.1-or-later and GPL-2.0-or-later | 5 | License: LGPL-2.1-or-later and GPL-2.0-or-later |
| 6 | URL: http://audiofile.68k.org/ | 6 | URL: http://audiofile.68k.org/ |
| @@ -19,6 +19,7 @@ Patch10: backport-Partial0-CVE-2019-13147.patch | |||
| 19 | Patch11: backport-Partial1-CVE-2019-13147.patch | 19 | Patch11: backport-Partial1-CVE-2019-13147.patch |
| 20 | Patch12: CVE-2018-13440.patch | 20 | Patch12: CVE-2018-13440.patch |
| 21 | Patch13: CVE-2018-17095.patch | 21 | Patch13: CVE-2018-17095.patch |
| 22 | +Patch14: backport-CVE-2017-6835-CVE-2017-6833.patch | ||
| 22 | 23 | ||
| 23 | BuildRequires: gcc-c++ libtool alsa-lib-devel flac-devel chrpath | 24 | BuildRequires: gcc-c++ libtool alsa-lib-devel flac-devel chrpath |
| 24 | 25 | ||
| @@ -75,6 +76,9 @@ chrpath --delete %{buildroot}%{_bindir}/sfconvert | |||
| 75 | %{_mandir}/man3/* | 76 | %{_mandir}/man3/* |
| 76 | 77 | ||
| 77 | %changelog | 78 | %changelog |
| 79 | +* Mon May 18 2026 infra_team <zhaiwenjie1@huawei.com> - 0.3.6-34 | ||
| 80 | +- fix CVE-2017-6835 CVE-2017-6833 in BlockCodec.cpp | ||
| 81 | + | ||
| 78 | * Tue May 12 2026 Funda Wang <fundawang@yeah.net> - 0.3.6-32 | 82 | * Tue May 12 2026 Funda Wang <fundawang@yeah.net> - 0.3.6-32 |
| 79 | - fix CVE-2018-13440, CVE-2018-17095 | 83 | - fix CVE-2018-13440, CVE-2018-17095 |
| 80 | 84 | ||
| @@ -0,0 +1,49 @@ | |||
| 1 | +From: infra_team <zhaiwenjie1@huawei.com> | ||
| 2 | +Date: Sun, 18 May 2026 16:10:00 +0800 | ||
| 3 | +Subject: [PATCH] fix CVE-2017-6835 CVE-2017-6833 - BlockCodec divide-by-zero | ||
| 4 | + | ||
| 5 | +Fix divide-by-zero vulnerabilities in BlockCodec.cpp: | ||
| 6 | +- CVE-2017-6833: runPull function - check m_bytesPerPacket > 0 before division | ||
| 7 | +- CVE-2017-6835: reset1/reset2 functions - check m_framesPerPacket > 0 before division | ||
| 8 | + | ||
| 9 | +Upstream-issue: https://github.com/mpruett/audiofile/issues/39 | ||
| 10 | + | ||
| 11 | +Signed-off-by: infra_team <zhaiwenjie1@huawei.com> | ||
| 12 | + | ||
| 13 | +--- a/libaudiofile/modules/BlockCodec.cpp | ||
| 14 | ++++ b/libaudiofile/modules/BlockCodec.cpp | ||
| 15 | +@@ -42,6 +42,10 @@ | ||
| 16 | + AFframecount framesToRead = m_outChunk->frameCount; | ||
| 17 | + AFframecount framesRead = 0; | ||
| 18 | + | ||
| 19 | ++ // CVE-2017-6833: prevent divide-by-zero in bytesRead / m_bytesPerPacket | ||
| 20 | ++ if (m_bytesPerPacket <= 0 || m_framesPerPacket <= 0) | ||
| 21 | ++ return; | ||
| 22 | ++ | ||
| 23 | + assert(framesToRead % m_framesPerPacket == 0); | ||
| 24 | + int blockCount = framesToRead / m_framesPerPacket; | ||
| 25 | + | ||
| 26 | +@@ -71,6 +75,11 @@ | ||
| 27 | + void BlockCodec::reset1() | ||
| 28 | + { | ||
| 29 | + AFframecount nextTrackFrame = m_track->nextfframe; | ||
| 30 | ++ | ||
| 31 | ++ // CVE-2017-6835: prevent divide-by-zero in nextTrackFrame / m_framesPerPacket | ||
| 32 | ++ if (m_framesPerPacket <= 0) | ||
| 33 | ++ return; | ||
| 34 | ++ | ||
| 35 | + m_track->nextfframe = (nextTrackFrame / m_framesPerPacket) * | ||
| 36 | + m_framesPerPacket; | ||
| 37 | + | ||
| 38 | +@@ -79,6 +88,10 @@ | ||
| 39 | + | ||
| 40 | + void BlockCodec::reset2() | ||
| 41 | + { | ||
| 42 | ++ // CVE-2017-6835: prevent divide-by-zero in m_track->nextfframe / m_framesPerPacket | ||
| 43 | ++ if (m_framesPerPacket <= 0) | ||
| 44 | ++ return; | ||
| 45 | ++ | ||
| 46 | + m_track->fpos_next_frame = m_track->fpos_first_frame + | ||
| 47 | + m_bytesPerPacket * (m_track->nextfframe / m_framesPerPacket); | ||
| 48 | + m_track->frames2ignore += m_framesToIgnore; | ||
| 49 | + | ||