已开启
fix(cve): 修复 CVE-2017-6834 在 audiofile 中的漏洞 #58
infra_team创建于 5月18日
fix(cve): 修复 CVE-2017-6834 在 audiofile 中的漏洞 #58
已开启
共 2 个文件变更+75-1
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: audiofile | 1 | Name: audiofile |
| 2 | Version: 0.3.6 | 2 | Version: 0.3.6 |
| 3 | -Release: 32 | 3 | +Release: 33 |
| 4 | Summary: Library for reading and writing audio files in many common formats | 4 | Summary: Library for reading and writing audio files in many common formats |
| 5 | License: LGPL-2.1-or-later and GPL-2.0-or-later | 5 | License: LGPL-2.1-or-later and GPL-2.0-or-later |
| 6 | URL: http://audiofile.68k.org/ | 6 | URL: http://audiofile.68k.org/ |
| @@ -19,6 +19,7 @@ Patch10: backport-Partial0-CVE-2019-13147.patch | |||
| 19 | Patch11: backport-Partial1-CVE-2019-13147.patch | 19 | Patch11: backport-Partial1-CVE-2019-13147.patch |
| 20 | Patch12: CVE-2018-13440.patch | 20 | Patch12: CVE-2018-13440.patch |
| 21 | Patch13: CVE-2018-17095.patch | 21 | Patch13: CVE-2018-17095.patch |
| 22 | +Patch14: backport-CVE-2017-6834.patch | ||
| 22 | 23 | ||
| 23 | BuildRequires: gcc-c++ libtool alsa-lib-devel flac-devel chrpath | 24 | BuildRequires: gcc-c++ libtool alsa-lib-devel flac-devel chrpath |
| 24 | 25 | ||
| @@ -75,6 +76,9 @@ chrpath --delete %{buildroot}%{_bindir}/sfconvert | |||
| 75 | %{_mandir}/man3/* | 76 | %{_mandir}/man3/* |
| 76 | 77 | ||
| 77 | %changelog | 78 | %changelog |
| 79 | +* Mon May 18 2026 infra_team <zhaiwenjie1@huawei.com> - 0.3.6-33 | ||
| 80 | +- fix CVE-2017-6834: heap buffer overflow in G711.cpp | ||
| 81 | + | ||
| 78 | * Tue May 12 2026 Funda Wang <fundawang@yeah.net> - 0.3.6-32 | 82 | * Tue May 12 2026 Funda Wang <fundawang@yeah.net> - 0.3.6-32 |
| 79 | - fix CVE-2018-13440, CVE-2018-17095 | 83 | - fix CVE-2018-13440, CVE-2018-17095 |
| 80 | 84 | ||
| @@ -0,0 +1,70 @@ | |||
| 1 | +diff --git a/libaudiofile/modules/G711.cpp b/libaudiofile/modules/G711.cpp | ||
| 2 | +index cb93af9..e75f00c 100644 | ||
| 3 | +--- a/libaudiofile/modules/G711.cpp | ||
| 4 | ++++ b/libaudiofile/modules/G711.cpp | ||
| 5 | + | ||
| 6 | + | ||
| 7 | + #include "../g711.h" | ||
| 8 | + | ||
| 9 | ++int firstBitSet(int x) | ||
| 10 | ++{ | ||
| 11 | ++ int position=0; | ||
| 12 | ++ while (x!=0) | ||
| 13 | ++ { | ||
| 14 | ++ x>>=1; | ||
| 15 | ++ ++position; | ||
| 16 | ++ } | ||
| 17 | ++ return position; | ||
| 18 | ++} | ||
| 19 | ++ | ||
| 20 | ++#ifndef __has_builtin | ||
| 21 | ++#define __has_builtin(x) 0 | ||
| 22 | ++#endif | ||
| 23 | ++ | ||
| 24 | ++int multiplyCheckOverflow(int a, int b, int *result) | ||
| 25 | ++{ | ||
| 26 | ++#if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow)) | ||
| 27 | ++ return __builtin_mul_overflow(a, b, result); | ||
| 28 | ++#else | ||
| 29 | ++ if (firstBitSet(a)+firstBitSet(b)>31) | ||
| 30 | ++ return true; | ||
| 31 | ++ *result = a * b; | ||
| 32 | ++ return false; | ||
| 33 | ++#endif | ||
| 34 | ++} | ||
| 35 | ++ | ||
| 36 | + static void ulaw2linear_buf (const uint8_t *ulaw, int16_t *linear, int nsamples) | ||
| 37 | + { | ||
| 38 | + for (int i=0; i < nsamples; i++) | ||
| 39 | + G711 *G711::createCompress(Track *track, File *fh, | ||
| 40 | + void G711::runPush() | ||
| 41 | + { | ||
| 42 | + AFframecount framesToWrite = m_inChunk->frameCount; | ||
| 43 | +- AFframecount samplesToWrite = m_inChunk->frameCount * m_inChunk->f.channelCount; | ||
| 44 | ++ int samplesToWrite; | ||
| 45 | + int framesize = m_inChunk->f.channelCount; | ||
| 46 | + | ||
| 47 | ++ while (multiplyCheckOverflow(m_inChunk->frameCount, framesize, &samplesToWrite)) | ||
| 48 | ++ m_inChunk->frameCount /= 2; | ||
| 49 | ++ | ||
| 50 | ++ framesToWrite = m_inChunk->frameCount; | ||
| 51 | ++ | ||
| 52 | + assert(m_track->f.compressionType == AF_COMPRESSION_G711_ULAW || | ||
| 53 | + m_track->f.compressionType == AF_COMPRESSION_G711_ALAW); | ||
| 54 | + | ||
| 55 | + G711 *G711::createDecompress(Track *track, File *fh, | ||
| 56 | + void G711::runPull() | ||
| 57 | + { | ||
| 58 | + AFframecount framesToRead = m_outChunk->frameCount; | ||
| 59 | +- AFframecount samplesToRead = m_outChunk->frameCount * m_outChunk->f.channelCount; | ||
| 60 | ++ int samplesToRead; | ||
| 61 | + int framesize = m_outChunk->f.channelCount; | ||
| 62 | + | ||
| 63 | ++ while (multiplyCheckOverflow(m_outChunk->frameCount, framesize, &samplesToRead)) | ||
| 64 | ++ m_outChunk->frameCount /= 2; | ||
| 65 | ++ | ||
| 66 | ++ framesToRead = m_outChunk->frameCount; | ||
| 67 | ++ | ||
| 68 | + /* Read the compressed frames. */ | ||
| 69 | + | ||
| 70 | + ssize_t bytesRead = read(m_inChunk->buffer, framesize * framesToRead); | ||