已开启
[sync] PR-59: fix(cve): 修复 CVE-2017-6830 在 audiofile 中的漏洞 #64
openeuler-ci-bot创建于 6月9日
[sync] PR-59: fix(cve): 修复 CVE-2017-6830 在 audiofile 中的漏洞 #64
已开启
共 2 个文件变更+62-1
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: audiofile | 1 | Name: audiofile |
| 2 | Version: 0.3.6 | 2 | Version: 0.3.6 |
| 3 | -Release: 32 | 3 | +Release: 33 |
| 4 | Summary: Library for reading and writing audio files in many common formats | 4 | Summary: Library for reading and writing audio files in many common formats |
| 5 | License: LGPL-2.1-or-later and GPL-2.0-or-later | 5 | License: LGPL-2.1-or-later and GPL-2.0-or-later |
| 6 | URL: http://audiofile.68k.org/ | 6 | URL: http://audiofile.68k.org/ |
| @@ -19,6 +19,7 @@ Patch10: backport-Partial0-CVE-2019-13147.patch | |||
| 19 | Patch11: backport-Partial1-CVE-2019-13147.patch | 19 | Patch11: backport-Partial1-CVE-2019-13147.patch |
| 20 | Patch12: CVE-2018-13440.patch | 20 | Patch12: CVE-2018-13440.patch |
| 21 | Patch13: CVE-2018-17095.patch | 21 | Patch13: CVE-2018-17095.patch |
| 22 | +Patch14: backport-CVE-2017-6830.patch | ||
| 22 | 23 | ||
| 23 | BuildRequires: gcc-c++ libtool alsa-lib-devel flac-devel chrpath | 24 | BuildRequires: gcc-c++ libtool alsa-lib-devel flac-devel chrpath |
| 24 | 25 | ||
| @@ -75,6 +76,9 @@ chrpath --delete %{buildroot}%{_bindir}/sfconvert | |||
| 75 | %{_mandir}/man3/* | 76 | %{_mandir}/man3/* |
| 76 | 77 | ||
| 77 | %changelog | 78 | %changelog |
| 79 | +* Mon May 18 2026 infra_team <zhaiwenjie1@huawei.com> - 0.3.6-33 | ||
| 80 | +- fix CVE-2017-6830 | ||
| 81 | + | ||
| 78 | * Tue May 12 2026 Funda Wang <fundawang@yeah.net> - 0.3.6-32 | 82 | * Tue May 12 2026 Funda Wang <fundawang@yeah.net> - 0.3.6-32 |
| 79 | - fix CVE-2018-13440, CVE-2018-17095 | 83 | - fix CVE-2018-13440, CVE-2018-17095 |
| 80 | 84 | ||
| @@ -0,0 +1,57 @@ | |||
| 1 | +From: Antonio Larrosa <larrosa@kde.org> | ||
| 2 | +Date: Mon, 6 Mar 2017 13:43:53 +0100 | ||
| 3 | +Subject: [PATCH] Check for multiplication overflow in G711 runPull | ||
| 4 | + | ||
| 5 | +Check for multiplication overflow when calculating samplesToRead | ||
| 6 | +in G711.cpp runPull(). If the multiplication of frameCount and | ||
| 7 | +channelCount would overflow, report an error and return. | ||
| 8 | + | ||
| 9 | +This fixes CVE-2017-6830: heap-based buffer overflow in | ||
| 10 | +alaw2linear_buf function in G711.cpp. | ||
| 11 | + | ||
| 12 | +Signed-off-by: infra_team <zhaiwenjie1@huawei.com> | ||
| 13 | +--- | ||
| 14 | + libaudiofile/modules/G711.cpp | 23 ++++++++++++++++++++++- | ||
| 15 | + 1 file changed, 22 insertions(+), 1 deletion(-) | ||
| 16 | + | ||
| 17 | +diff --git a/libaudiofile/modules/G711.cpp b/libaudiofile/modules/G711.cpp | ||
| 18 | +--- a/libaudiofile/modules/G711.cpp | ||
| 19 | ++++ b/libaudiofile/modules/G711.cpp | ||
| 20 | + | ||
| 21 | + | ||
| 22 | + #include "../g711.h" | ||
| 23 | + | ||
| 24 | ++#include <limits.h> | ||
| 25 | ++ | ||
| 26 | ++#ifndef __has_builtin | ||
| 27 | ++#define __has_builtin(x) 0 | ||
| 28 | ++#endif | ||
| 29 | ++ | ||
| 30 | ++static bool multiplyCheckOverflow(AFframecount a, int b, AFframecount *result) | ||
| 31 | ++{ | ||
| 32 | ++#if (defined __GNUC__ && __GNUC__ >= 5) || (__clang__ && __has_builtin(__builtin_mul_overflow)) | ||
| 33 | ++ return __builtin_mul_overflow(a, b, result); | ||
| 34 | ++#else | ||
| 35 | ++ if (a > INT_MAX / b) | ||
| 36 | ++ return true; | ||
| 37 | ++ *result = a * b; | ||
| 38 | ++ return false; | ||
| 39 | ++#endif | ||
| 40 | ++} | ||
| 41 | ++ | ||
| 42 | + static void ulaw2linear_buf (const uint8_t *ulaw, int16_t *linear, int nsamples) | ||
| 43 | + { | ||
| 44 | + for (int i=0; i < nsamples; i++) | ||
| 45 | + void G711::runPull() | ||
| 46 | + { | ||
| 47 | + AFframecount framesToRead = m_outChunk->frameCount; | ||
| 48 | +- AFframecount samplesToRead = m_outChunk->frameCount * m_outChunk->f.channelCount; | ||
| 49 | ++ AFframecount samplesToRead; | ||
| 50 | ++ if (multiplyCheckOverflow(m_outChunk->frameCount, m_outChunk->f.channelCount, &samplesToRead)) | ||
| 51 | ++ { | ||
| 52 | ++ _af_error(AF_BAD_COMPRESSION, "Error calculating samples to read"); | ||
| 53 | ++ return; | ||
| 54 | ++ } | ||
| 55 | + int framesize = m_outChunk->f.channelCount; | ||
| 56 | + | ||
| 57 | + /* Read the compressed frames. */ | ||