Brad Bishop | 316dfdd | 2018-06-25 12:45:53 -0400 | [diff] [blame^] | 1 | From 3a017f591457bf6e80231b563bf83ee583fdbca8 Mon Sep 17 00:00:00 2001 |
| 2 | From: Thomas Daede <daede003@umn.edu> |
| 3 | Date: Thu, 15 Mar 2018 14:15:31 -0700 |
| 4 | Subject: [PATCH] CVE-2018-5146: Prevent out-of-bounds write in codebook |
| 5 | decoding. |
| 6 | |
| 7 | Codebooks that are not an exact divisor of the partition size are now |
| 8 | truncated to fit within the partition. |
| 9 | |
| 10 | Upstream-Status: Backport |
| 11 | CVE: CVE-2018-5146 |
| 12 | |
| 13 | Reference to upstream patch: |
| 14 | https://git.xiph.org/?p=vorbis.git;a=commitdiff;h=667ceb4aab60c1f74060143bb24e5f427b3cce5f |
| 15 | |
| 16 | Signed-off-by: Tanu Kaskinen <tanuk@iki.fi> |
| 17 | --- |
| 18 | lib/codebook.c | 48 ++++++++++-------------------------------------- |
| 19 | 1 file changed, 10 insertions(+), 38 deletions(-) |
| 20 | |
| 21 | diff --git a/lib/codebook.c b/lib/codebook.c |
| 22 | index 8b766e8..7022fd2 100644 |
| 23 | --- a/lib/codebook.c |
| 24 | +++ b/lib/codebook.c |
| 25 | @@ -387,7 +387,7 @@ long vorbis_book_decodevs_add(codebook *book,float *a,oggpack_buffer *b,int n){ |
| 26 | t[i] = book->valuelist+entry[i]*book->dim; |
| 27 | } |
| 28 | for(i=0,o=0;i<book->dim;i++,o+=step) |
| 29 | - for (j=0;j<step;j++) |
| 30 | + for (j=0;o+j<n && j<step;j++) |
| 31 | a[o+j]+=t[j][i]; |
| 32 | } |
| 33 | return(0); |
| 34 | @@ -399,41 +399,12 @@ long vorbis_book_decodev_add(codebook *book,float *a,oggpack_buffer *b,int n){ |
| 35 | int i,j,entry; |
| 36 | float *t; |
| 37 | |
| 38 | - if(book->dim>8){ |
| 39 | - for(i=0;i<n;){ |
| 40 | - entry = decode_packed_entry_number(book,b); |
| 41 | - if(entry==-1)return(-1); |
| 42 | - t = book->valuelist+entry*book->dim; |
| 43 | - for (j=0;j<book->dim;) |
| 44 | - a[i++]+=t[j++]; |
| 45 | - } |
| 46 | - }else{ |
| 47 | - for(i=0;i<n;){ |
| 48 | - entry = decode_packed_entry_number(book,b); |
| 49 | - if(entry==-1)return(-1); |
| 50 | - t = book->valuelist+entry*book->dim; |
| 51 | - j=0; |
| 52 | - switch((int)book->dim){ |
| 53 | - case 8: |
| 54 | - a[i++]+=t[j++]; |
| 55 | - case 7: |
| 56 | - a[i++]+=t[j++]; |
| 57 | - case 6: |
| 58 | - a[i++]+=t[j++]; |
| 59 | - case 5: |
| 60 | - a[i++]+=t[j++]; |
| 61 | - case 4: |
| 62 | - a[i++]+=t[j++]; |
| 63 | - case 3: |
| 64 | - a[i++]+=t[j++]; |
| 65 | - case 2: |
| 66 | - a[i++]+=t[j++]; |
| 67 | - case 1: |
| 68 | - a[i++]+=t[j++]; |
| 69 | - case 0: |
| 70 | - break; |
| 71 | - } |
| 72 | - } |
| 73 | + for(i=0;i<n;){ |
| 74 | + entry = decode_packed_entry_number(book,b); |
| 75 | + if(entry==-1)return(-1); |
| 76 | + t = book->valuelist+entry*book->dim; |
| 77 | + for(j=0;i<n && j<book->dim;) |
| 78 | + a[i++]+=t[j++]; |
| 79 | } |
| 80 | } |
| 81 | return(0); |
| 82 | @@ -471,12 +442,13 @@ long vorbis_book_decodevv_add(codebook *book,float **a,long offset,int ch, |
| 83 | long i,j,entry; |
| 84 | int chptr=0; |
| 85 | if(book->used_entries>0){ |
| 86 | - for(i=offset/ch;i<(offset+n)/ch;){ |
| 87 | + int m=(offset+n)/ch; |
| 88 | + for(i=offset/ch;i<m;){ |
| 89 | entry = decode_packed_entry_number(book,b); |
| 90 | if(entry==-1)return(-1); |
| 91 | { |
| 92 | const float *t = book->valuelist+entry*book->dim; |
| 93 | - for (j=0;j<book->dim;j++){ |
| 94 | + for (j=0;i<m && j<book->dim;j++){ |
| 95 | a[chptr++][i]+=t[j]; |
| 96 | if(chptr==ch){ |
| 97 | chptr=0; |
| 98 | -- |
| 99 | 2.16.2 |
| 100 | |