| Patrick Williams | c124f4f | 2015-09-15 14:41:29 -0500 | [diff] [blame] | 1 | From dbe14f00030af5d3577f4cabbf9861db59e9c378 Mon Sep 17 00:00:00 2001 |
| 2 | From: Erik de Castro Lopo <erikd@mega-nerd.com> |
| 3 | Date: Thu, 25 Dec 2014 19:23:12 +1100 |
| 4 | Subject: [PATCH] src/sd2.c : Fix two potential buffer read overflows. |
| 5 | |
| 6 | (Upstream commit dbe14f00030af5d3577f4cabbf9861db59e9c378) |
| 7 | |
| 8 | Closes: https://github.com/erikd/libsndfile/issues/93 |
| 9 | |
| 10 | Upstream-Status: Backport |
| 11 | |
| 12 | Signed-off-by: Yue Tao <yue.tao@windriver.com> |
| 13 | --- |
| 14 | src/sd2.c | 12 +++++++++++- |
| 15 | 1 file changed, 11 insertions(+), 1 deletion(-) |
| 16 | |
| 17 | diff --git a/src/sd2.c b/src/sd2.c |
| 18 | index 0b4e5af..a70a1f1 100644 |
| 19 | --- a/src/sd2.c |
| 20 | +++ b/src/sd2.c |
| 21 | @@ -517,6 +517,11 @@ sd2_parse_rsrc_fork (SF_PRIVATE *psf) |
| 22 | |
| 23 | rsrc.type_offset = rsrc.map_offset + 30 ; |
| 24 | |
| 25 | + if (rsrc.map_offset + 28 > rsrc.rsrc_len) |
| 26 | + { psf_log_printf (psf, "Bad map offset.\n") ; |
| 27 | + goto parse_rsrc_fork_cleanup ; |
| 28 | + } ; |
| 29 | + |
| 30 | rsrc.type_count = read_rsrc_short (&rsrc, rsrc.map_offset + 28) + 1 ; |
| 31 | if (rsrc.type_count < 1) |
| 32 | { psf_log_printf (psf, "Bad type count.\n") ; |
| 33 | @@ -533,7 +538,12 @@ sd2_parse_rsrc_fork (SF_PRIVATE *psf) |
| 34 | |
| 35 | rsrc.str_index = -1 ; |
| 36 | for (k = 0 ; k < rsrc.type_count ; k ++) |
| 37 | - { marker = read_rsrc_marker (&rsrc, rsrc.type_offset + k * 8) ; |
| 38 | + { if (rsrc.type_offset + k * 8 > rsrc.rsrc_len) |
| 39 | + { psf_log_printf (psf, "Bad rsrc marker.\n") ; |
| 40 | + goto parse_rsrc_fork_cleanup ; |
| 41 | + } ; |
| 42 | + |
| 43 | + marker = read_rsrc_marker (&rsrc, rsrc.type_offset + k * 8) ; |
| 44 | |
| 45 | if (marker == STR_MARKER) |
| 46 | { rsrc.str_index = k ; |
| 47 | -- |
| 48 | 1.7.9.5 |
| 49 | |