1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
|
From 18f018cd774cb931116ce06a520dc0c5f9443932 Mon Sep 17 00:00:00 2001
From: Ron <ron@debian.org>
Date: Wed, 27 Sep 2017 03:36:51 +0930
Subject: [PATCH] Properly zero initialise the ogg and vorbis state structs
This prevents things from exploding in flames if an error occurs and the
code tries to unwind before the codec and container initialiser functions
can all be called. It fixes the second issue indicated in CVE-2017-11333,
which isn't the fault of libvorbis, it's caused by us passing junk data
to vorbis_block_clear() when an invalid file is detected and we bail out
before vorbis_block_init() gets called.
Ideally, we should simplify all of this and get rid of most of the malloc
farm there by embedding the needed structs in splt_ogg_state (instead of
pointers to them), then just do a single malloc and memset for the whole
lot - but that would be a much more intrusive change, so for now just
ensure the allocated memory is all safely zeroed in the simplest manner.
---
libmp3splt/plugins/ogg.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/libmp3splt/plugins/ogg.c b/libmp3splt/plugins/ogg.c
index 50cc495..57745f1 100644
--- a/libmp3splt/plugins/ogg.c
+++ b/libmp3splt/plugins/ogg.c
@@ -212,26 +212,36 @@ static splt_ogg_state *splt_ogg_v_new(int *error)
goto error;
}
memset(oggstate, 0, sizeof(splt_ogg_state));
+
if ((oggstate->sync_in = malloc(sizeof(ogg_sync_state)))==NULL)
{
goto error;
}
+ memset(oggstate->sync_in, 0, sizeof(ogg_sync_state));
+
if ((oggstate->stream_in = malloc(sizeof(ogg_stream_state)))==NULL)
{
goto error;
}
+ memset(oggstate->stream_in, 0, sizeof(ogg_stream_state));
+
if ((oggstate->vd = malloc(sizeof(vorbis_dsp_state)))==NULL)
{
goto error;
}
+ memset(oggstate->vd, 0, sizeof(vorbis_dsp_state));
+
if ((oggstate->vi = malloc(sizeof(vorbis_info)))==NULL)
{
goto error;
}
+ memset(oggstate->vi, 0, sizeof(vorbis_info));
+
if ((oggstate->vb = malloc(sizeof(vorbis_block)))==NULL)
{
goto error;
}
+ memset(oggstate->vb, 0, sizeof(vorbis_block));
if ((oggstate->headers = malloc(sizeof(splt_v_packet) * TOTAL_HEADER_PACKETS))==NULL)
{
--
2.29.2
|