03_CVE-2015-7747.patch 4.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157
  1. Description: fix buffer overflow when changing both sample format and
  2. number of channels
  3. Origin: https://github.com/mpruett/audiofile/pull/25
  4. Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/audiofile/+bug/1502721
  5. Bug-Debian: https://bugs.debian.org/801102
  6. --- a/libaudiofile/modules/ModuleState.cpp
  7. +++ b/libaudiofile/modules/ModuleState.cpp
  8. @@ -402,7 +402,7 @@ status ModuleState::arrange(AFfilehandle
  9. addModule(new Transform(outfc, in.pcm, out.pcm));
  10. if (in.channelCount != out.channelCount)
  11. - addModule(new ApplyChannelMatrix(infc, isReading,
  12. + addModule(new ApplyChannelMatrix(outfc, isReading,
  13. in.channelCount, out.channelCount,
  14. in.pcm.minClip, in.pcm.maxClip,
  15. track->channelMatrix));
  16. --- a/test/Makefile.am
  17. +++ b/test/Makefile.am
  18. @@ -26,6 +26,7 @@ TESTS = \
  19. VirtualFile \
  20. floatto24 \
  21. query2 \
  22. + sixteen-stereo-to-eight-mono \
  23. sixteen-to-eight \
  24. testchannelmatrix \
  25. testdouble \
  26. @@ -139,6 +140,7 @@ printmarkers_SOURCES = printmarkers.c
  27. printmarkers_LDADD = $(LIBAUDIOFILE) -lm
  28. sixteen_to_eight_SOURCES = sixteen-to-eight.c TestUtilities.cpp TestUtilities.h
  29. +sixteen_stereo_to_eight_mono_SOURCES = sixteen-stereo-to-eight-mono.c TestUtilities.cpp TestUtilities.h
  30. testchannelmatrix_SOURCES = testchannelmatrix.c TestUtilities.cpp TestUtilities.h
  31. --- /dev/null
  32. +++ b/test/sixteen-stereo-to-eight-mono.c
  33. @@ -0,0 +1,118 @@
  34. +/*
  35. + Audio File Library
  36. +
  37. + Copyright 2000, Silicon Graphics, Inc.
  38. +
  39. + This program is free software; you can redistribute it and/or modify
  40. + it under the terms of the GNU General Public License as published by
  41. + the Free Software Foundation; either version 2 of the License, or
  42. + (at your option) any later version.
  43. +
  44. + This program is distributed in the hope that it will be useful,
  45. + but WITHOUT ANY WARRANTY; without even the implied warranty of
  46. + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  47. + GNU General Public License for more details.
  48. +
  49. + You should have received a copy of the GNU General Public License along
  50. + with this program; if not, write to the Free Software Foundation, Inc.,
  51. + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  52. +*/
  53. +
  54. +/*
  55. + sixteen-stereo-to-eight-mono.c
  56. +
  57. + This program tests the conversion from 2-channel 16-bit integers to
  58. + 1-channel 8-bit integers.
  59. +*/
  60. +
  61. +#ifdef HAVE_CONFIG_H
  62. +#include <config.h>
  63. +#endif
  64. +
  65. +#include <stdint.h>
  66. +#include <stdio.h>
  67. +#include <stdlib.h>
  68. +#include <string.h>
  69. +#include <unistd.h>
  70. +#include <limits.h>
  71. +
  72. +#include <audiofile.h>
  73. +
  74. +#include "TestUtilities.h"
  75. +
  76. +int main (int argc, char **argv)
  77. +{
  78. + AFfilehandle file;
  79. + AFfilesetup setup;
  80. + int16_t frames16[] = {14298, 392, 3923, -683, 958, -1921};
  81. + int8_t frames8[] = {28, 6, -2};
  82. + int i, frameCount = 3;
  83. + int8_t byte;
  84. + AFframecount result;
  85. +
  86. + setup = afNewFileSetup();
  87. +
  88. + afInitFileFormat(setup, AF_FILE_WAVE);
  89. +
  90. + afInitSampleFormat(setup, AF_DEFAULT_TRACK, AF_SAMPFMT_TWOSCOMP, 16);
  91. + afInitChannels(setup, AF_DEFAULT_TRACK, 2);
  92. +
  93. + char *testFileName;
  94. + if (!createTemporaryFile("sixteen-to-eight", &testFileName))
  95. + {
  96. + fprintf(stderr, "Could not create temporary file.\n");
  97. + exit(EXIT_FAILURE);
  98. + }
  99. +
  100. + file = afOpenFile(testFileName, "w", setup);
  101. + if (file == AF_NULL_FILEHANDLE)
  102. + {
  103. + fprintf(stderr, "could not open file for writing\n");
  104. + exit(EXIT_FAILURE);
  105. + }
  106. +
  107. + afFreeFileSetup(setup);
  108. +
  109. + afWriteFrames(file, AF_DEFAULT_TRACK, frames16, frameCount);
  110. +
  111. + afCloseFile(file);
  112. +
  113. + file = afOpenFile(testFileName, "r", AF_NULL_FILESETUP);
  114. + if (file == AF_NULL_FILEHANDLE)
  115. + {
  116. + fprintf(stderr, "could not open file for reading\n");
  117. + exit(EXIT_FAILURE);
  118. + }
  119. +
  120. + afSetVirtualSampleFormat(file, AF_DEFAULT_TRACK, AF_SAMPFMT_TWOSCOMP, 8);
  121. + afSetVirtualChannels(file, AF_DEFAULT_TRACK, 1);
  122. +
  123. + for (i=0; i<frameCount; i++)
  124. + {
  125. + /* Read one frame. */
  126. + result = afReadFrames(file, AF_DEFAULT_TRACK, &byte, 1);
  127. +
  128. + if (result != 1)
  129. + break;
  130. +
  131. + /* Compare the byte read with its precalculated value. */
  132. + if (memcmp(&byte, &frames8[i], 1) != 0)
  133. + {
  134. + printf("error\n");
  135. + printf("expected %d, got %d\n", frames8[i], byte);
  136. + exit(EXIT_FAILURE);
  137. + }
  138. + else
  139. + {
  140. +#ifdef DEBUG
  141. + printf("got what was expected: %d\n", byte);
  142. +#endif
  143. + }
  144. + }
  145. +
  146. + afCloseFile(file);
  147. + unlink(testFileName);
  148. + free(testFileName);
  149. +
  150. + exit(EXIT_SUCCESS);
  151. +}