zepto-forks/meta-qt5-extra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

timidity++: fix CVE-2017-11546 and CVE-2017-11547

Browse Source 
Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
This commit is contained in:
Andreas Müller
2018-08-10 23:17:11 +02:00
parent d06330e0bd
commit 016b3e002c
3 changed files with 92 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
recipes-misc/recipes-multimedia/timidity++/files/0003-timidity-readmidi-zero-division-fix.patch Normal file
View File

@@ -0,0 +1,27 @@
From: Takashi Iwai <tiwai@suse.de>
Subject: readmidi: Fix division by zero
References: CVE-2017-11546
An adhoc fix for division by zero in insert_note_steps().
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Stolen from [1]
[1] https://src.fedoraproject.org/cgit/rpms/timidity++.git/tree/timidity-readmidi-zero-division-fix.patch
---
timidity/readmidi.c | 2 ++
1 file changed, 2 insertions(+)
--- a/timidity/readmidi.c
+++ b/timidity/readmidi.c
@@ -4585,6 +4585,8 @@ static void insert_note_steps(void)
if (beat != 0)
meas++, beat = 0;
num = timesig[n].a, denom = timesig[n].b, n++;
+ if (!denom)
+ denom = 1;
}
a = (meas + 1) & 0xff;
b = (((meas + 1) >> 8) & 0x0f) + ((beat + 1) << 4);

60
recipes-misc/recipes-multimedia/timidity++/files/0004-timidity-resample-frac-overflow-fix.patch Normal file
View File

@@ -0,0 +1,60 @@
From: Takashi Iwai <tiwai@suse.de>
Subject: resample: Fix out-of-bound access in resamplers
References: CVE-2017-11547
An adhoc fix for out-of-bound accesses in resamples.
The offset might overflow the given data range.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Stolen from [1]
[1] https://src.fedoraproject.org/cgit/rpms/timidity++.git/tree/timidity-resample-frac-overflow-fix.patch
--- a/timidity/resample.c
+++ b/timidity/resample.c
@@ -57,6 +57,8 @@ static resample_t resample_cspline(sample_t *src, splen_t ofs, resample_rec_t *r
{
int32 ofsi, ofsf, v0, v1, v2, v3, temp;
+ if (ofs + (1 << FRACTION_BITS) >= rec->data_length)
+ return src[ofs >> FRACTION_BITS];
ofsi = ofs >> FRACTION_BITS;
v1 = src[ofsi];
v2 = src[ofsi + 1];
@@ -96,6 +98,8 @@ static resample_t resample_lagrange(sample_t *src, splen_t ofs, resample_rec_t *
{
int32 ofsi, ofsf, v0, v1, v2, v3;
+ if (ofs + (1 << FRACTION_BITS) >= rec->data_length)
+ return src[ofs >> FRACTION_BITS];
ofsi = ofs >> FRACTION_BITS;
v1 = (int32)src[ofsi];
v2 = (int32)src[ofsi + 1];
@@ -154,6 +158,8 @@ static resample_t resample_gauss(sample_t *src, splen_t ofs, resample_rec_t *rec
sample_t *sptr;
int32 left, right, temp_n;
+ if (ofs + (1 << FRACTION_BITS) >= rec->data_length)
+ return src[ofs >> FRACTION_BITS];
left = (ofs>>FRACTION_BITS);
right = (rec->data_length>>FRACTION_BITS) - left - 1;
temp_n = (right<<1)-1;
@@ -261,6 +267,8 @@ static resample_t resample_newton(sample_t *src, splen_t ofs, resample_rec_t *re
int32 left, right, temp_n;
int ii, jj;
+ if (ofs + (1 << FRACTION_BITS) >= rec->data_length)
+ return src[ofs >> FRACTION_BITS];
left = (ofs>>FRACTION_BITS);
right = (rec->data_length>>FRACTION_BITS)-(ofs>>FRACTION_BITS)-1;
temp_n = (right<<1)-1;
@@ -330,6 +338,8 @@ static resample_t resample_linear(sample_t *src, splen_t ofs, resample_rec_t *re
{
int32 v1, v2, ofsi;
+ if (ofs + (1 << FRACTION_BITS) >= rec->data_length)
+ return src[ofs >> FRACTION_BITS];
ofsi = ofs >> FRACTION_BITS;
v1 = src[ofsi];
v2 = src[ofsi + 1];

6
recipes-misc/recipes-multimedia/timidity++/timidity++.inc
View File

@@ -7,7 +7,11 @@ PV = "2.14.0"
UPSTREAM_PN = "TiMidity++"
SRC_URI = "${SOURCEFORGE_MIRROR}/project/timidity/${UPSTREAM_PN}/${UPSTREAM_PN}-${PV}/${UPSTREAM_PN}-${PV}.tar.xz"
SRC_URI = " \
${SOURCEFORGE_MIRROR}/project/timidity/${UPSTREAM_PN}/${UPSTREAM_PN}-${PV}/${UPSTREAM_PN}-${PV}.tar.xz \
file://0003-timidity-readmidi-zero-division-fix.patch \
file://0004-timidity-resample-frac-overflow-fix.patch \
"
SRC_URI[md5sum] = "27927182d62ba24abbf447a9e9919c53"
SRC_URI[sha256sum] = "abf0c8367959e85c9e635b8fbd5183fc27bd380e0ef5e45de4158784538c86fc"