From 016b3e002c751ac9f66542a45dd174456ea3c6a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andreas=20M=C3=BCller?= Date: Fri, 10 Aug 2018 23:17:11 +0200 Subject: [PATCH] timidity++: fix CVE-2017-11546 and CVE-2017-11547 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Andreas Müller --- ...-timidity-readmidi-zero-division-fix.patch | 27 +++++++++ ...-timidity-resample-frac-overflow-fix.patch | 60 +++++++++++++++++++ .../timidity++/timidity++.inc | 6 +- 3 files changed, 92 insertions(+), 1 deletion(-) create mode 100644 recipes-misc/recipes-multimedia/timidity++/files/0003-timidity-readmidi-zero-division-fix.patch create mode 100644 recipes-misc/recipes-multimedia/timidity++/files/0004-timidity-resample-frac-overflow-fix.patch diff --git a/recipes-misc/recipes-multimedia/timidity++/files/0003-timidity-readmidi-zero-division-fix.patch b/recipes-misc/recipes-multimedia/timidity++/files/0003-timidity-readmidi-zero-division-fix.patch new file mode 100644 index 00000000..b51d360e --- /dev/null +++ b/recipes-misc/recipes-multimedia/timidity++/files/0003-timidity-readmidi-zero-division-fix.patch @@ -0,0 +1,27 @@ +From: Takashi Iwai +Subject: readmidi: Fix division by zero +References: CVE-2017-11546 + +An adhoc fix for division by zero in insert_note_steps(). + +Signed-off-by: Takashi Iwai + +Stolen from [1] + +[1] https://src.fedoraproject.org/cgit/rpms/timidity++.git/tree/timidity-readmidi-zero-division-fix.patch + +--- + timidity/readmidi.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/timidity/readmidi.c ++++ b/timidity/readmidi.c +@@ -4585,6 +4585,8 @@ static void insert_note_steps(void) + if (beat != 0) + meas++, beat = 0; + num = timesig[n].a, denom = timesig[n].b, n++; ++ if (!denom) ++ denom = 1; + } + a = (meas + 1) & 0xff; + b = (((meas + 1) >> 8) & 0x0f) + ((beat + 1) << 4); diff --git a/recipes-misc/recipes-multimedia/timidity++/files/0004-timidity-resample-frac-overflow-fix.patch b/recipes-misc/recipes-multimedia/timidity++/files/0004-timidity-resample-frac-overflow-fix.patch new file mode 100644 index 00000000..ff031ae4 --- /dev/null +++ b/recipes-misc/recipes-multimedia/timidity++/files/0004-timidity-resample-frac-overflow-fix.patch @@ -0,0 +1,60 @@ +From: Takashi Iwai +Subject: resample: Fix out-of-bound access in resamplers +References: CVE-2017-11547 + +An adhoc fix for out-of-bound accesses in resamples. +The offset might overflow the given data range. + +Signed-off-by: Takashi Iwai + +Stolen from [1] + +[1] https://src.fedoraproject.org/cgit/rpms/timidity++.git/tree/timidity-resample-frac-overflow-fix.patch + +--- a/timidity/resample.c ++++ b/timidity/resample.c +@@ -57,6 +57,8 @@ static resample_t resample_cspline(sample_t *src, splen_t ofs, resample_rec_t *r + { + int32 ofsi, ofsf, v0, v1, v2, v3, temp; + ++ if (ofs + (1 << FRACTION_BITS) >= rec->data_length) ++ return src[ofs >> FRACTION_BITS]; + ofsi = ofs >> FRACTION_BITS; + v1 = src[ofsi]; + v2 = src[ofsi + 1]; +@@ -96,6 +98,8 @@ static resample_t resample_lagrange(sample_t *src, splen_t ofs, resample_rec_t * + { + int32 ofsi, ofsf, v0, v1, v2, v3; + ++ if (ofs + (1 << FRACTION_BITS) >= rec->data_length) ++ return src[ofs >> FRACTION_BITS]; + ofsi = ofs >> FRACTION_BITS; + v1 = (int32)src[ofsi]; + v2 = (int32)src[ofsi + 1]; +@@ -154,6 +158,8 @@ static resample_t resample_gauss(sample_t *src, splen_t ofs, resample_rec_t *rec + sample_t *sptr; + int32 left, right, temp_n; + ++ if (ofs + (1 << FRACTION_BITS) >= rec->data_length) ++ return src[ofs >> FRACTION_BITS]; + left = (ofs>>FRACTION_BITS); + right = (rec->data_length>>FRACTION_BITS) - left - 1; + temp_n = (right<<1)-1; +@@ -261,6 +267,8 @@ static resample_t resample_newton(sample_t *src, splen_t ofs, resample_rec_t *re + int32 left, right, temp_n; + int ii, jj; + ++ if (ofs + (1 << FRACTION_BITS) >= rec->data_length) ++ return src[ofs >> FRACTION_BITS]; + left = (ofs>>FRACTION_BITS); + right = (rec->data_length>>FRACTION_BITS)-(ofs>>FRACTION_BITS)-1; + temp_n = (right<<1)-1; +@@ -330,6 +338,8 @@ static resample_t resample_linear(sample_t *src, splen_t ofs, resample_rec_t *re + { + int32 v1, v2, ofsi; + ++ if (ofs + (1 << FRACTION_BITS) >= rec->data_length) ++ return src[ofs >> FRACTION_BITS]; + ofsi = ofs >> FRACTION_BITS; + v1 = src[ofsi]; + v2 = src[ofsi + 1]; diff --git a/recipes-misc/recipes-multimedia/timidity++/timidity++.inc b/recipes-misc/recipes-multimedia/timidity++/timidity++.inc index 9a1f4782..3079f5c4 100644 --- a/recipes-misc/recipes-multimedia/timidity++/timidity++.inc +++ b/recipes-misc/recipes-multimedia/timidity++/timidity++.inc @@ -7,7 +7,11 @@ PV = "2.14.0" UPSTREAM_PN = "TiMidity++" -SRC_URI = "${SOURCEFORGE_MIRROR}/project/timidity/${UPSTREAM_PN}/${UPSTREAM_PN}-${PV}/${UPSTREAM_PN}-${PV}.tar.xz" +SRC_URI = " \ + ${SOURCEFORGE_MIRROR}/project/timidity/${UPSTREAM_PN}/${UPSTREAM_PN}-${PV}/${UPSTREAM_PN}-${PV}.tar.xz \ + file://0003-timidity-readmidi-zero-division-fix.patch \ + file://0004-timidity-resample-frac-overflow-fix.patch \ +" SRC_URI[md5sum] = "27927182d62ba24abbf447a9e9919c53" SRC_URI[sha256sum] = "abf0c8367959e85c9e635b8fbd5183fc27bd380e0ef5e45de4158784538c86fc"