From 32c4958c4d113562f879ce76664fe785f93bba7c Mon Sep 17 00:00:00 2001

From: Kamil Dudka <kdudka@redhat.com>

Date: Thu, 19 Feb 2015 15:32:24 +0100

Subject: [PATCH] oggenc: validate count of channels in the header

... in order to prevent a division by zero (CVE-2014-9638) and integer

overflow (CVE-2014-9639).

Bug: https://trac.xiph.org/ticket/2136

Bug: https://trac.xiph.org/ticket/2137

---

 oggenc/audio.c | 19 +++++++++++++++++--

 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/oggenc/audio.c b/oggenc/audio.c

index 22bbed4..1cbb214 100644

--- a/oggenc/audio.c

+++ b/oggenc/audio.c

@@ -13,6 +13,7 @@

 #include <config.h>

 #endif

+#include <limits.h>

 #include <stdlib.h>

 #include <stdio.h>

 #include <string.h>

@@ -251,6 +252,7 @@ int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen)

     aiff_fmt format;

     aifffile *aiff = malloc(sizeof(aifffile));

     int i;

+    long channels;

     if(buf[11]=='C')

         aifc=1;

@@ -277,11 +279,17 @@ int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen)

         return 0;

     }

-    format.channels = READ_U16_BE(buffer);

+    format.channels = channels = READ_U16_BE(buffer);

     format.totalframes = READ_U32_BE(buffer+2);

     format.samplesize = READ_U16_BE(buffer+6);

     format.rate = (int)read_IEEE80(buffer+8);

+    if(channels <= 0L || SHRT_MAX < channels)

+    {

+        fprintf(stderr, _("Warning: Unsupported count of channels in AIFF header\n"));

+        return 0;

+    }

+

     aiff->bigendian = 1;

     if(aifc)

@@ -412,6 +420,7 @@ int wav_open(FILE *in, oe_enc_opt *opt, unsigned char *oldbuf, int buflen)

     wav_fmt format;

     wavfile *wav = malloc(sizeof(wavfile));

     int i;

+    long channels;

     /* Ok. At this point, we know we have a WAV file. Now we have to detect

      * whether we support the subtype, and we have to find the actual data

@@ -449,12 +458,18 @@ int wav_open(FILE *in, oe_enc_opt *opt, unsigned char *oldbuf, int buflen)

     }

     format.format =      READ_U16_LE(buf);

-    format.channels =    READ_U16_LE(buf+2);

+    format.channels = channels = READ_U16_LE(buf+2);

     format.samplerate =  READ_U32_LE(buf+4);

     format.bytespersec = READ_U32_LE(buf+8);

     format.align =       READ_U16_LE(buf+12);

     format.samplesize =  READ_U16_LE(buf+14);

+    if(channels <= 0L || SHRT_MAX < channels)

+    {

+        fprintf(stderr, _("Warning: Unsupported count of channels in WAV header\n"));

+        return 0;

+    }

+

     if(format.format == -2) /* WAVE_FORMAT_EXTENSIBLE */

     {

       if(len<40)

-- 

2.1.0