|
@@ -1,34 +0,0 @@
|
|
-From fcf0ba06ae12ccd7c67cee3c8d948df15f946b85 Mon Sep 17 00:00:00 2001
|
|
|
|
-From: Erik de Castro Lopo <erikd@mega-nerd.com>
|
|
|
|
-Date: Wed, 19 Nov 2014 19:35:59 -0800
|
|
|
|
-Subject: [PATCH] src/libFACL/stream_decoder.c : Fail safely to avoid a heap overflow.
|
|
|
|
-
|
|
|
|
-A file provided by the reporters caused the stream decoder to write to
|
|
|
|
-un-allocated heap space resulting in a segfault. The solution is to
|
|
|
|
-error out (by returning false from read_residual_partitioned_rice_())
|
|
|
|
-instead of trying to continue to decode.
|
|
|
|
-
|
|
|
|
-Fixes: CVE-2014-9028
|
|
|
|
-Reported-by: Michele Spagnuolo,
|
|
|
|
- Google Security Team <mikispag@google.com>
|
|
|
|
----
|
|
|
|
- src/libFLAC/stream_decoder.c | 3 ++-
|
|
|
|
- 1 files changed, 2 insertions(+), 1 deletions(-)
|
|
|
|
-
|
|
|
|
-diff --git a/src/libFLAC/stream_decoder.c b/src/libFLAC/stream_decoder.c
|
|
|
|
-index 88a656d..54e84d4 100644
|
|
|
|
---- a/src/libFLAC/stream_decoder.c
|
|
|
|
-+++ b/src/libFLAC/stream_decoder.c
|
|
|
|
-@@ -2736,7 +2736,8 @@ FLAC__bool read_residual_partitioned_rice_(FLAC__StreamDecoder *decoder, unsigne
|
|
|
|
- if(decoder->private_->frame.header.blocksize < predictor_order) {
|
|
|
|
- send_error_to_client_(decoder, FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC);
|
|
|
|
- decoder->protected_->state = FLAC__STREAM_DECODER_SEARCH_FOR_FRAME_SYNC;
|
|
|
|
-- return true;
|
|
|
|
-+ /* We have received a potentially malicious bt stream. All we can do is error out to avoid a heap overflow. */
|
|
|
|
-+ return false;
|
|
|
|
- }
|
|
|
|
- }
|
|
|
|
- else {
|
|
|
|
---
|
|
|
|
-1.7.2.5
|
|
|
|
-
|
|
|