0007-mat4-mat5-fix-int-overflow-when-calculating-blockwid.patch 1.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748
  1. From 39f2a4ffe5ab77d1cadc2057c2db046a9a3d5d65 Mon Sep 17 00:00:00 2001
  2. From: Alex Stewart <alex.stewart@ni.com>
  3. Date: Wed, 11 Oct 2023 16:12:22 -0400
  4. Subject: [PATCH] mat4/mat5: fix int overflow when calculating blockwidth
  5. Pre-cast the components of the blockwidth calculation to sf_count_t to
  6. avoid overflowing integers during calculation.
  7. CVE: CVE-2022-33065
  8. Fixes: https://github.com/libsndfile/libsndfile/issues/833
  9. Signed-off-by: Alex Stewart <alex.stewart@ni.com>
  10. Upstream: https://github.com/libsndfile/libsndfile/commit/39f2a4ffe5ab77d1cadc2057c2db046a9a3d5d65
  11. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
  12. ---
  13. src/mat4.c | 2 +-
  14. src/mat5.c | 2 +-
  15. 2 files changed, 2 insertions(+), 2 deletions(-)
  16. diff --git a/src/mat4.c b/src/mat4.c
  17. index 575683ba..9f046f0c 100644
  18. --- a/src/mat4.c
  19. +++ b/src/mat4.c
  20. @@ -104,7 +104,7 @@ mat4_open (SF_PRIVATE *psf)
  21. psf->container_close = mat4_close ;
  22. - psf->blockwidth = psf->bytewidth * psf->sf.channels ;
  23. + psf->blockwidth = (sf_count_t) psf->bytewidth * psf->sf.channels ;
  24. switch (subformat)
  25. { case SF_FORMAT_PCM_16 :
  26. diff --git a/src/mat5.c b/src/mat5.c
  27. index da5a6eca..20f0ea64 100644
  28. --- a/src/mat5.c
  29. +++ b/src/mat5.c
  30. @@ -114,7 +114,7 @@ mat5_open (SF_PRIVATE *psf)
  31. psf->container_close = mat5_close ;
  32. - psf->blockwidth = psf->bytewidth * psf->sf.channels ;
  33. + psf->blockwidth = (sf_count_t) psf->bytewidth * psf->sf.channels ;
  34. switch (subformat)
  35. { case SF_FORMAT_PCM_U8 :
  36. --
  37. 2.39.5