| From 85c877d5072866aadbe8ed0c3e0590fbb5e16788 Mon Sep 17 00:00:00 2001 |
| From: Fabian Greffrath <fabian@greffrath.com> |
| Date: Thu, 28 Sep 2017 12:15:04 +0200 |
| Subject: [PATCH] double64_init: Check psf->sf.channels against upper bound |
| |
| This prevents division by zero later in the code. |
| |
| While the trivial case to catch this (i.e. sf.channels < 1) has already |
| been covered, a crafted file may report a number of channels that is |
| so high (i.e. > INT_MAX/sizeof(double)) that it "somehow" gets |
| miscalculated to zero (if this makes sense) in the determination of the |
| blockwidth. Since we only support a limited number of channels anyway, |
| make sure to check here as well. |
| |
| CVE-2017-14634 |
| |
| Closes: https://github.com/erikd/libsndfile/issues/318 |
| Signed-off-by: Erik de Castro Lopo <erikd@mega-nerd.com> |
| Signed-off-by: Peter Korsgaard <peter@korsgaard.com> |
| --- |
| src/double64.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/src/double64.c b/src/double64.c |
| index b318ea86..78dfef7f 100644 |
| --- a/src/double64.c |
| +++ b/src/double64.c |
| @@ -91,7 +91,7 @@ int |
| double64_init (SF_PRIVATE *psf) |
| { static int double64_caps ; |
| |
| - if (psf->sf.channels < 1) |
| + if (psf->sf.channels < 1 || psf->sf.channels > SF_MAX_CHANNELS) |
| { psf_log_printf (psf, "double64_init : internal error : channels = %d\n", psf->sf.channels) ; |
| return SFE_INTERNAL ; |
| } ; |
| -- |
| 2.11.0 |
| |
