1*4882a593Smuzhiyun# HG changeset patch 2*4882a593Smuzhiyun# User Petr Písař <ppisar@redhat.com> 3*4882a593Smuzhiyun# Date 1560182231 25200 4*4882a593Smuzhiyun# Mon Jun 10 08:57:11 2019 -0700 5*4882a593Smuzhiyun# Branch SDL-1.2 6*4882a593Smuzhiyun# Node ID a8afedbcaea0e84921dc770195c4699bda3ccdc5 7*4882a593Smuzhiyun# Parent faf9abbcfb5fe0d0ca23c4bf0394aa226ceccf02 8*4882a593SmuzhiyunCVE-2019-7572: Fix a buffer overwrite in IMA_ADPCM_decode 9*4882a593SmuzhiyunIf data chunk was longer than expected based on a WAV format 10*4882a593Smuzhiyundefinition, IMA_ADPCM_decode() tried to write past the output 11*4882a593Smuzhiyunbuffer. This patch fixes it. 12*4882a593Smuzhiyun 13*4882a593SmuzhiyunBased on patch from 14*4882a593Smuzhiyun<https://bugzilla.libsdl.org/show_bug.cgi?id=4496>. 15*4882a593Smuzhiyun 16*4882a593SmuzhiyunCVE-2019-7572 17*4882a593Smuzhiyunhttps://bugzilla.libsdl.org/show_bug.cgi?id=4495 18*4882a593Smuzhiyun 19*4882a593SmuzhiyunSigned-off-by: Petr Písař <ppisar@redhat.com> 20*4882a593Smuzhiyun 21*4882a593Smuzhiyun# HG changeset patch 22*4882a593Smuzhiyun# User Petr Písař <ppisar@redhat.com> 23*4882a593Smuzhiyun# Date 1560041863 25200 24*4882a593Smuzhiyun# Sat Jun 08 17:57:43 2019 -0700 25*4882a593Smuzhiyun# Branch SDL-1.2 26*4882a593Smuzhiyun# Node ID e52413f5258600878f9a10d2f92605a729aa8976 27*4882a593Smuzhiyun# Parent 4e73be7b47877ae11d2279bd916910d469d18f8e 28*4882a593SmuzhiyunCVE-2019-7572: Fix a buffer overread in IMA_ADPCM_nibble 29*4882a593SmuzhiyunIf an IMA ADPCM block contained an initial index out of step table 30*4882a593Smuzhiyunrange (loaded in IMA_ADPCM_decode()), IMA_ADPCM_nibble() blindly used 31*4882a593Smuzhiyunthis bogus value and that lead to a buffer overread. 32*4882a593Smuzhiyun 33*4882a593SmuzhiyunThis patch fixes it by moving clamping the index value at the 34*4882a593Smuzhiyunbeginning of IMA_ADPCM_nibble() function instead of the end after 35*4882a593Smuzhiyunan update. 36*4882a593Smuzhiyun 37*4882a593SmuzhiyunCVE-2019-7572 38*4882a593Smuzhiyunhttps://bugzilla.libsdl.org/show_bug.cgi?id=4495 39*4882a593Smuzhiyun 40*4882a593SmuzhiyunSigned-off-by: Petr Písař <ppisar@redhat.com> 41*4882a593Smuzhiyun 42*4882a593SmuzhiyunCVE: CVE-2019-7572 43*4882a593SmuzhiyunUpstream-Status: Backport 44*4882a593SmuzhiyunSigned-off-by: Anuj Mittal <anuj.mittal@intel.com> 45*4882a593Smuzhiyun 46*4882a593Smuzhiyundiff -r faf9abbcfb5f -r a8afedbcaea0 src/audio/SDL_wave.c 47*4882a593Smuzhiyun--- a/src/audio/SDL_wave.c Mon Jun 10 08:54:29 2019 -0700 48*4882a593Smuzhiyun+++ b/src/audio/SDL_wave.c Mon Jun 10 08:57:11 2019 -0700 49*4882a593Smuzhiyun@@ -346,7 +346,7 @@ 50*4882a593Smuzhiyun static int IMA_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len) 51*4882a593Smuzhiyun { 52*4882a593Smuzhiyun struct IMA_ADPCM_decodestate *state; 53*4882a593Smuzhiyun- Uint8 *freeable, *encoded, *encoded_end, *decoded; 54*4882a593Smuzhiyun+ Uint8 *freeable, *encoded, *encoded_end, *decoded, *decoded_end; 55*4882a593Smuzhiyun Sint32 encoded_len, samplesleft; 56*4882a593Smuzhiyun unsigned int c, channels; 57*4882a593Smuzhiyun 58*4882a593Smuzhiyun@@ -373,6 +373,7 @@ 59*4882a593Smuzhiyun return(-1); 60*4882a593Smuzhiyun } 61*4882a593Smuzhiyun decoded = *audio_buf; 62*4882a593Smuzhiyun+ decoded_end = decoded + *audio_len; 63*4882a593Smuzhiyun 64*4882a593Smuzhiyun /* Get ready... Go! */ 65*4882a593Smuzhiyun while ( encoded_len >= IMA_ADPCM_state.wavefmt.blockalign ) { 66*4882a593Smuzhiyun@@ -392,6 +393,7 @@ 67*4882a593Smuzhiyun } 68*4882a593Smuzhiyun 69*4882a593Smuzhiyun /* Store the initial sample we start with */ 70*4882a593Smuzhiyun+ if (decoded + 2 > decoded_end) goto invalid_size; 71*4882a593Smuzhiyun decoded[0] = (Uint8)(state[c].sample&0xFF); 72*4882a593Smuzhiyun decoded[1] = (Uint8)(state[c].sample>>8); 73*4882a593Smuzhiyun decoded += 2; 74*4882a593Smuzhiyun@@ -402,6 +404,8 @@ 75*4882a593Smuzhiyun while ( samplesleft > 0 ) { 76*4882a593Smuzhiyun for ( c=0; c<channels; ++c ) { 77*4882a593Smuzhiyun if (encoded + 4 > encoded_end) goto invalid_size; 78*4882a593Smuzhiyun+ if (decoded + 4 * 4 * channels > decoded_end) 79*4882a593Smuzhiyun+ goto invalid_size; 80*4882a593Smuzhiyun Fill_IMA_ADPCM_block(decoded, encoded, 81*4882a593Smuzhiyun c, channels, &state[c]); 82*4882a593Smuzhiyun encoded += 4; 83*4882a593Smuzhiyun 84*4882a593Smuzhiyundiff -r 4e73be7b4787 -r e52413f52586 src/audio/SDL_wave.c 85*4882a593Smuzhiyun--- a/src/audio/SDL_wave.c Sat Jun 01 18:27:46 2019 +0100 86*4882a593Smuzhiyun+++ b/src/audio/SDL_wave.c Sat Jun 08 17:57:43 2019 -0700 87*4882a593Smuzhiyun@@ -264,6 +264,14 @@ 88*4882a593Smuzhiyun }; 89*4882a593Smuzhiyun Sint32 delta, step; 90*4882a593Smuzhiyun 91*4882a593Smuzhiyun+ /* Clamp index value. The inital value can be invalid. */ 92*4882a593Smuzhiyun+ if ( state->index > 88 ) { 93*4882a593Smuzhiyun+ state->index = 88; 94*4882a593Smuzhiyun+ } else 95*4882a593Smuzhiyun+ if ( state->index < 0 ) { 96*4882a593Smuzhiyun+ state->index = 0; 97*4882a593Smuzhiyun+ } 98*4882a593Smuzhiyun+ 99*4882a593Smuzhiyun /* Compute difference and new sample value */ 100*4882a593Smuzhiyun step = step_table[state->index]; 101*4882a593Smuzhiyun delta = step >> 3; 102*4882a593Smuzhiyun@@ -275,12 +283,6 @@ 103*4882a593Smuzhiyun 104*4882a593Smuzhiyun /* Update index value */ 105*4882a593Smuzhiyun state->index += index_table[nybble]; 106*4882a593Smuzhiyun- if ( state->index > 88 ) { 107*4882a593Smuzhiyun- state->index = 88; 108*4882a593Smuzhiyun- } else 109*4882a593Smuzhiyun- if ( state->index < 0 ) { 110*4882a593Smuzhiyun- state->index = 0; 111*4882a593Smuzhiyun- } 112*4882a593Smuzhiyun 113*4882a593Smuzhiyun /* Clamp output sample */ 114*4882a593Smuzhiyun if ( state->sample > max_audioval ) { 115