Hi Petter, On Tue, Aug 01, 2017 at 08:02:47PM +0200, Petter Reinholdtsen wrote: > Control: retitle -1 libvorbis: CVE-2017-11333 OOM via crafted WAV file > > I've tried to figure out of the recently reported security problems are > reported upstream, but the upstream bug tracker is being moved from > trac.xiph.org to https://gitlab.xiph.org/xiph and the migration is > not done yet, so it seem to be impossible to register it with upstream > so far.
The issue is at https://gitlab.xiph.org/xiph/vorbis/issues/2332 > > Thus I have no idea if there are any patches for this issue yet. Anyone > know? The wav file also seems to suffer from too many channels. When I apply the patch from #876778 and then the attached patch sox aborts correctly. I did not check if there are other issues in the wav file besides too many channels. (Attaching the patch here since the upstream sox list doesn't seem to list my submission). Cheers, -- Guido > > -- > Happy hacking > Petter Reinholdtsen
>From 93b6e4b5b0efa47b318151d39c35277fc06525f1 Mon Sep 17 00:00:00 2001 Message-Id: <93b6e4b5b0efa47b318151d39c35277fc06525f1.1511192342.git....@sigxcpu.org> From: =?UTF-8?q?Guido=20G=C3=BCnther?= <[email protected]> Date: Wed, 15 Nov 2017 18:36:58 +0100 Subject: [PATCH] Handle vorbis_analysis_headerout errors This is related to https://github.com/xiph/vorbis/pull/34 but could also happen today with on other errors in the called function. --- src/vorbis.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/vorbis.c b/src/vorbis.c index 267fb803..1afaa01b 100644 --- a/src/vorbis.c +++ b/src/vorbis.c @@ -270,8 +270,11 @@ static int write_vorbis_header(sox_format_t * ft, vorbis_enc_t * ve) vc.comment_lengths[i] = strlen(text); } } - vorbis_analysis_headerout( /* Build the packets */ - &ve->vd, &vc, &header_main, &header_comments, &header_codebooks); + if (vorbis_analysis_headerout( /* Build the packets */ + &ve->vd, &vc, &header_main, &header_comments, &header_codebooks) < 0) { + ret = HEADER_ERROR; + goto cleanup; + } ogg_stream_packetin(&ve->os, &header_main); /* And stream them out */ ogg_stream_packetin(&ve->os, &header_comments); @@ -280,6 +283,7 @@ static int write_vorbis_header(sox_format_t * ft, vorbis_enc_t * ve) while (ogg_stream_flush(&ve->os, &ve->og) && ret == HEADER_OK) if (!oe_write_page(&ve->og, ft)) ret = HEADER_ERROR; +cleanup: for (i = 0; i < vc.comments; ++i) free(vc.user_comments[i]); free(vc.user_comments); -- 2.15.0
