Giuseppe Iuculano ha scritto: > Proposed debdiffs in attachment. Updated oldstable debdiff (do not backport changes in src/libmodplug/stdafx.h, instead include stdint.h)
Cheers, Giuseppe.
diff -u libmodplug-0.7/debian/changelog libmodplug-0.7/debian/changelog --- libmodplug-0.7/debian/changelog +++ libmodplug-0.7/debian/changelog @@ -1,3 +1,11 @@ +libmodplug (1:0.7-5.3) oldstable-security; urgency=high + + * Non-maintainer upload. + * Fixed "CSoundFile::ReadMed()" Integer Overflow in src/load_med.cp + (Closes: #526657) (CVE-2009-1438) + + -- Giuseppe Iuculano <[email protected]> Sat, 02 May 2009 18:16:49 +0200 + libmodplug (1:0.7-5.2) unstable; urgency=medium * Non-maintainer upload. only in patch2: unchanged: --- libmodplug-0.7.orig/src/load_med.cpp +++ libmodplug-0.7/src/load_med.cpp @@ -8,6 +8,8 @@ #include "stdafx.h" #include "sndfile.h" +#include <stdint.h> + //#define MED_LOG #ifdef MED_LOG @@ -692,21 +694,24 @@ } } // Song Comments - UINT annotxt = bswapBE32(pmex->annotxt); - UINT annolen = bswapBE32(pmex->annolen); - if ((annotxt) && (annolen) && (annotxt+annolen <= dwMemLength)) + uint32_t annotxt = bswapBE32(pmex->annotxt); + uint32_t annolen = bswapBE32(pmex->annolen); + if ((annotxt) && (annolen) && (annotxt + annolen > annotxt) // overflow checks. + && (annotxt+annolen <= dwMemLength)) { m_lpszSongComments = new char[annolen+1]; memcpy(m_lpszSongComments, lpStream+annotxt, annolen); m_lpszSongComments[annolen] = 0; } // Song Name - UINT songname = bswapBE32(pmex->songname); - UINT songnamelen = bswapBE32(pmex->songnamelen); - if ((songname) && (songnamelen) && (songname+songnamelen <= dwMemLength)) + uint32_t songname = bswapBE32(pmex->songname); + uint32_t songnamelen = bswapBE32(pmex->songnamelen); + if ((songname) && (songnamelen) && (songname+songnamelen > songname) + && (songname+songnamelen <= dwMemLength)) { if (songnamelen > 31) songnamelen = 31; memcpy(m_szNames[0], lpStream+songname, songnamelen); + m_szNames[0][31] = '\0'; } // Sample Names DWORD smpinfoex = bswapBE32(pmex->iinfo); @@ -716,14 +721,18 @@ UINT ientries = bswapBE16(pmex->i_ext_entries); UINT ientrysz = bswapBE16(pmex->i_ext_entrsz); - if ((iinfoptr) && (ientrysz < 256) && (iinfoptr + ientries*ientrysz < dwMemLength)) + if ((iinfoptr) && (ientrysz < 256) && + (ientries*ientrysz < dwMemLength) && + (iinfoptr < dwMemLength - (ientries*ientrysz))) { LPCSTR psznames = (LPCSTR)(lpStream + iinfoptr); UINT maxnamelen = ientrysz; + // copy a max of 32 bytes. if (maxnamelen > 32) maxnamelen = 32; for (UINT i=0; i<ientries; i++) if (i < m_nSamples) { lstrcpyn(m_szNames[i+1], psznames + i*ientrysz, maxnamelen); + m_szNames[i+1][31] = '\0'; } } } @@ -754,6 +763,7 @@ if ((trknameofs) && (trknameofs + trknamelen < dwMemLength)) { lstrcpyn(ChnSettings[i].szName, (LPCSTR)(lpStream+trknameofs), MAX_CHANNELNAME); + ChnSettings[i].szName[MAX_CHANNELNAME-1] = '\0'; } } }
signature.asc
Description: OpenPGP digital signature
