Pick patch from [1] also mentioned at debian in [2] [1] https://github.com/libsndfile/libsndfile/commit/c32c090ff9bb45e1dae637957c9c9b47b3967623 [2] https://security-tracker.debian.org/tracker/CVE-2026-37555
Signed-off-by: Rohini Sangam <[email protected]> --- .../libsndfile1/CVE-2026-37555.patch | 48 +++++++++++++++++++ .../libsndfile/libsndfile1_1.2.2.bb | 1 + 2 files changed, 49 insertions(+) create mode 100644 meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch new file mode 100644 index 0000000000..b2e671f2b3 --- /dev/null +++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch @@ -0,0 +1,48 @@ +From c32c090ff9bb45e1dae637957c9c9b47b3967623 Mon Sep 17 00:00:00 2001 +From: Alb3e3 <[email protected]> +Date: Sat, 27 Jun 2026 14:34:16 +0200 +Subject: [PATCH] sds: avoid divide-by-zero in sds_byterate for zero-frame + files + +sds_read_header() sets psf->sf.frames directly from the file's 3-byte +data-length field without a lower bound, so a crafted .sds file can +leave psf->sf.frames == 0. SDS never sets psf->bytewidth, so +sf_current_byterate() falls through to psf->byterate (sds_byterate), +which computes + + (psf->datalength * psf->sf.samplerate) / psf->sf.frames + +dividing by zero -> SIGFPE crash (denial of service) when an +application calls the public sf_current_byterate() on such a file. + +Guard the division with psf->sf.frames > 0, returning -1 (the same +'unknown' value already used for the write path) otherwise. + +Reproduced with a 21-byte crafted .sds (data-length field = 0) under +AddressSanitizer: 'FPE ... in sds_byterate src/sds.c:761' before the +fix; returns -1 cleanly after. + +CVE: CVE-2026-37555 +Upstream-Status: Backport [https://github.com/libsndfile/libsndfile/commit/c32c090ff9bb45e1dae637957c9c9b47b3967623] + +Signed-off-by: Rohini Sangam <[email protected]> +--- + src/sds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/sds.c b/src/sds.c +index 6bc7617..0dc082d 100644 +--- a/src/sds.c ++++ b/src/sds.c +@@ -757,7 +757,7 @@ sds_seek (SF_PRIVATE *psf, int mode, sf_count_t seek_from_start) + static int + sds_byterate (SF_PRIVATE * psf) + { +- if (psf->file.mode == SFM_READ) ++ if (psf->file.mode == SFM_READ && psf->sf.frames > 0) + return (psf->datalength * psf->sf.samplerate) / psf->sf.frames ; + + return -1 ; +-- +2.44.4 + diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1_1.2.2.bb b/meta/recipes-multimedia/libsndfile/libsndfile1_1.2.2.bb index 4cf4237573..5d2a2c256b 100644 --- a/meta/recipes-multimedia/libsndfile/libsndfile1_1.2.2.bb +++ b/meta/recipes-multimedia/libsndfile/libsndfile1_1.2.2.bb @@ -13,6 +13,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/libsndfile-${PV}.tar.xz \ file://CVE-2024-50612.patch \ file://CVE-2025-56226-01.patch \ file://CVE-2025-56226-02.patch \ + file://CVE-2026-37555.patch \ " GITHUB_BASE_URI = "https://github.com/libsndfile/libsndfile/releases/"; -- 2.34.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243675): https://lists.openembedded.org/g/openembedded-core/message/243675 Mute This Topic: https://lists.openembedded.org/mt/120806530/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
