Hello community,

here is the log from the commit of package libsndfile for openSUSE:Factory 
checked in at 2017-08-12 20:06:48
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/libsndfile (Old)
 and      /work/SRC/openSUSE:Factory/.libsndfile.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "libsndfile"

Sat Aug 12 20:06:48 2017 rev:52 rq:515153 version:1.0.28

Changes:
--------
--- /work/SRC/openSUSE:Factory/libsndfile/libsndfile.changes    2017-06-15 
11:18:38.395681818 +0200
+++ /work/SRC/openSUSE:Factory/.libsndfile.new/libsndfile.changes       
2017-08-12 20:06:49.371360704 +0200
@@ -1,0 +2,7 @@
+Tue Aug  8 11:00:09 CEST 2017 - ti...@suse.de
+
+- Fix Heap-based Buffer Overflow in the psf_binheader_writef
+  (CVE-2017-12562, bsc#1052476):
+  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch
+
+-------------------------------------------------------------------

New:
----
  0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ libsndfile.spec ++++++
--- /var/tmp/diff_new_pack.p4EhNR/_old  2017-08-12 20:06:51.047125936 +0200
+++ /var/tmp/diff_new_pack.p4EhNR/_new  2017-08-12 20:06:51.051125376 +0200
@@ -32,6 +32,7 @@
 Patch1:         0001-FLAC-Fix-a-buffer-read-overrun.patch
 Patch2:         0002-src-flac.c-Fix-a-buffer-read-overflow.patch
 Patch10:        0010-src-aiff.c-Fix-a-buffer-read-overflow.patch
+Patch20:        0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch
 # PATCH-FIX-OPENSUSE
 Patch100:       sndfile-ocloexec.patch
 BuildRequires:  alsa-devel
@@ -82,6 +83,7 @@
 %patch1 -p1
 %patch2 -p1
 %patch10 -p1
+%patch20 -p1
 %patch100 -p1
 
 %build

++++++ 0020-src-common.c-Fix-heap-buffer-overflows-when-writing-.patch ++++++
>From cf7a8182c2642c50f1cf90dddea9ce96a8bad2e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rn=20Heusipp?= <osm...@problemloesungsmaschine.de>
Date: Wed, 14 Jun 2017 12:25:40 +0200
Subject: [PATCH] src/common.c: Fix heap buffer overflows when writing strings
 in binheader

Fixes the following problems:
 1. Case 's' only enlarges the buffer by 16 bytes instead of size bytes.
 2. psf_binheader_writef() enlarges the header buffer (if needed) prior to the
    big switch statement by an amount (16 bytes) which is enough for all cases
    where only a single value gets added. Cases 's', 'S', 'p' however
    additionally write an arbitrary length block of data and again enlarge the
    buffer to the required amount. However, the required space calculation does
    not take into account the size of the length field which gets output before
    the data.
 3. Buffer size requirement calculation in case 'S' does not account for the
    padding byte ("size += (size & 1) ;" happens after the calculation which
    uses "size").
 4. Case 'S' can overrun the header buffer by 1 byte when no padding is
    involved
    ("memcpy (&(psf->header.ptr [psf->header.indx]), strptr, size + 1) ;" while
    the buffer is only guaranteed to have "size" space available).
 5. "psf->header.ptr [psf->header.indx] = 0 ;" in case 'S' always writes 1 byte
    beyond the space which is guaranteed to be allocated in the header buffer.
 6. Case 's' can overrun the provided source string by 1 byte if padding is
    involved ("memcpy (&(psf->header.ptr [psf->header.indx]), strptr, size) ;"
    where "size" is "strlen (strptr) + 1" (which includes the 0 terminator,
    plus optionally another 1 which is padding and not guaranteed to be
    readable via the source string pointer).

Closes: https://github.com/erikd/libsndfile/issues/292
---
 src/common.c |   15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

--- a/src/common.c
+++ b/src/common.c
@@ -675,16 +675,16 @@ psf_binheader_writef (SF_PRIVATE *psf, c
                                        /* Write a C string (guaranteed to have 
a zero terminator). */
                                        strptr = va_arg (argptr, char *) ;
                                        size = strlen (strptr) + 1 ;
-                                       size += (size & 1) ;
 
-                                       if (psf->header.indx + (sf_count_t) 
size >= psf->header.len && psf_bump_header_allocation (psf, 16))
+                                       if (psf->header.indx + 4 + (sf_count_t) 
size + (sf_count_t) (size & 1) > psf->header.len && psf_bump_header_allocation 
(psf, 4 + size + (size & 1)))
                                                return count ;
 
                                        if (psf->rwf_endian == SF_ENDIAN_BIG)
-                                               header_put_be_int (psf, size) ;
+                                               header_put_be_int (psf, size + 
(size & 1)) ;
                                        else
-                                               header_put_le_int (psf, size) ;
+                                               header_put_le_int (psf, size + 
(size & 1)) ;
                                        memcpy (&(psf->header.ptr 
[psf->header.indx]), strptr, size) ;
+                                       size += (size & 1) ;
                                        psf->header.indx += size ;
                                        psf->header.ptr [psf->header.indx - 1] 
= 0 ;
                                        count += 4 + size ;
@@ -697,16 +697,15 @@ psf_binheader_writef (SF_PRIVATE *psf, c
                                        */
                                        strptr = va_arg (argptr, char *) ;
                                        size = strlen (strptr) ;
-                                       if (psf->header.indx + (sf_count_t) 
size > psf->header.len && psf_bump_header_allocation (psf, size))
+                                       if (psf->header.indx + 4 + (sf_count_t) 
size + (sf_count_t) (size & 1) > psf->header.len && psf_bump_header_allocation 
(psf, 4 + size + (size & 1)))
                                                return count ;
                                        if (psf->rwf_endian == SF_ENDIAN_BIG)
                                                header_put_be_int (psf, size) ;
                                        else
                                                header_put_le_int (psf, size) ;
-                                       memcpy (&(psf->header.ptr 
[psf->header.indx]), strptr, size + 1) ;
+                                       memcpy (&(psf->header.ptr 
[psf->header.indx]), strptr, size + (size & 1)) ;
                                        size += (size & 1) ;
                                        psf->header.indx += size ;
-                                       psf->header.ptr [psf->header.indx] = 0 ;
                                        count += 4 + size ;
                                        break ;
 
@@ -718,7 +717,7 @@ psf_binheader_writef (SF_PRIVATE *psf, c
                                        size = (size & 1) ? size : size + 1 ;
                                        size = (size > 254) ? 254 : size ;
 
-                                       if (psf->header.indx + (sf_count_t) 
size > psf->header.len && psf_bump_header_allocation (psf, size))
+                                       if (psf->header.indx + 1 + (sf_count_t) 
size > psf->header.len && psf_bump_header_allocation (psf, 1 + size))
                                                return count ;
 
                                        header_put_byte (psf, size) ;



Reply via email to