sysmo-bts
/
generic-poky
9
0
Fork 0
Code Pull Requests Releases Activity

libsndfile1: Fix CVE-2017-6892 

Backport upstream patch to fix CVE-2017-6892.

CVE: CVE-2017-6892

(From OE-Core rev: cc9b8d0afe64b83f585843f3aff1c077f69fd656)

(From OE-Core rev: eed7d052dc053732e2d485dcc7e551b6754c4576)

Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Fan Xin 2017-06-22 10:44:02 +09:00 committed by Richard Purdie
parent 108f9a2666
commit ce45b35a67
2 changed files with 37 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2017-6892.patch Normal file
View File

@ -0,0 +1,34 @@
From f833c53cb596e9e1792949f762e0b33661822748 Mon Sep 17 00:00:00 2001
From: Erik de Castro Lopo <erikd@mega-nerd.com>
Date: Tue, 23 May 2017 20:15:24 +1000
Subject: [PATCH] src/aiff.c: Fix a buffer read overflow
Secunia Advisory SA76717.
Found by: Laurent Delosieres, Secunia Research at Flexera Software
CVE: CVE-2017-6892
Upstream-Status: Backport
Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com>
---
src/aiff.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/aiff.c b/src/aiff.c
index 5b5f9f5..45864b7 100644
--- a/src/aiff.c
+++ b/src/aiff.c
@@ -1759,7 +1759,7 @@ aiff_read_chanmap (SF_PRIVATE * psf, unsigned dword)
psf_binheader_readf (psf, "j", dword - bytesread) ;
if (map_info->channel_map != NULL)
- { size_t chanmap_size = psf->sf.channels * sizeof (psf->channel_map [0]) ;
+ { size_t chanmap_size = SF_MIN (psf->sf.channels, layout_tag & 0xffff) * sizeof (psf->channel_map [0]) ;
free (psf->channel_map) ;
--
1.9.1

4
meta/recipes-multimedia/libsndfile/libsndfile1_1.0.27.bb
View File

@ -5,7 +5,9 @@ DEPENDS = "flac libogg libvorbis sqlite3"
SECTION = "libs/multimedia"
LICENSE = "LGPLv2.1"
SRC_URI = "http://www.mega-nerd.com/libsndfile/files/libsndfile-${PV}.tar.gz"
SRC_URI = "http://www.mega-nerd.com/libsndfile/files/libsndfile-${PV}.tar.gz \
file://CVE-2017-6892.patch \
"
SRC_URI[md5sum] = "fd1d97c6077f03b5d984d7956ffedb7a"
SRC_URI[sha256sum] = "a391952f27f4a92ceb2b4c06493ac107896ed6c76be9a613a4731f076d30fac0"