From 00bd0320d895ef5f3027c75a9df26546bc18f8b7 Mon Sep 17 00:00:00 2001 From: Alex Stewart Date: Wed, 11 Oct 2023 17:43:02 -0400 Subject: [PATCH 10/17] ircam: fix int overflow in ircam_read_header() When reading the IRCAM header, it is possible for the calculated blockwidth to exceed the bounds of a signed int32. Use a 64bit sf_count_t to store the blockwidth. CVE: CVE-2022-33065 Fixes: https://github.com/libsndfile/libsndfile/issues/833 Signed-off-by: Alex Stewart Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-6.patch?h=ubuntu/jammy-security Upstream commit https://github.com/libsndfile/libsndfile/commit/00bd0320d895ef5f3027c75a9df26546bc18f8b7] CVE: CVE-2022-33065 Signed-off-by: Vijay Anusuri --- src/common.h | 2 +- src/ircam.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/common.h b/src/common.h index cd9ac8b07..01f6ae095 100644 --- a/src/common.h +++ b/src/common.h @@ -439,7 +439,7 @@ typedef struct sf_private_tag sf_count_t datalength ; /* Length in bytes of the audio data. */ sf_count_t dataend ; /* Offset to file tailer. */ - int blockwidth ; /* Size in bytes of one set of interleaved samples. */ + sf_count_t blockwidth ; /* Size in bytes of one set of interleaved samples. */ int bytewidth ; /* Size in bytes of one sample (one channel). */ void *dither ; diff --git a/src/ircam.c b/src/ircam.c index 8e7cdba81..3d73ba442 100644 --- a/src/ircam.c +++ b/src/ircam.c @@ -171,35 +171,35 @@ ircam_read_header (SF_PRIVATE *psf) switch (encoding) { case IRCAM_PCM_16 : psf->bytewidth = 2 ; - psf->blockwidth = psf->sf.channels * psf->bytewidth ; + psf->blockwidth = (sf_count_t) psf->sf.channels * psf->bytewidth ; psf->sf.format = SF_FORMAT_IRCAM | SF_FORMAT_PCM_16 ; break ; case IRCAM_PCM_32 : psf->bytewidth = 4 ; - psf->blockwidth = psf->sf.channels * psf->bytewidth ; + psf->blockwidth = (sf_count_t) psf->sf.channels * psf->bytewidth ; psf->sf.format = SF_FORMAT_IRCAM | SF_FORMAT_PCM_32 ; break ; case IRCAM_FLOAT : psf->bytewidth = 4 ; - psf->blockwidth = psf->sf.channels * psf->bytewidth ; + psf->blockwidth = (sf_count_t) psf->sf.channels * psf->bytewidth ; psf->sf.format = SF_FORMAT_IRCAM | SF_FORMAT_FLOAT ; break ; case IRCAM_ALAW : psf->bytewidth = 1 ; - psf->blockwidth = psf->sf.channels * psf->bytewidth ; + psf->blockwidth = (sf_count_t) psf->sf.channels * psf->bytewidth ; psf->sf.format = SF_FORMAT_IRCAM | SF_FORMAT_ALAW ; break ; case IRCAM_ULAW : psf->bytewidth = 1 ; - psf->blockwidth = psf->sf.channels * psf->bytewidth ; + psf->blockwidth = (sf_count_t) psf->sf.channels * psf->bytewidth ; psf->sf.format = SF_FORMAT_IRCAM | SF_FORMAT_ULAW ; break ;