From 1116fa173ea8785c9d881936b2174be6a58c0055 Mon Sep 17 00:00:00 2001 From: Alex Stewart Date: Wed, 11 Oct 2023 16:54:21 -0400 Subject: [PATCH 08/17] sds: fix int overflow warning in sample calculations The sds_*byte_read() functions compose their uint_32 sample buffers by shifting 7bit samples into a 32bit wide buffer, and adding them together. Because the 7bit samples are stored in 32bit ints, code fuzzers become concerned that the addition operation can overflow and cause undefined behavior. Instead, bitwise-OR the bytes together - which should accomplish the same arithmetic operation, without risking an int-overflow. CVE: CVE-2022-33065 Fixes: https://github.com/libsndfile/libsndfile/issues/833 Signed-off-by: Alex Stewart Do the same for the 3byte and 4byte read functions. Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-4.patch?h=ubuntu/jammy-security Upstream commit https://github.com/libsndfile/libsndfile/commit/1116fa173ea8785c9d881936b2174be6a58c0055] CVE: CVE-2022-33065 Signed-off-by: Vijay Anusuri --- src/sds.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/sds.c b/src/sds.c index 6bc761716..2a0f164c3 100644 --- a/src/sds.c +++ b/src/sds.c @@ -454,7 +454,7 @@ sds_2byte_read (SF_PRIVATE *psf, SDS_PRIVATE *psds) ucptr = psds->read_data + 5 ; for (k = 0 ; k < 120 ; k += 2) - { sample = arith_shift_left (ucptr [k], 25) + arith_shift_left (ucptr [k + 1], 18) ; + { sample = arith_shift_left (ucptr [k], 25) | arith_shift_left (ucptr [k + 1], 18) ; psds->read_samples [k / 2] = (int) (sample - 0x80000000) ; } ; @@ -498,7 +498,7 @@ sds_3byte_read (SF_PRIVATE *psf, SDS_PRIVATE *psds) ucptr = psds->read_data + 5 ; for (k = 0 ; k < 120 ; k += 3) - { sample = (((uint32_t) ucptr [k]) << 25) + (ucptr [k + 1] << 18) + (ucptr [k + 2] << 11) ; + { sample = (((uint32_t) ucptr [k]) << 25) | (ucptr [k + 1] << 18) | (ucptr [k + 2] << 11) ; psds->read_samples [k / 3] = (int) (sample - 0x80000000) ; } ; @@ -542,7 +542,7 @@ sds_4byte_read (SF_PRIVATE *psf, SDS_PRIVATE *psds) ucptr = psds->read_data + 5 ; for (k = 0 ; k < 120 ; k += 4) - { sample = (((uint32_t) ucptr [k]) << 25) + (ucptr [k + 1] << 18) + (ucptr [k + 2] << 11) + (ucptr [k + 3] << 4) ; + { sample = (((uint32_t) ucptr [k]) << 25) | (ucptr [k + 1] << 18) | (ucptr [k + 2] << 11) | (ucptr [k + 3] << 4) ; psds->read_samples [k / 4] = (int) (sample - 0x80000000) ; } ;