From ec149a79d457916479489d71b55e4d63015a08ea Mon Sep 17 00:00:00 2001 From: Alex Stewart Date: Tue, 17 Oct 2023 12:01:00 -0400 Subject: [PATCH 16/17] rf64: fix int overflow in rf64_read_header() When checking for mismatches between the filelength and riff_size, it is possible to overflow the temporary riff_size value used in the comparison by adding a static offset; which is probably fine, but it is offensive to overflow fuzzers. Since filelength is always a positive value, simply move the offset to the other side of the comparison operator as a negative value, avoid the possibility of an overflow. CVE: CVE-2022-33065 Fixes: https://github.com/libsndfile/libsndfile/issues/833 Signed-off-by: Alex Stewart Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsndfile/tree/debian/patches/CVE-2022-33065/CVE-2022-33065-12.patch?h=ubuntu/jammy-security Upstream commit https://github.com/libsndfile/libsndfile/commit/ec149a79d457916479489d71b55e4d63015a08ea] CVE: CVE-2022-33065 Signed-off-by: Vijay Anusuri --- src/rf64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/rf64.c b/src/rf64.c index 123db445a..c60399fb3 100644 --- a/src/rf64.c +++ b/src/rf64.c @@ -242,7 +242,7 @@ rf64_read_header (SF_PRIVATE *psf, int *blockalign, int *framesperblock) } ; } ; - if (psf->filelength != riff_size + 8) + if (psf->filelength - 8 != riff_size) psf_log_printf (psf, " Riff size : %D (should be %D)\n", riff_size, psf->filelength - 8) ; else psf_log_printf (psf, " Riff size : %D\n", riff_size) ;