File ms_adpcm-Fix-and-extend-size-checks.patch of Package libsndfile.9560

Overview Repositories Revisions Requests Users Attributes Meta

File ms_adpcm-Fix-and-extend-size-checks.patch of Package libsndfile.9560

From deb669ee8be55a94565f6f8a6b60890c2e7c6f32 Mon Sep 17 00:00:00 2001
From: bobsayshilol <bobsayshilol@live.co.uk>
Date: Thu, 18 Feb 2021 21:52:09 +0000
Subject: [PATCH] ms_adpcm: Fix and extend size checks

'blockalign' is the size of a block, and each block contains 7 samples
per channel as part of the preamble, so check against 'samplesperblock'
rather than 'blockalign'. Also add an additional check that the block
is big enough to hold the samples it claims to hold.

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26803
---
 src/ms_adpcm.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

--- a/src/ms_adpcm.c
+++ b/src/ms_adpcm.c
@@ -140,6 +140,17 @@ wav_w64_msadpcm_init	(SF_PRIVATE *psf, i
 	if (psf->file.mode == SFM_WRITE)
 		samplesperblock = 2 + 2 * (blockalign - 7 * psf->sf.channels) / psf->sf.channels ;
 
+	/* There's 7 samples per channel in the preamble of each block */
+	if (samplesperblock < 7 * psf->sf.channels)
+	{	psf_log_printf (psf, "*** Error samplesperblock (%d) should be >= %d.\n", samplesperblock, 7 * psf->sf.channels) ;
+		return SFE_INTERNAL ;
+		} ;
+
+	if (2 * blockalign < samplesperblock * psf->sf.channels)
+	{	psf_log_printf (psf, "*** Error blockalign (%d) should be >= %d.\n", blockalign, samplesperblock * psf->sf.channels / 2) ;
+		return SFE_INTERNAL ;
+		} ;
+
 	pmssize = sizeof (MSADPCM_PRIVATE) + blockalign + 3 * psf->sf.channels * samplesperblock ;
 
 	if (! (psf->codec_data = calloc (1, pmssize)))

Places

File ms_adpcm-Fix-and-extend-size-checks.patch of Package libsndfile.9560

Places