File libmikmod-3.1.12-CVE-2009-3995,3996.diff of Package libmikmod

Overview Repositories Revisions Requests Users Attributes Meta

File libmikmod-3.1.12-CVE-2009-3995,3996.diff of Package libmikmod (Revision 5c090443a95f0f980fd79c8daf4b1f6b)

Currently displaying revision 5c090443a95f0f980fd79c8daf4b1f6b , Show latest

Index: loaders/load_it.c
===================================================================
--- loaders/load_it.c.orig
+++ loaders/load_it.c
@@ -747,6 +747,8 @@ BOOL IT_Load(BOOL curious)
 				ih. name##end   =_mm_read_UBYTE(modreader);				\
 				ih. name##susbeg=_mm_read_UBYTE(modreader);				\
 				ih. name##susend=_mm_read_UBYTE(modreader);				\
+				if (ih. name##pts>= ITENVCNT) \
+					ih. name##pts = ITENVCNT-1; \
 				for(lp=0;lp<ITENVCNT;lp++) {							\
 					ih. name##node[lp]=_mm_read_##type (modreader);		\
 					ih. name##tick[lp]=_mm_read_I_UWORD(modreader);		\
@@ -760,6 +762,8 @@ BOOL IT_Load(BOOL curious)
 				ih. name/**/end   =_mm_read_UBYTE(modreader);			\
 				ih. name/**/susbeg=_mm_read_UBYTE(modreader);			\
 				ih. name/**/susend=_mm_read_UBYTE(modreader);			\
+				if (ih. name/**/pts>= ITENVCNT) \
+					ih. name/**/pts = ITENVCNT-1; \
 				for(lp=0;lp<ITENVCNT;lp++) {							\
 					ih. name/**/node[lp]=_mm_read_/**/type (modreader);	\
 					ih. name/**/tick[lp]=_mm_read_I_UWORD(modreader);	\
Index: loaders/load_ult.c
===================================================================
--- loaders/load_ult.c.orig
+++ loaders/load_ult.c
@@ -225,6 +225,10 @@ BOOL ULT_Load(BOOL curious)
 		for(t=0;t<of.numpat;t++)
 			of.patterns[(t*of.numchn)+u]=tracks++;
 
+	// SA37775
+	if (of.numchn>=UF_MAXCHAN)
+		of.numchn=UF_MAXCHAN - 1;
+	
 	/* read pan position table for v1.5 and higher */
 	if(mh.id[14]>='3') {
 		for(t=0;t<of.numchn;t++) of.panning[t]=_mm_read_UBYTE(modreader)<<4;

Places

File libmikmod-3.1.12-CVE-2009-3995,3996.diff of Package libmikmod (Revision 5c090443a95f0f980fd79c8daf4b1f6b)

Places