38 lines
1.3 KiB
Diff
38 lines
1.3 KiB
Diff
From 818bdd0ccc1e5b6cae742c740c17fd414935cf39 Mon Sep 17 00:00:00 2001
|
|
From: Mans Rullgard <mans@mansr.com>
|
|
Date: Sun, 5 Nov 2017 15:57:48 +0000
|
|
Subject: [PATCH] flac: fix crash on corrupt metadata (CVE-2017-15371)
|
|
|
|
---
|
|
src/flac.c | 8 +++++---
|
|
1 file changed, 5 insertions(+), 3 deletions(-)
|
|
|
|
Index: sox/src/flac.c
|
|
===================================================================
|
|
--- sox.orig/src/flac.c
|
|
+++ sox/src/flac.c
|
|
@@ -119,9 +119,10 @@ static void decoder_metadata_callback(FL
|
|
p->total_samples = metadata->data.stream_info.total_samples;
|
|
}
|
|
else if (metadata->type == FLAC__METADATA_TYPE_VORBIS_COMMENT) {
|
|
+ const FLAC__StreamMetadata_VorbisComment *vc = &metadata->data.vorbis_comment;
|
|
size_t i;
|
|
|
|
- if (metadata->data.vorbis_comment.num_comments == 0)
|
|
+ if (vc->num_comments == 0)
|
|
return;
|
|
|
|
if (ft->oob.comments != NULL) {
|
|
@@ -129,8 +130,9 @@ static void decoder_metadata_callback(FL
|
|
return;
|
|
}
|
|
|
|
- for (i = 0; i < metadata->data.vorbis_comment.num_comments; ++i)
|
|
- sox_append_comment(&ft->oob.comments, (char const *) metadata->data.vorbis_comment.comments[i].entry);
|
|
+ for (i = 0; i < vc->num_comments; ++i)
|
|
+ if (vc->comments[i].entry)
|
|
+ sox_append_comment(&ft->oob.comments, (char const *) vc->comments[i].entry);
|
|
}
|
|
}
|
|
|