| From ef3d8be0f80cbb650e4766b545d61e10d7a24c9e Mon Sep 17 00:00:00 2001 |
| From: Mans Rullgard <mans@mansr.com> |
| Date: Sun, 5 Nov 2017 16:21:23 +0000 |
| Subject: [PATCH] wav: ima_adpcm: fix buffer overflow on corrupt input |
| (CVE-2017-15370) |
| |
| Add the same check bad block size as was done for MS adpcm in commit |
| f39c574b ("More checks for invalid MS ADPCM blocks"). |
| --- |
| src/wav.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/src/wav.c b/src/wav.c |
| index 5202556c..3e80e692 100644 |
| --- a/src/wav.c |
| +++ b/src/wav.c |
| @@ -127,7 +127,7 @@ static unsigned short ImaAdpcmReadBlock(sox_format_t * ft) |
| /* work with partial blocks. Specs say it should be null */ |
| /* padded but I guess this is better than trailing quiet. */ |
| samplesThisBlock = lsx_ima_samples_in((size_t)0, (size_t)ft->signal.channels, bytesRead, (size_t) 0); |
| - if (samplesThisBlock == 0) |
| + if (samplesThisBlock == 0 || samplesThisBlock > wav->samplesPerBlock) |
| { |
| lsx_warn("Premature EOF on .wav input file"); |
| return 0; |
