okseby/Quake-III-Arena
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update libvorbis from 1.3.5 to 1.3.6

Browse source 
* Fix CVE-2018-5146 - out-of-bounds write on codebook decoding.
* Fix CVE-2017-14632 - free() on unitialized data
* Fix CVE-2017-14633 - out-of-bounds read
This commit is contained in:
Zack Middleton 2018-03-16 12:30:08 -05:00
parent ebd3d516ac
commit b78c6e61bf
67 changed files with 46 additions and 125 deletions
Download patch file Download diff file Expand all files Collapse all files

34
code/libvorbis-1.3.5/lib/info.c
View file

@ -11,7 +11,6 @@
********************************************************************
function: maintain the info structure, info <-> header packets
last mod: $Id: info.c 19441 2015-01-21 01:17:41Z xiphmont $
********************************************************************/
@ -31,8 +30,8 @@
#include "misc.h"
#include "os.h"
#define GENERAL_VENDOR_STRING "Xiph.Org libVorbis 1.3.5"
#define ENCODE_VENDOR_STRING "Xiph.Org libVorbis I 20150105 (⛄⛄⛄⛄)"
#define GENERAL_VENDOR_STRING "Xiph.Org libVorbis 1.3.6"
#define ENCODE_VENDOR_STRING "Xiph.Org libVorbis I 20180316 (Now 100% fewer shells)"
/* helpers */
static void _v_writestring(oggpack_buffer *o,const char *s, int bytes){
@ -65,11 +64,13 @@ void vorbis_comment_add(vorbis_comment *vc,const char *comment){
}
void vorbis_comment_add_tag(vorbis_comment *vc, const char *tag, const char *contents){
char *comment=alloca(strlen(tag)+strlen(contents)+2); /* +2 for = and \0 */
/* Length for key and value +2 for = and \0 */
char *comment=_ogg_malloc(strlen(tag)+strlen(contents)+2);
strcpy(comment, tag);
strcat(comment, "=");
strcat(comment, contents);
vorbis_comment_add(vc, comment);
_ogg_free(comment);
}
/* This is more or less the same as strncasecmp - but that doesn't exist
@ -88,27 +89,30 @@ char *vorbis_comment_query(vorbis_comment *vc, const char *tag, int count){
long i;
int found = 0;
int taglen = strlen(tag)+1; /* +1 for the = we append */
char *fulltag = alloca(taglen+ 1);
char *fulltag = _ogg_malloc(taglen+1);
strcpy(fulltag, tag);
strcat(fulltag, "=");
for(i=0;i<vc->comments;i++){
if(!tagcompare(vc->user_comments[i], fulltag, taglen)){
if(count == found)
if(count == found) {
/* We return a pointer to the data, not a copy */
return vc->user_comments[i] + taglen;
else
_ogg_free(fulltag);
return vc->user_comments[i] + taglen;
} else {
found++;
}
}
}
_ogg_free(fulltag);
return NULL; /* didn't find anything */
}
int vorbis_comment_query_count(vorbis_comment *vc, const char *tag){
int i,count=0;
int taglen = strlen(tag)+1; /* +1 for the = we append */
char *fulltag = alloca(taglen+1);
char *fulltag = _ogg_malloc(taglen+1);
strcpy(fulltag,tag);
strcat(fulltag, "=");
@ -117,6 +121,7 @@ int vorbis_comment_query_count(vorbis_comment *vc, const char *tag){
count++;
}
_ogg_free(fulltag);
return count;
}
@ -206,9 +211,9 @@ static int _vorbis_unpack_info(vorbis_info *vi,oggpack_buffer *opb){
vi->channels=oggpack_read(opb,8);
vi->rate=oggpack_read(opb,32);
vi->bitrate_upper=oggpack_read(opb,32);
vi->bitrate_nominal=oggpack_read(opb,32);
vi->bitrate_lower=oggpack_read(opb,32);
vi->bitrate_upper=(ogg_int32_t)oggpack_read(opb,32);
vi->bitrate_nominal=(ogg_int32_t)oggpack_read(opb,32);
vi->bitrate_lower=(ogg_int32_t)oggpack_read(opb,32);
ci->blocksizes[0]=1<<oggpack_read(opb,4);
ci->blocksizes[1]=1<<oggpack_read(opb,4);
@ -583,7 +588,8 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v,
oggpack_buffer opb;
private_state *b=v->backend_state;
if(!b||vi->channels<=0){
if(!b||vi->channels<=0||vi->channels>256){
b = NULL;
ret=OV_EFAULT;
goto err_out;
}
@ -642,7 +648,7 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v,
memset(op_code,0,sizeof(*op_code));
if(b){
oggpack_writeclear(&opb);
if(vi->channels>0)oggpack_writeclear(&opb);
if(b->header)_ogg_free(b->header);
if(b->header1)_ogg_free(b->header1);
if(b->header2)_ogg_free(b->header2);