Message ID | 98bfcbfa-4142-2985-864f-c146ac8d1f92@brendan.scot |
---|---|
State | Accepted |
Headers | show |
Series | [bug#42890] gnu: taglib: Include patch to prevent OGG corruption. | expand |
Context | Check | Description |
---|---|---|
cbaines/applying patch | fail | View Laminar job |
Hi Brendan, Brendan Tildesley writes: > I should apologise. I also prepared this same patch to submit over a > year or two ago but ended up neglecting it. I also discovered these two > CVE patches (attached) from another distribution that i was going to > add. Perhaps the best solution is to switch to git-reference and choose > a more recent commit that includes all these fixes. Your patch is in > master at > https://github.com/taglib/taglib/commit/9336c82da3a04552168f208cd7a5fa4646701ea4 > and the two I attached are also in master. No worries! Yeah I think it's a good to just use a git-reference in this case, I'll try that and submit another patch, thanks for the suggestion! Pierre
From 272648ccfcccae30e002ccf34a22e075dd477278 Mon Sep 17 00:00:00 2001 From: Scott Gayou <github.scott@gmail.com> Date: Mon, 4 Jun 2018 11:34:36 -0400 Subject: [PATCH] Fixed OOB read when loading invalid ogg flac file. (#868) CVE-2018-11439 is caused by a failure to check the minimum length of a ogg flac header. This header is detailed in full at: https://xiph.org/flac/ogg_mapping.html. Added more strict checking for entire header. --- taglib/ogg/flac/oggflacfile.cpp | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/taglib/ogg/flac/oggflacfile.cpp b/taglib/ogg/flac/oggflacfile.cpp index 53d04508a..07ea9dccc 100644 --- a/taglib/ogg/flac/oggflacfile.cpp +++ b/taglib/ogg/flac/oggflacfile.cpp @@ -231,11 +231,21 @@ void Ogg::FLAC::File::scan() if(!metadataHeader.startsWith("fLaC")) { // FLAC 1.1.2+ + // See https://xiph.org/flac/ogg_mapping.html for the header specification. + if(metadataHeader.size() < 13) + return; + + if(metadataHeader[0] != 0x7f) + return; + if(metadataHeader.mid(1, 4) != "FLAC") return; - if(metadataHeader[5] != 1) - return; // not version 1 + if(metadataHeader[5] != 1 && metadataHeader[6] != 0) + return; // not version 1.0 + + if(metadataHeader.mid(9, 4) != "fLaC") + return; metadataHeader = metadataHeader.mid(13); }