diff -Nru sox-14.4.1/debian/changelog sox-14.4.1/debian/changelog --- sox-14.4.1/debian/changelog 2019-01-31 16:19:24.000000000 +0000 +++ sox-14.4.1/debian/changelog 2019-07-30 15:27:13.000000000 +0000 @@ -1,3 +1,68 @@ +sox (14.4.1-5+deb8u4ubuntu0.1) xenial-security; urgency=medium + + * SECURITY UPDATE: Merge from Debian + - Fixes: + - CVE-2019-8354 + - CVE-2019-8356 + - CVE-2019-8357 + - Fixes overwritten by Debian: + - CVE-2017-11332 + - CVE-2017-11358 + - CVE-2017-11359 + - CVE-2017-15370 + - CVE-2017-15371 + - CVE-2017-15372 + - CVE-2017-15642 + - CVE-2017-18189 + - Ignored Debian's "override_dh_strip" in debian/rules as this change was + made by mistake + + -- Eduardo Barretto Mon, 29 Jul 2019 11:35:57 -0300 + +sox (14.4.1-5+deb8u4) jessie-security; urgency=medium + + * Non-maintainer upload by the LTS Team. + * CVE-2019-8354, CVE-2019-8355: buffer overflow in valloc functions. + * CVE-2019-8356: stack-based buffer overflow in bitrv2(). + * CVE-2019-8357: NULL pointer dereference in lsx_make_lpf(). + + -- Emilio Pozuelo Monfort Fri, 10 May 2019 01:08:00 +0200 + +sox (14.4.1-5+deb8u3) jessie-security; urgency=high + + * Non-maintainer upload by the LTS Team. + * CVE-2017-15371: reachable assertion in sox_append_comment() (formats.c) + (Closes: #878809). + * CVE-2017-11359: divide-by-zero error wavwritehdr function (wav.c) + (Closes: #870328). + * CVE-2017-11332: divide-by-zero error in startread function (wav.c). + * CVE-2017-11358: invalid memory read in read_samples function (hcom.c). + + -- Hugo Lefeuvre Tue, 05 Mar 2019 16:43:06 +0100 + +sox (14.4.1-5+deb8u2) jessie-security; urgency=high + + * Non-maintainer upload by the LTS Team. + * CVE-2017-15370: heap-based buffer overflow in the ImaExpandS function + of ima_rw.c (Closes: #878810). + * CVE-2017-15372: stack-based buffer overflow in the + lsx_ms_adpcm_block_expand_i function of adpcm.c (Closes: #878808). + * CVE-2017-18189: null pointer dereference caused by corrupt header + specifying zero channels, sending read_channels() into an infinite loop + (Closes: #881121). + * CVE-2017-15642: use-after-free in output_message, triggered by crafted + aiff file (Closes: #882144). + + -- Hugo Lefeuvre Thu, 28 Feb 2019 08:58:56 +0100 + +sox (14.4.1-5+deb8u1) jessie-security; urgency=medium + + * Non-maintainer upload. + * Add patches for CVE-2014-8145 to series file and really apply fixes. + Thanks to Mike Salvatore for spotting the issue. (Closes: #773720) + + -- Adrian Bunk Sun, 24 Feb 2019 18:04:09 +0200 + sox (14.4.1-5ubuntu0.1) xenial-security; urgency=medium * SECURITY UPDATE: Buffer overflow @@ -928,6 +993,3 @@ -- Joey Hess Sat, 30 Aug 1997 20:48:47 -0400 -Local variables: -mode: debian-changelog -End: diff -Nru sox-14.4.1/debian/patches/0001-Check-for-minimum-size-sphere-headers.patch sox-14.4.1/debian/patches/0001-Check-for-minimum-size-sphere-headers.patch --- sox-14.4.1/debian/patches/0001-Check-for-minimum-size-sphere-headers.patch 2019-01-31 15:17:40.000000000 +0000 +++ sox-14.4.1/debian/patches/0001-Check-for-minimum-size-sphere-headers.patch 2019-02-01 15:18:21.000000000 +0000 @@ -1,4 +1,4 @@ ---- a/src/sphere.c +--- a/src/sphere.c.old +++ b/src/sphere.c @@ -47,6 +47,11 @@ static int start_read(sox_format_t * ft) diff -Nru sox-14.4.1/debian/patches/0001-Clean-up-lsx_malloc-and-friends.patch sox-14.4.1/debian/patches/0001-Clean-up-lsx_malloc-and-friends.patch --- sox-14.4.1/debian/patches/0001-Clean-up-lsx_malloc-and-friends.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/0001-Clean-up-lsx_malloc-and-friends.patch 2019-05-09 23:08:00.000000000 +0000 @@ -0,0 +1,80 @@ +From ccedd08802f62ed896f69d778e6a106d00f9ab58 Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Tue, 8 Dec 2015 22:52:41 +0000 +Subject: [PATCH 1/5] Clean up lsx_malloc() and friends + +--- + src/Makefile.am | 2 +- + src/xmalloc.c | 30 +++++++++++++++++++++++++----- + src/xmalloc.h | 7 ++++--- + 3 files changed, 30 insertions(+), 9 deletions(-) + +diff --git a/src/xmalloc.c b/src/xmalloc.c +index 9bf15969..56fe6944 100644 +--- a/src/xmalloc.c ++++ b/src/xmalloc.c +@@ -20,6 +20,16 @@ + #include "sox_i.h" + #include + ++static void *lsx_checkptr(void *ptr) ++{ ++ if (!ptr) { ++ lsx_fail("out of memory"); ++ exit(2); ++ } ++ ++ return ptr; ++} ++ + /* Resize an allocated memory area; abort if not possible. + * + * For malloc, `If the size of the space requested is zero, the behavior is +@@ -34,10 +44,20 @@ void *lsx_realloc(void *ptr, size_t newsize) + return NULL; + } + +- if ((ptr = realloc(ptr, newsize)) == NULL) { +- lsx_fail("out of memory"); +- exit(2); +- } ++ return lsx_checkptr(realloc(ptr, newsize)); ++} + +- return ptr; ++void *lsx_malloc(size_t size) ++{ ++ return lsx_checkptr(malloc(size + !size)); ++} ++ ++void *lsx_calloc(size_t n, size_t size) ++{ ++ return lsx_checkptr(calloc(n + !n, size + !size)); ++} ++ ++char *lsx_strdup(const char *s) ++{ ++ return lsx_checkptr(strdup(s)); + } +diff --git a/src/xmalloc.h b/src/xmalloc.h +index 9ee77f63..92ac64d9 100644 +--- a/src/xmalloc.h ++++ b/src/xmalloc.h +@@ -23,10 +23,11 @@ + #include + #include + +-#define lsx_malloc(size) lsx_realloc(NULL, (size)) +-#define lsx_calloc(n,s) (((n)*(s))? memset(lsx_malloc((n)*(s)),0,(n)*(s)) : NULL) ++LSX_RETURN_VALID void *lsx_malloc(size_t size); ++LSX_RETURN_VALID void *lsx_calloc(size_t n, size_t size); ++LSX_RETURN_VALID char *lsx_strdup(const char *s); ++ + #define lsx_Calloc(v,n) v = lsx_calloc(n,sizeof(*(v))) +-#define lsx_strdup(p) ((p)? strcpy((char *)lsx_malloc(strlen(p) + 1), p) : NULL) + #define lsx_memdup(p,s) ((p)? memcpy(lsx_malloc(s), p, s) : NULL) + #define lsx_valloc(v,n) v = lsx_malloc((n)*sizeof(*(v))) + #define lsx_revalloc(v,n) v = lsx_realloc(v, (n)*sizeof(*(v))) +-- +2.20.1 + diff -Nru sox-14.4.1/debian/patches/0002-fix-possible-buffer-size-overflow-in-lsx_make_lpf-CV.patch sox-14.4.1/debian/patches/0002-fix-possible-buffer-size-overflow-in-lsx_make_lpf-CV.patch --- sox-14.4.1/debian/patches/0002-fix-possible-buffer-size-overflow-in-lsx_make_lpf-CV.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/0002-fix-possible-buffer-size-overflow-in-lsx_make_lpf-CV.patch 2019-05-09 23:08:00.000000000 +0000 @@ -0,0 +1,23 @@ +From f70911261a84333b077c29908e1242f69d7439eb Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Wed, 24 Apr 2019 14:57:34 +0100 +Subject: [PATCH 2/5] fix possible buffer size overflow in lsx_make_lpf() + (CVE-2019-8354) + +The multiplication in the size argument malloc() might overflow, +resulting in a small buffer being allocated. Use calloc() instead. +--- + src/effects_i_dsp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/src/effects_i_dsp.c ++++ b/src/effects_i_dsp.c +@@ -256,7 +256,7 @@ + double * lsx_make_lpf(int num_taps, double Fc, double beta, double scale, sox_bool dc_norm) + { + int i, m = num_taps - 1; +- double * h = malloc(num_taps * sizeof(*h)), sum = 0; ++ double * h = calloc(num_taps, sizeof(*h)), sum = 0; + double mult = scale / lsx_bessel_I_0(beta); + assert(Fc >= 0 && Fc <= 1); + lsx_debug("make_lpf(n=%i, Fc=%g beta=%g dc-norm=%i scale=%g)", num_taps, Fc, beta, dc_norm, scale); diff -Nru sox-14.4.1/debian/patches/0002-More-checks-for-invalid-MS-ADPCM-blocks.patch sox-14.4.1/debian/patches/0002-More-checks-for-invalid-MS-ADPCM-blocks.patch --- sox-14.4.1/debian/patches/0002-More-checks-for-invalid-MS-ADPCM-blocks.patch 2019-01-31 15:17:57.000000000 +0000 +++ sox-14.4.1/debian/patches/0002-More-checks-for-invalid-MS-ADPCM-blocks.patch 2019-02-01 15:18:21.000000000 +0000 @@ -1,4 +1,4 @@ ---- a/src/wav.c +--- a/src/wav.c.old +++ b/src/wav.c @@ -166,7 +166,7 @@ static unsigned short AdpcmReadBlock(sox_format_t * ft) /* work with partial blocks. Specs say it should be null */ diff -Nru sox-14.4.1/debian/patches/0003-fix-possible-overflow-in-lsx_-re-valloc-size-calcula.patch sox-14.4.1/debian/patches/0003-fix-possible-overflow-in-lsx_-re-valloc-size-calcula.patch --- sox-14.4.1/debian/patches/0003-fix-possible-overflow-in-lsx_-re-valloc-size-calcula.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/0003-fix-possible-overflow-in-lsx_-re-valloc-size-calcula.patch 2019-05-09 23:08:00.000000000 +0000 @@ -0,0 +1,55 @@ +From f8587e2d50dad72d40453ac1191c539ee9e50381 Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Wed, 24 Apr 2019 17:39:45 +0100 +Subject: [PATCH 3/5] fix possible overflow in lsx_(re)valloc() size + calculation (CVE-2019-8355) + +--- + src/Makefile.am | 2 +- + src/xmalloc.c | 10 ++++++++++ + src/xmalloc.h | 5 +++-- + 3 files changed, 14 insertions(+), 3 deletions(-) + +diff --git a/src/xmalloc.c b/src/xmalloc.c +index 56fe6944..72c9ea4d 100644 +--- a/src/xmalloc.c ++++ b/src/xmalloc.c +@@ -57,6 +57,16 @@ void *lsx_calloc(size_t n, size_t size) + return lsx_checkptr(calloc(n + !n, size + !size)); + } + ++void *lsx_realloc_array(void *p, size_t n, size_t size) ++{ ++ if (n > (size_t)-1 / size) { ++ lsx_fail("malloc size overflow"); ++ exit(2); ++ } ++ ++ return lsx_realloc(p, n * size); ++} ++ + char *lsx_strdup(const char *s) + { + return lsx_checkptr(strdup(s)); +diff --git a/src/xmalloc.h b/src/xmalloc.h +index 92ac64d9..21ff6630 100644 +--- a/src/xmalloc.h ++++ b/src/xmalloc.h +@@ -25,11 +25,12 @@ + + LSX_RETURN_VALID void *lsx_malloc(size_t size); + LSX_RETURN_VALID void *lsx_calloc(size_t n, size_t size); ++LSX_RETURN_VALID void *lsx_realloc_array(void *p, size_t n, size_t size); + LSX_RETURN_VALID char *lsx_strdup(const char *s); + + #define lsx_Calloc(v,n) v = lsx_calloc(n,sizeof(*(v))) + #define lsx_memdup(p,s) ((p)? memcpy(lsx_malloc(s), p, s) : NULL) +-#define lsx_valloc(v,n) v = lsx_malloc((n)*sizeof(*(v))) +-#define lsx_revalloc(v,n) v = lsx_realloc(v, (n)*sizeof(*(v))) ++#define lsx_valloc(v,n) v = lsx_realloc_array(NULL, n, sizeof(*(v))) ++#define lsx_revalloc(v,n) v = lsx_realloc_array(v, n, sizeof(*(v))) + + #endif +-- +2.20.1 + diff -Nru sox-14.4.1/debian/patches/0004-fft4g-bail-if-size-too-large-CVE-2019-8356.patch sox-14.4.1/debian/patches/0004-fft4g-bail-if-size-too-large-CVE-2019-8356.patch --- sox-14.4.1/debian/patches/0004-fft4g-bail-if-size-too-large-CVE-2019-8356.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/0004-fft4g-bail-if-size-too-large-CVE-2019-8356.patch 2019-05-09 23:08:00.000000000 +0000 @@ -0,0 +1,92 @@ +From b7883ae1398499daaa926ae6621f088f0f531ed8 Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Wed, 24 Apr 2019 16:56:42 +0100 +Subject: [PATCH 4/5] fft4g: bail if size too large (CVE-2019-8356) + +Prevent overflowing of fixed-size buffers in bitrv2() and bitrv2conj() +if the transform size is too large. +--- + src/fft4g.c | 18 ++++++++++++++++++ + src/fft4g.h | 2 ++ + 2 files changed, 20 insertions(+) + +diff --git a/src/fft4g.c b/src/fft4g.c +index 38a8bcc0..88a2a7ec 100644 +--- a/src/fft4g.c ++++ b/src/fft4g.c +@@ -322,6 +322,9 @@ static void rftfsub(int n, double *a, int nc, double const *c); + + void cdft(int n, int isgn, double *a, int *ip, double *w) + { ++ if (n > FFT4G_MAX_SIZE) ++ return; ++ + if (n > (ip[0] << 2)) { + makewt(n >> 2, ip, w); + } +@@ -344,6 +347,9 @@ void rdft(int n, int isgn, double *a, int *ip, double *w) + int nw, nc; + double xi; + ++ if (n > FFT4G_MAX_SIZE) ++ return; ++ + nw = ip[0]; + if (n > (nw << 2)) { + nw = n >> 2; +@@ -384,6 +390,9 @@ void ddct(int n, int isgn, double *a, int *ip, double *w) + int j, nw, nc; + double xr; + ++ if (n > FFT4G_MAX_SIZE) ++ return; ++ + nw = ip[0]; + if (n > (nw << 2)) { + nw = n >> 2; +@@ -435,6 +444,9 @@ void ddst(int n, int isgn, double *a, int *ip, double *w) + int j, nw, nc; + double xr; + ++ if (n > FFT4G_MAX_SIZE) ++ return; ++ + nw = ip[0]; + if (n > (nw << 2)) { + nw = n >> 2; +@@ -486,6 +498,9 @@ void dfct(int n, double *a, double *t, int *ip, double *w) + int j, k, l, m, mh, nw, nc; + double xr, xi, yr, yi; + ++ if (n > FFT4G_MAX_SIZE) ++ return; ++ + nw = ip[0]; + if (n > (nw << 3)) { + nw = n >> 3; +@@ -576,6 +591,9 @@ void dfst(int n, double *a, double *t, int *ip, double *w) + int j, k, l, m, mh, nw, nc; + double xr, xi, yr, yi; + ++ if (n > FFT4G_MAX_SIZE) ++ return; ++ + nw = ip[0]; + if (n > (nw << 3)) { + nw = n >> 3; +diff --git a/src/fft4g.h b/src/fft4g.h +index 2b8051ca..95ee3413 100644 +--- a/src/fft4g.h ++++ b/src/fft4g.h +@@ -13,6 +13,8 @@ + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + */ + ++#define FFT4G_MAX_SIZE 262144 ++ + void lsx_cdft(int, int, double *, int *, double *); + void lsx_rdft(int, int, double *, int *, double *); + void lsx_ddct(int, int, double *, int *, double *); +-- +2.20.1 + diff -Nru sox-14.4.1/debian/patches/0005-fix-possible-null-pointer-deref-in-lsx_make_lpf-CVE-.patch sox-14.4.1/debian/patches/0005-fix-possible-null-pointer-deref-in-lsx_make_lpf-CVE-.patch --- sox-14.4.1/debian/patches/0005-fix-possible-null-pointer-deref-in-lsx_make_lpf-CVE-.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/0005-fix-possible-null-pointer-deref-in-lsx_make_lpf-CVE-.patch 2019-05-09 23:08:00.000000000 +0000 @@ -0,0 +1,24 @@ +From 2ce02fea7b350de9ddfbcf542ba4dd59a8ab255b Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Wed, 24 Apr 2019 15:08:51 +0100 +Subject: [PATCH 5/5] fix possible null pointer deref in lsx_make_lpf() + (CVE-2019-8357) + +If the buffer allocation fails, return NULL. +--- + src/effects_i_dsp.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/src/effects_i_dsp.c ++++ b/src/effects_i_dsp.c +@@ -260,6 +260,10 @@ + double mult = scale / lsx_bessel_I_0(beta); + assert(Fc >= 0 && Fc <= 1); + lsx_debug("make_lpf(n=%i, Fc=%g beta=%g dc-norm=%i scale=%g)", num_taps, Fc, beta, dc_norm, scale); ++ ++ if (!h) ++ return NULL; ++ + for (i = 0; i <= m / 2; ++i) { + double x = M_PI * (i - .5 * m), y = 2. * i / m - 1; + h[i] = x? sin(Fc * x) / x : Fc; diff -Nru sox-14.4.1/debian/patches/CVE-2017-11332.patch sox-14.4.1/debian/patches/CVE-2017-11332.patch --- sox-14.4.1/debian/patches/CVE-2017-11332.patch 2019-01-31 15:50:49.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-11332.patch 2019-03-05 15:43:06.000000000 +0000 @@ -1,15 +1,11 @@ -From 7405bcaacb1ded8c595cb751d407cf738cb26571 Mon Sep 17 00:00:00 2001 -From: Mans Rullgard -Date: Sun, 5 Nov 2017 16:29:28 +0000 -Subject: [PATCH] wav: fix crash if channel count is zero (CVE-2017-11332) - ---- - src/wav.c | 5 +++++ - 1 file changed, 5 insertions(+) - ---- a/src/wav.c -+++ b/src/wav.c -@@ -613,6 +613,11 @@ static int startread(sox_format_t * ft) +Description: wav: fix crash if channel count is zero + WAV files declaring zero channels lead to division-by-zero crashes. + numchannels = 0 is not a meaningful value, forbid it. +Author: Mans Rullgard +Origin: upstream, https://github.com/mansr/sox/commit/7405bcaacb1ded8c595cb751d407cf738cb26571 +--- a/src/wav.c 2019-03-05 16:42:55.000000000 +0100 ++++ b/src/wav.c 2019-03-05 16:58:31.066400747 +0100 +@@ -614,6 +614,11 @@ else lsx_report("User options overriding channels read in .wav header"); diff -Nru sox-14.4.1/debian/patches/CVE-2017-11358.patch sox-14.4.1/debian/patches/CVE-2017-11358.patch --- sox-14.4.1/debian/patches/CVE-2017-11358.patch 2019-01-31 15:51:06.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-11358.patch 2019-03-05 15:43:06.000000000 +0000 @@ -1,18 +1,9 @@ -From 6cb44a44b9eda6b321ccdbf6483348d4a9798b00 Mon Sep 17 00:00:00 2001 -From: Mans Rullgard -Date: Sun, 5 Nov 2017 16:43:35 +0000 -Subject: [PATCH] hcom: fix crash on input with corrupt dictionary - (CVE-2017-11358) - ---- - src/hcom.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/src/hcom.c b/src/hcom.c -index c62b020c..1b0e09dd 100644 ---- a/src/hcom.c -+++ b/src/hcom.c -@@ -150,6 +150,11 @@ static int startread(sox_format_t * ft) +Subject: hcom: fix crash on input with corrupt dictionary +Author: Mans Rullgard +Origin: upstream, https://github.com/mansr/sox/commit/6cb44a44b9eda6b321ccdbf6483348d4a9798b00 +--- a/src/hcom.c 2012-01-23 23:27:33.000000000 +0100 ++++ b/src/hcom.c 2019-03-05 17:03:20.202990165 +0100 +@@ -150,6 +150,11 @@ lsx_debug("%d %d", p->dictionary[i].dict_leftson, p->dictionary[i].dict_rightson); diff -Nru sox-14.4.1/debian/patches/CVE-2017-11359.patch sox-14.4.1/debian/patches/CVE-2017-11359.patch --- sox-14.4.1/debian/patches/CVE-2017-11359.patch 2019-01-31 15:51:24.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-11359.patch 2019-03-05 15:43:06.000000000 +0000 @@ -1,16 +1,11 @@ -From 8b590b3a52f4ccc4eea3f41b4a067c38b3565b60 Mon Sep 17 00:00:00 2001 -From: Mans Rullgard -Date: Sun, 5 Nov 2017 17:02:11 +0000 -Subject: [PATCH] wav: fix crash writing header when channel count >64k - (CVE-2017-11359) - ---- - src/wav.c | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/src/wav.c -+++ b/src/wav.c -@@ -1275,6 +1275,12 @@ static int wavwritehdr(sox_format_t * ft +Description: wav: fix crash writing header when channel count >64k + High number of channels (>64k) lead to divide-by-zero error and crash. Number + of channels should be representable with 16 bits, so forbid any higher value. +Author: Mans Rullgard +Origin: upstream, https://github.com/mansr/sox/commit/8b590b3a52f4ccc4eea3f41b4a067c38b3565b60 +--- a/src/wav.c 2019-03-05 17:05:44.053925697 +0100 ++++ b/src/wav.c 2019-03-05 17:07:53.657036855 +0100 +@@ -1278,6 +1278,12 @@ long blocksWritten = 0; sox_bool isExtensible = sox_false; /* WAVE_FORMAT_EXTENSIBLE? */ diff -Nru sox-14.4.1/debian/patches/CVE-2017-15370.patch sox-14.4.1/debian/patches/CVE-2017-15370.patch --- sox-14.4.1/debian/patches/CVE-2017-15370.patch 2019-01-31 15:51:38.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-15370.patch 2019-02-28 07:58:56.000000000 +0000 @@ -1,18 +1,11 @@ -From ef3d8be0f80cbb650e4766b545d61e10d7a24c9e Mon Sep 17 00:00:00 2001 -From: Mans Rullgard -Date: Sun, 5 Nov 2017 16:21:23 +0000 -Subject: [PATCH] wav: ima_adpcm: fix buffer overflow on corrupt input - (CVE-2017-15370) - -Add the same check bad block size as was done for MS adpcm in commit -f39c574b ("More checks for invalid MS ADPCM blocks"). ---- - src/wav.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/src/wav.c -+++ b/src/wav.c -@@ -125,7 +125,7 @@ static unsigned short ImaAdpcmReadBlock +Description: wav: ima_adpcm: fix buffer overflow on corrupt input + Add the same check bad block size as was done for MS adpcm in patch + 0002-More-checks-for-invalid-MS-ADPCM-blocks.patch. +Author: Mans Rullgard +Origin: upstream, https://github.com/mansr/sox/commit/ef3d8be0f80cbb650e4766b545d61e10d7a24c9e +--- a/src/wav.c 2019-02-28 10:06:36.428053693 +0100 ++++ b/src/wav.c 2019-02-28 10:07:05.191757247 +0100 +@@ -125,7 +125,7 @@ /* work with partial blocks. Specs say it should be null */ /* padded but I guess this is better than trailing quiet. */ samplesThisBlock = lsx_ima_samples_in((size_t)0, (size_t)ft->signal.channels, bytesRead, (size_t) 0); diff -Nru sox-14.4.1/debian/patches/CVE-2017-15371.patch sox-14.4.1/debian/patches/CVE-2017-15371.patch --- sox-14.4.1/debian/patches/CVE-2017-15371.patch 2019-01-31 15:52:10.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-15371.patch 2019-03-05 15:43:06.000000000 +0000 @@ -1,15 +1,9 @@ -From 818bdd0ccc1e5b6cae742c740c17fd414935cf39 Mon Sep 17 00:00:00 2001 -From: Mans Rullgard -Date: Sun, 5 Nov 2017 15:57:48 +0000 -Subject: [PATCH] flac: fix crash on corrupt metadata (CVE-2017-15371) - ---- - src/flac.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - ---- a/src/flac.c -+++ b/src/flac.c -@@ -78,9 +78,10 @@ static void FLAC__decoder_metadata_callb +Subject: flac: fix crash on corrupt metadata +Author: Mans Rullgard +Origin: upstream, https://github.com/mansr/sox/commit/818bdd0ccc1e5b6cae742c740c17fd414935cf39 +--- a/src/flac.c 2013-01-13 20:57:39.000000000 +0100 ++++ b/src/flac.c 2019-03-05 17:15:06.998569651 +0100 +@@ -78,9 +78,10 @@ p->total_samples = metadata->data.stream_info.total_samples; } else if (metadata->type == FLAC__METADATA_TYPE_VORBIS_COMMENT) { @@ -21,7 +15,7 @@ return; if (ft->oob.comments != NULL) { -@@ -88,8 +89,9 @@ static void FLAC__decoder_metadata_callb +@@ -88,8 +89,9 @@ return; } diff -Nru sox-14.4.1/debian/patches/CVE-2017-15372.patch sox-14.4.1/debian/patches/CVE-2017-15372.patch --- sox-14.4.1/debian/patches/CVE-2017-15372.patch 2019-01-31 15:55:07.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-15372.patch 2019-02-28 07:58:56.000000000 +0000 @@ -1,17 +1,9 @@ -From 3f7ed312614649e2695b54b398475d32be4f64f3 Mon Sep 17 00:00:00 2001 -From: Mans Rullgard -Date: Wed, 8 Nov 2017 00:29:14 +0000 -Subject: adpcm: fix stack overflow with >4 channels (CVE-2017-15372) - ---- - src/adpcm.c | 8 +++++++- - src/adpcm.h | 3 +++ - src/wav.c | 5 ++++- - 3 files changed, 14 insertions(+), 2 deletions(-) - ---- a/src/adpcm.c -+++ b/src/adpcm.c -@@ -71,6 +71,11 @@ const short lsx_ms_adpcm_i_coef[7][2] = +Subject: fix stack buffer overflow in lsx_ms_adpcm_block_expand_i +Author: Mans Rullgard +Origin: upstream, https://github.com/mansr/sox/commit/001c337552912d286ba68086ac378f6fdc1e8b50 +--- a/src/adpcm.c 2012-01-23 23:27:33.000000000 +0100 ++++ b/src/adpcm.c 2019-02-28 10:15:09.251531753 +0100 +@@ -71,6 +71,11 @@ { 392,-232} }; @@ -23,7 +15,7 @@ static inline sox_sample_t AdpcmDecode(sox_sample_t c, MsState_t *state, sox_sample_t sample1, sox_sample_t sample2) { -@@ -102,6 +107,7 @@ static inline sox_sample_t AdpcmDecode(s +@@ -102,6 +107,7 @@ /* lsx_ms_adpcm_block_expand_i() outputs interleaved samples into one output buffer */ const char *lsx_ms_adpcm_block_expand_i( @@ -31,7 +23,7 @@ unsigned chans, /* total channels */ int nCoef, const short *coef, -@@ -113,7 +119,7 @@ const char *lsx_ms_adpcm_block_expand_i( +@@ -113,7 +119,7 @@ const unsigned char *ip; unsigned ch; const char *errmsg = NULL; @@ -40,8 +32,8 @@ /* Read the four-byte header for each channel */ ip = ibuff; ---- a/src/adpcm.h -+++ b/src/adpcm.h +--- a/src/adpcm.h 2012-01-23 23:27:33.000000000 +0100 ++++ b/src/adpcm.h 2019-02-28 10:15:09.251531753 +0100 @@ -29,8 +29,11 @@ /* default coef sets */ extern const short lsx_ms_adpcm_i_coef[7][2]; @@ -54,9 +46,9 @@ unsigned chans, /* total channels */ int nCoef, const short *coef, ---- a/src/wav.c -+++ b/src/wav.c -@@ -82,6 +82,7 @@ typedef struct { +--- a/src/wav.c 2019-02-28 10:14:50.207678261 +0100 ++++ b/src/wav.c 2019-02-28 10:15:09.255531722 +0100 +@@ -82,6 +82,7 @@ /* following used by *ADPCM wav files */ unsigned short nCoefs; /* ADPCM: number of coef sets */ short *lsx_ms_adpcm_i_coefs; /* ADPCM: coef sets */ @@ -64,7 +56,7 @@ unsigned char *packet; /* Temporary buffer for packets */ short *samples; /* interleaved samples buffer */ short *samplePtr; /* Pointer to current sample */ -@@ -173,7 +174,7 @@ static unsigned short AdpcmReadBlock(so +@@ -173,7 +174,7 @@ } } @@ -73,7 +65,7 @@ if (errmsg) lsx_warn("%s", errmsg); -@@ -692,6 +693,7 @@ static int startread(sox_format_t * ft) +@@ -687,6 +688,7 @@ /* nCoefs, lsx_ms_adpcm_i_coefs used by adpcm.c */ wav->lsx_ms_adpcm_i_coefs = lsx_malloc(wav->nCoefs * 2 * sizeof(short)); @@ -81,7 +73,7 @@ { int i, errct=0; for (i=0; len>=2 && i < 2*wav->nCoefs; i++) { -@@ -1112,6 +1114,7 @@ static int stopread(sox_format_t * ft) +@@ -1107,6 +1109,7 @@ free(wav->packet); free(wav->samples); free(wav->lsx_ms_adpcm_i_coefs); diff -Nru sox-14.4.1/debian/patches/CVE-2017-15642.patch sox-14.4.1/debian/patches/CVE-2017-15642.patch --- sox-14.4.1/debian/patches/CVE-2017-15642.patch 2019-01-31 15:52:28.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-15642.patch 2019-02-28 07:58:56.000000000 +0000 @@ -1,16 +1,11 @@ -Description: This fixes a use after free and double free if an empty comment -chunk follows a non-empty one. +Description: aiff: fix crash on empty comment chunk (CVE-2017-15642) + This fixes a use after free and double free if an empty comment + chunk follows a non-empty one. Author: Mans Rullgard -Forwarded: not-needed ---- - src/aiff.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -Index: sox/src/aiff.c -=================================================================== ---- sox.orig/src/aiff.c -+++ sox/src/aiff.c -@@ -62,7 +62,6 @@ int lsx_aiffstartread(sox_format_t * ft) +Origin: upstream, https://github.com/mansr/sox/commit/0be259eaa9ce3f3fa587a3ef0cf2c0b9c73167a2 +--- a/src/aiff.c 2012-01-23 23:27:33.000000000 +0100 ++++ b/src/aiff.c 2019-02-28 10:46:46.358710941 +0100 +@@ -62,7 +62,6 @@ size_t ssndsize = 0; char *annotation; char *author; @@ -18,7 +13,7 @@ char *copyright; char *nametext; -@@ -270,6 +269,7 @@ int lsx_aiffstartread(sox_format_t * ft) +@@ -270,6 +269,7 @@ free(annotation); } else if (strncmp(buf, "COMT", (size_t)4) == 0) { diff -Nru sox-14.4.1/debian/patches/CVE-2017-18189.patch sox-14.4.1/debian/patches/CVE-2017-18189.patch --- sox-14.4.1/debian/patches/CVE-2017-18189.patch 2019-01-31 15:53:06.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-18189.patch 2019-02-28 07:58:56.000000000 +0000 @@ -1,21 +1,13 @@ -Description: A corrupt header specifying zero channels would send read_channels() -into an infinite loop. Prevent this by sanity checking the channel -count in open_read(). Also add an upper bound to prevent overflow -in multiplication. -https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881121 +Description: xa: validate channel count + A corrupt header specifying zero channels would send read_channels() + into an infinite loop. Prevent this by sanity checking the channel + count in open_read(). Also add an upper bound to prevent overflow + in multiplication. Author: Mans Rullgard - Jaromír Mikeš -Forwarded: not-needed - ---- - src/xa.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -Index: sox/src/xa.c -=================================================================== ---- sox.orig/src/xa.c -+++ sox/src/xa.c -@@ -143,6 +143,12 @@ static int startread(sox_format_t * ft) +Origin: upstream, https://github.com/mansr/sox/commit/7a8ceb86212b28243bbb6d0de636f0dfbe833e53 +--- a/src/xa.c 2012-01-23 23:27:33.000000000 +0100 ++++ b/src/xa.c 2019-02-28 10:32:46.220409795 +0100 +@@ -143,6 +143,12 @@ lsx_report("User options overriding rate read in .xa header"); } diff -Nru sox-14.4.1/debian/patches/CVE-2019-8355.patch sox-14.4.1/debian/patches/CVE-2019-8355.patch --- sox-14.4.1/debian/patches/CVE-2019-8355.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2019-8355.patch 2019-05-09 23:03:32.000000000 +0000 @@ -0,0 +1,28 @@ +--- a/src/xmalloc.c ++++ b/src/xmalloc.c +@@ -41,3 +41,13 @@ + + return ptr; + } ++ ++void *lsx_realloc_array(void *p, size_t n, size_t size) ++{ ++ if (n > (size_t)-1 / size) { ++ lsx_fail("malloc size overflow"); ++ exit(2); ++ } ++ ++ return lsx_realloc(p, n * size); ++} +--- a/src/xmalloc.h ++++ b/src/xmalloc.h +@@ -28,7 +28,7 @@ + #define lsx_Calloc(v,n) v = lsx_calloc(n,sizeof(*(v))) + #define lsx_strdup(p) ((p)? strcpy((char *)lsx_malloc(strlen(p) + 1), p) : NULL) + #define lsx_memdup(p,s) ((p)? memcpy(lsx_malloc(s), p, s) : NULL) +-#define lsx_valloc(v,n) v = lsx_malloc((n)*sizeof(*(v))) +-#define lsx_revalloc(v,n) v = lsx_realloc(v, (n)*sizeof(*(v))) ++#define lsx_valloc(v,n) v = lsx_realloc_array(NULL, n, sizeof(*(v))) ++#define lsx_revalloc(v,n) v = lsx_realloc_array(v, n, sizeof(*(v))) + + #endif diff -Nru sox-14.4.1/debian/patches/CVE-2019-8356.patch sox-14.4.1/debian/patches/CVE-2019-8356.patch --- sox-14.4.1/debian/patches/CVE-2019-8356.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2019-8356.patch 2019-05-09 23:00:09.000000000 +0000 @@ -0,0 +1,73 @@ +--- a/src/fft4g.c ++++ b/src/fft4g.c +@@ -322,6 +322,9 @@ + + void cdft(int n, int isgn, double *a, int *ip, double *w) + { ++ if (n > FFT4G_MAX_SIZE) ++ return; ++ + if (n > (ip[0] << 2)) { + makewt(n >> 2, ip, w); + } +@@ -344,6 +347,9 @@ + int nw, nc; + double xi; + ++ if (n > FFT4G_MAX_SIZE) ++ return; ++ + nw = ip[0]; + if (n > (nw << 2)) { + nw = n >> 2; +@@ -384,6 +390,9 @@ + int j, nw, nc; + double xr; + ++ if (n > FFT4G_MAX_SIZE) ++ return; ++ + nw = ip[0]; + if (n > (nw << 2)) { + nw = n >> 2; +@@ -435,6 +444,9 @@ + int j, nw, nc; + double xr; + ++ if (n > FFT4G_MAX_SIZE) ++ return; ++ + nw = ip[0]; + if (n > (nw << 2)) { + nw = n >> 2; +@@ -486,6 +498,9 @@ + int j, k, l, m, mh, nw, nc; + double xr, xi, yr, yi; + ++ if (n > FFT4G_MAX_SIZE) ++ return; ++ + nw = ip[0]; + if (n > (nw << 3)) { + nw = n >> 3; +@@ -576,6 +591,9 @@ + int j, k, l, m, mh, nw, nc; + double xr, xi, yr, yi; + ++ if (n > FFT4G_MAX_SIZE) ++ return; ++ + nw = ip[0]; + if (n > (nw << 3)) { + nw = n >> 3; +--- a/src/fft4g.h ++++ b/src/fft4g.h +@@ -13,6 +13,8 @@ + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + */ + ++#define FFT4G_MAX_SIZE 262144 ++ + void lsx_cdft(int, int, double *, int *, double *); + void lsx_rdft(int, int, double *, int *, double *); + void lsx_ddct(int, int, double *, int *, double *); diff -Nru sox-14.4.1/debian/patches/CVE-2019-8357.patch sox-14.4.1/debian/patches/CVE-2019-8357.patch --- sox-14.4.1/debian/patches/CVE-2019-8357.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2019-8357.patch 2019-05-09 22:57:27.000000000 +0000 @@ -0,0 +1,13 @@ +--- a/src/effects_i_dsp.c ++++ b/src/effects_i_dsp.c +@@ -260,6 +260,10 @@ + double mult = scale / lsx_bessel_I_0(beta); + assert(Fc >= 0 && Fc <= 1); + lsx_debug("make_lpf(n=%i, Fc=%g beta=%g dc-norm=%i scale=%g)", num_taps, Fc, beta, dc_norm, scale); ++ ++ if (!h) ++ return NULL; ++ + for (i = 0; i <= m / 2; ++i) { + double x = M_PI * (i - .5 * m), y = 2. * i / m - 1; + h[i] = x? sin(Fc * x) / x : Fc; diff -Nru sox-14.4.1/debian/patches/series sox-14.4.1/debian/patches/series --- sox-14.4.1/debian/patches/series 2019-01-31 15:54:12.000000000 +0000 +++ sox-14.4.1/debian/patches/series 2019-05-09 23:08:00.000000000 +0000 @@ -1,10 +1,20 @@ 0001-Check-for-minimum-size-sphere-headers.patch 0002-More-checks-for-invalid-MS-ADPCM-blocks.patch + +CVE-2017-15370.patch +CVE-2017-15372.patch +CVE-2017-18189.patch +CVE-2017-15642.patch + CVE-2017-11332.patch CVE-2017-11358.patch CVE-2017-11359.patch -CVE-2017-15370.patch -CVE-2017-15372.patch CVE-2017-15371.patch -CVE-2017-15642.patch -CVE-2017-18189.patch +#CVE-2019-8355.patch +#CVE-2019-8356.patch +#CVE-2019-8357.patch +0001-Clean-up-lsx_malloc-and-friends.patch +0002-fix-possible-buffer-size-overflow-in-lsx_make_lpf-CV.patch +0003-fix-possible-overflow-in-lsx_-re-valloc-size-calcula.patch +0004-fft4g-bail-if-size-too-large-CVE-2019-8356.patch +0005-fix-possible-null-pointer-deref-in-lsx_make_lpf-CVE-.patch