diff -Nru sox-14.4.1/debian/changelog sox-14.4.1/debian/changelog --- sox-14.4.1/debian/changelog 2013-12-31 01:39:39.000000000 +0000 +++ sox-14.4.1/debian/changelog 2019-01-31 16:22:54.000000000 +0000 @@ -1,3 +1,48 @@ +sox (14.4.1-3ubuntu1.1) trusty-security; urgency=medium + + * SECURITY UPDATE: Buffer overflow + - debian/patches/0001-Check-for-minimum-size-sphere-headers.patch: Avoid + integer underflow by validating the header_size_ul for NIST sphere + formatted media files. + - debian/patches/0002-More-checks-for-invalid-MS-ADPCM-blocks.patch: Check + the number of samples in a wav block against the expected samples per + block. + - CVE-2014-8145 + * SECURITY UPDATE: Division by zero + - debian/patches/CVE-2017-11332.patch: wav: fix crash if channel count is + zero + - CVE-2017-11332 + * SECURITY UPDATE: Division by zero + - debian/patches/CVE-2017-11358.patch: hcom: fix crash on input with + corrupt dictionary + - CVE-2017-11358 + * SECURITY UPDATE: Invalid memory read + - debian/patches/CVE-2017-11359.patch: wav: fix crash writing header when + channel count >64k + - CVE-2017-11359 + * SECURITY UPDATE: Buffer overflow + - debian/patches/CVE-2017-15370.patch: wav: ima_adpcm: fix buffer overflow + on corrupt input + - CVE-2017-15370 + * SECURITY UPDATE: Buffer overflow + - debian/patches/CVE-2017-15371.patch: flac: fix crash on corrupt metadata + - CVE-2017-15371 + * SECURITY UPDATE: Buffer overflow + - debian/patches/CVE-2017-15372.patch: adpcm: fix stack overflow with >4 + channels + - CVE-2017-15372 + * SECURITY UPDATE: Use after free + - debian/patches/CVE-2017-15642.patch: adpcm: fix a user after free and + double free if an empty comment chunk follows a non-empty one. + - CVE-2017-15642 + * SECURITY UPDATE: NULL pointer dereference + - debian/patches/CVE-2017-18189.patch: Prevent infinite loop caused by + specifying zero channels in a header. Also add an upper bound to prevent + overflow in multiplication + - CVE-2017-18189 + + -- Mike Salvatore Thu, 31 Jan 2019 11:22:54 -0500 + sox (14.4.1-3ubuntu1) trusty; urgency=medium * Build with dh-autoreconf instead of autotools-dev for new libtool. diff -Nru sox-14.4.1/debian/patches/0001-Check-for-minimum-size-sphere-headers.patch sox-14.4.1/debian/patches/0001-Check-for-minimum-size-sphere-headers.patch --- sox-14.4.1/debian/patches/0001-Check-for-minimum-size-sphere-headers.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/0001-Check-for-minimum-size-sphere-headers.patch 2019-01-31 16:22:21.000000000 +0000 @@ -0,0 +1,14 @@ +--- a/src/sphere.c ++++ b/src/sphere.c +@@ -47,6 +47,11 @@ static int start_read(sox_format_t * ft) + + /* Determine header size, and allocate a buffer large enough to hold it. */ + sscanf(fldsval, "%lu", &header_size_ul); ++ if (header_size_ul < 16) { ++ lsx_fail_errno(ft, SOX_EHDR, "Error reading Sphere header"); ++ return (SOX_EOF); ++ } ++ + buf = lsx_malloc(header_size = header_size_ul); + + /* Skip what we have read so far */ diff -Nru sox-14.4.1/debian/patches/0002-More-checks-for-invalid-MS-ADPCM-blocks.patch sox-14.4.1/debian/patches/0002-More-checks-for-invalid-MS-ADPCM-blocks.patch --- sox-14.4.1/debian/patches/0002-More-checks-for-invalid-MS-ADPCM-blocks.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/0002-More-checks-for-invalid-MS-ADPCM-blocks.patch 2019-01-31 16:22:21.000000000 +0000 @@ -0,0 +1,11 @@ +--- a/src/wav.c ++++ b/src/wav.c +@@ -166,7 +166,7 @@ static unsigned short AdpcmReadBlock(sox_format_t * ft) + /* work with partial blocks. Specs say it should be null */ + /* padded but I guess this is better than trailing quiet. */ + samplesThisBlock = lsx_ms_adpcm_samples_in((size_t)0, (size_t)ft->signal.channels, bytesRead, (size_t)0); +- if (samplesThisBlock == 0) ++ if (samplesThisBlock == 0 || samplesThisBlock > wav->samplesPerBlock) + { + lsx_warn("Premature EOF on .wav input file"); + return 0; diff -Nru sox-14.4.1/debian/patches/CVE-2017-11332.patch sox-14.4.1/debian/patches/CVE-2017-11332.patch --- sox-14.4.1/debian/patches/CVE-2017-11332.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-11332.patch 2019-01-31 16:22:21.000000000 +0000 @@ -0,0 +1,23 @@ +From 7405bcaacb1ded8c595cb751d407cf738cb26571 Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Sun, 5 Nov 2017 16:29:28 +0000 +Subject: [PATCH] wav: fix crash if channel count is zero (CVE-2017-11332) + +--- + src/wav.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/src/wav.c ++++ b/src/wav.c +@@ -613,6 +613,11 @@ static int startread(sox_format_t * ft) + else + lsx_report("User options overriding channels read in .wav header"); + ++ if (ft->signal.channels == 0) { ++ lsx_fail_errno(ft, SOX_EHDR, "Channel count is zero"); ++ return SOX_EOF; ++ } ++ + if (ft->signal.rate == 0 || ft->signal.rate == dwSamplesPerSecond) + ft->signal.rate = dwSamplesPerSecond; + else diff -Nru sox-14.4.1/debian/patches/CVE-2017-11358.patch sox-14.4.1/debian/patches/CVE-2017-11358.patch --- sox-14.4.1/debian/patches/CVE-2017-11358.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-11358.patch 2019-01-31 16:22:21.000000000 +0000 @@ -0,0 +1,26 @@ +From 6cb44a44b9eda6b321ccdbf6483348d4a9798b00 Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Sun, 5 Nov 2017 16:43:35 +0000 +Subject: [PATCH] hcom: fix crash on input with corrupt dictionary + (CVE-2017-11358) + +--- + src/hcom.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/hcom.c b/src/hcom.c +index c62b020c..1b0e09dd 100644 +--- a/src/hcom.c ++++ b/src/hcom.c +@@ -150,6 +150,11 @@ static int startread(sox_format_t * ft) + lsx_debug("%d %d", + p->dictionary[i].dict_leftson, + p->dictionary[i].dict_rightson); ++ if ((unsigned) p->dictionary[i].dict_leftson >= dictsize || ++ (unsigned) p->dictionary[i].dict_rightson >= dictsize) { ++ lsx_fail_errno(ft, SOX_EHDR, "Invalid dictionary"); ++ return SOX_EOF; ++ } + } + rc = lsx_skipbytes(ft, (size_t) 1); /* skip pad byte */ + if (rc) diff -Nru sox-14.4.1/debian/patches/CVE-2017-11359.patch sox-14.4.1/debian/patches/CVE-2017-11359.patch --- sox-14.4.1/debian/patches/CVE-2017-11359.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-11359.patch 2019-01-31 16:22:21.000000000 +0000 @@ -0,0 +1,25 @@ +From 8b590b3a52f4ccc4eea3f41b4a067c38b3565b60 Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Sun, 5 Nov 2017 17:02:11 +0000 +Subject: [PATCH] wav: fix crash writing header when channel count >64k + (CVE-2017-11359) + +--- + src/wav.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/src/wav.c ++++ b/src/wav.c +@@ -1275,6 +1275,12 @@ static int wavwritehdr(sox_format_t * ft + long blocksWritten = 0; + sox_bool isExtensible = sox_false; /* WAVE_FORMAT_EXTENSIBLE? */ + ++ if (ft->signal.channels > UINT16_MAX) { ++ lsx_fail_errno(ft, SOX_EOF, "Too many channels (%u)", ++ ft->signal.channels); ++ return SOX_EOF; ++ } ++ + dwSamplesPerSecond = ft->signal.rate; + wChannels = ft->signal.channels; + wBitsPerSample = ft->encoding.bits_per_sample; diff -Nru sox-14.4.1/debian/patches/CVE-2017-15370.patch sox-14.4.1/debian/patches/CVE-2017-15370.patch --- sox-14.4.1/debian/patches/CVE-2017-15370.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-15370.patch 2019-01-31 16:22:21.000000000 +0000 @@ -0,0 +1,23 @@ +From ef3d8be0f80cbb650e4766b545d61e10d7a24c9e Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Sun, 5 Nov 2017 16:21:23 +0000 +Subject: [PATCH] wav: ima_adpcm: fix buffer overflow on corrupt input + (CVE-2017-15370) + +Add the same check bad block size as was done for MS adpcm in commit +f39c574b ("More checks for invalid MS ADPCM blocks"). +--- + src/wav.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/src/wav.c ++++ b/src/wav.c +@@ -125,7 +125,7 @@ static unsigned short ImaAdpcmReadBlock + /* work with partial blocks. Specs say it should be null */ + /* padded but I guess this is better than trailing quiet. */ + samplesThisBlock = lsx_ima_samples_in((size_t)0, (size_t)ft->signal.channels, bytesRead, (size_t) 0); +- if (samplesThisBlock == 0) ++ if (samplesThisBlock == 0 || samplesThisBlock > wav->samplesPerBlock) + { + lsx_warn("Premature EOF on .wav input file"); + return 0; diff -Nru sox-14.4.1/debian/patches/CVE-2017-15371.patch sox-14.4.1/debian/patches/CVE-2017-15371.patch --- sox-14.4.1/debian/patches/CVE-2017-15371.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-15371.patch 2019-01-31 16:22:21.000000000 +0000 @@ -0,0 +1,35 @@ +From 818bdd0ccc1e5b6cae742c740c17fd414935cf39 Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Sun, 5 Nov 2017 15:57:48 +0000 +Subject: [PATCH] flac: fix crash on corrupt metadata (CVE-2017-15371) + +--- + src/flac.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/src/flac.c ++++ b/src/flac.c +@@ -78,9 +78,10 @@ static void FLAC__decoder_metadata_callb + p->total_samples = metadata->data.stream_info.total_samples; + } + else if (metadata->type == FLAC__METADATA_TYPE_VORBIS_COMMENT) { ++ const FLAC__StreamMetadata_VorbisComment *vc = &metadata->data.vorbis_comment; + size_t i; + +- if (metadata->data.vorbis_comment.num_comments == 0) ++ if (vc->num_comments == 0) + return; + + if (ft->oob.comments != NULL) { +@@ -88,8 +89,9 @@ static void FLAC__decoder_metadata_callb + return; + } + +- for (i = 0; i < metadata->data.vorbis_comment.num_comments; ++i) +- sox_append_comment(&ft->oob.comments, (char const *) metadata->data.vorbis_comment.comments[i].entry); ++ for (i = 0; i < vc->num_comments; ++i) ++ if (vc->comments[i].entry) ++ sox_append_comment(&ft->oob.comments, (char const *) vc->comments[i].entry); + } + } + diff -Nru sox-14.4.1/debian/patches/CVE-2017-15372.patch sox-14.4.1/debian/patches/CVE-2017-15372.patch --- sox-14.4.1/debian/patches/CVE-2017-15372.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-15372.patch 2019-01-31 16:22:21.000000000 +0000 @@ -0,0 +1,91 @@ +From 3f7ed312614649e2695b54b398475d32be4f64f3 Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Wed, 8 Nov 2017 00:29:14 +0000 +Subject: adpcm: fix stack overflow with >4 channels (CVE-2017-15372) + +--- + src/adpcm.c | 8 +++++++- + src/adpcm.h | 3 +++ + src/wav.c | 5 ++++- + 3 files changed, 14 insertions(+), 2 deletions(-) + +--- a/src/adpcm.c ++++ b/src/adpcm.c +@@ -71,6 +71,11 @@ const short lsx_ms_adpcm_i_coef[7][2] = + { 392,-232} + }; + ++extern void *lsx_ms_adpcm_alloc(unsigned chans) ++{ ++ return lsx_malloc(chans * sizeof(MsState_t)); ++} ++ + static inline sox_sample_t AdpcmDecode(sox_sample_t c, MsState_t *state, + sox_sample_t sample1, sox_sample_t sample2) + { +@@ -102,6 +107,7 @@ static inline sox_sample_t AdpcmDecode(s + + /* lsx_ms_adpcm_block_expand_i() outputs interleaved samples into one output buffer */ + const char *lsx_ms_adpcm_block_expand_i( ++ void *priv, + unsigned chans, /* total channels */ + int nCoef, + const short *coef, +@@ -113,7 +119,7 @@ const char *lsx_ms_adpcm_block_expand_i( + const unsigned char *ip; + unsigned ch; + const char *errmsg = NULL; +- MsState_t state[4]; /* One decompressor state for each channel */ ++ MsState_t *state = priv; /* One decompressor state for each channel */ + + /* Read the four-byte header for each channel */ + ip = ibuff; +--- a/src/adpcm.h ++++ b/src/adpcm.h +@@ -29,8 +29,11 @@ + /* default coef sets */ + extern const short lsx_ms_adpcm_i_coef[7][2]; + ++extern void *lsx_ms_adpcm_alloc(unsigned chans); ++ + /* lsx_ms_adpcm_block_expand_i() outputs interleaved samples into one output buffer */ + extern const char *lsx_ms_adpcm_block_expand_i( ++ void *priv, + unsigned chans, /* total channels */ + int nCoef, + const short *coef, +--- a/src/wav.c ++++ b/src/wav.c +@@ -82,6 +82,7 @@ typedef struct { + /* following used by *ADPCM wav files */ + unsigned short nCoefs; /* ADPCM: number of coef sets */ + short *lsx_ms_adpcm_i_coefs; /* ADPCM: coef sets */ ++ void *ms_adpcm_data; /* Private data of adpcm decoder */ + unsigned char *packet; /* Temporary buffer for packets */ + short *samples; /* interleaved samples buffer */ + short *samplePtr; /* Pointer to current sample */ +@@ -173,7 +174,7 @@ static unsigned short AdpcmReadBlock(so + } + } + +- errmsg = lsx_ms_adpcm_block_expand_i(ft->signal.channels, wav->nCoefs, wav->lsx_ms_adpcm_i_coefs, wav->packet, wav->samples, samplesThisBlock); ++ errmsg = lsx_ms_adpcm_block_expand_i(wav->ms_adpcm_data, ft->signal.channels, wav->nCoefs, wav->lsx_ms_adpcm_i_coefs, wav->packet, wav->samples, samplesThisBlock); + + if (errmsg) + lsx_warn("%s", errmsg); +@@ -692,6 +693,7 @@ static int startread(sox_format_t * ft) + + /* nCoefs, lsx_ms_adpcm_i_coefs used by adpcm.c */ + wav->lsx_ms_adpcm_i_coefs = lsx_malloc(wav->nCoefs * 2 * sizeof(short)); ++ wav->ms_adpcm_data = lsx_ms_adpcm_alloc(wChannels); + { + int i, errct=0; + for (i=0; len>=2 && i < 2*wav->nCoefs; i++) { +@@ -1112,6 +1114,7 @@ static int stopread(sox_format_t * ft) + free(wav->packet); + free(wav->samples); + free(wav->lsx_ms_adpcm_i_coefs); ++ free(wav->ms_adpcm_data); + free(wav->comment); + wav->comment = NULL; + diff -Nru sox-14.4.1/debian/patches/CVE-2017-15642.patch sox-14.4.1/debian/patches/CVE-2017-15642.patch --- sox-14.4.1/debian/patches/CVE-2017-15642.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-15642.patch 2019-01-31 16:22:21.000000000 +0000 @@ -0,0 +1,28 @@ +Description: This fixes a use after free and double free if an empty comment +chunk follows a non-empty one. +Author: Mans Rullgard +Forwarded: not-needed +--- + src/aiff.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +Index: sox/src/aiff.c +=================================================================== +--- sox.orig/src/aiff.c ++++ sox/src/aiff.c +@@ -62,7 +62,6 @@ int lsx_aiffstartread(sox_format_t * ft) + size_t ssndsize = 0; + char *annotation; + char *author; +- char *comment = NULL; + char *copyright; + char *nametext; + +@@ -270,6 +269,7 @@ int lsx_aiffstartread(sox_format_t * ft) + free(annotation); + } + else if (strncmp(buf, "COMT", (size_t)4) == 0) { ++ char *comment = NULL; + rc = commentChunk(&comment, "Comment:", ft); + if (rc) { + /* Fail already called in function */ diff -Nru sox-14.4.1/debian/patches/CVE-2017-18189.patch sox-14.4.1/debian/patches/CVE-2017-18189.patch --- sox-14.4.1/debian/patches/CVE-2017-18189.patch 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/CVE-2017-18189.patch 2019-01-31 16:22:21.000000000 +0000 @@ -0,0 +1,30 @@ +Description: A corrupt header specifying zero channels would send read_channels() +into an infinite loop. Prevent this by sanity checking the channel +count in open_read(). Also add an upper bound to prevent overflow +in multiplication. +https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881121 +Author: Mans Rullgard + Jaromír Mikeš +Forwarded: not-needed + +--- + src/xa.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +Index: sox/src/xa.c +=================================================================== +--- sox.orig/src/xa.c ++++ sox/src/xa.c +@@ -143,6 +143,12 @@ static int startread(sox_format_t * ft) + lsx_report("User options overriding rate read in .xa header"); + } + ++ if (ft->signal.channels == 0 || ft->signal.channels > UINT16_MAX) { ++ lsx_fail_errno(ft, SOX_EFMT, "invalid channel count %d", ++ ft->signal.channels); ++ return SOX_EOF; ++ } ++ + /* Check for supported formats */ + if (ft->encoding.bits_per_sample != 16) { + lsx_fail_errno(ft, SOX_EFMT, "%d-bit sample resolution not supported.", diff -Nru sox-14.4.1/debian/patches/series sox-14.4.1/debian/patches/series --- sox-14.4.1/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ sox-14.4.1/debian/patches/series 2019-01-31 16:22:21.000000000 +0000 @@ -0,0 +1,10 @@ +0001-Check-for-minimum-size-sphere-headers.patch +0002-More-checks-for-invalid-MS-ADPCM-blocks.patch +CVE-2017-11332.patch +CVE-2017-11358.patch +CVE-2017-11359.patch +CVE-2017-15370.patch +CVE-2017-15371.patch +CVE-2017-15372.patch +CVE-2017-15642.patch +CVE-2017-18189.patch