[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 06 Feb 2023 21:25:28 +0100
From: Steffen Nurpmeso <steffen@...oden.eu>
To: Helmut Grohne <helmut@...divi.de>
Cc: oss-security@...ts.openwall.com
Subject: Re: sox: patches for old vulnerabilities
Hello Helmut.
Helmut Grohne wrote in
<Y9+dfm0bly+DJSJN@....mars>:
|On Sat, Feb 04, 2023 at 12:19:14AM +0100, Steffen Nurpmeso wrote:
|> But i was only wondering a bit, have you checked against the
|> [master] branch? For example
|
|I did a (too) rough survey of the upstream repository and (too quickly)
|concluded that it wouldn't help me with fixing these in Debian, so I
|worked from Debian's fork. I should have made this more clear.
|
|> 02-fix-resource-leak-hcom.patch
|
|Still needed in git.
|
|> 03-fix-regression-in-CVE-2017-11358.patch
|
|I'll be replacing the Debian-specific, broken fix of CVE-2017-11358 with
|the one committed upstream. Thanks.
|
|> 04-fix-hcom-big-endian.patch#
|
|Indeed, I should have revisited the upstream tree. Upstream also fixes a
|double free and I'll be replacing my patch with the upstream one.
|
|> 06-CVE-2021-33844.patch
|
|The code is refactored, but I think the issue persists in wav_read_fmt
|where wav->bitsPerSample isn't checked.
|
|> and
|> 07-CVE-2021-3643.patch
|
|The hunk context changed and channels are now verified, but the size
|validation is still missing. During further analysis I also found that
|my patch is insufficient still.
|
|If uc becomes 1, we assign it to v->size, later we pass 6 - v->size as
|the second parameter to lsx_adpcm_init, which is used as an index into a
|static array of 5 elements. We thus have an out-of-bounds read access
|here. I don't yet know where exactly the check belongs as v->size == 1
|may be valid in some contexts still.
|
|Updated patch attached.
...
|> (I an maintaining an official contrib now private sox port for
|> CRUX Linux based upon 42b3557e13e0fe0 as of 20211029.)
|
|I think it would be good to have a maintained upstream repository of sox
|eventually. It seems like multiple distributions are maintaining
|diverging patch piles now.
Would be very nice, i use it almost daily for over twenty years.
(But .. mostly for playing sounds, i am not a sophisticated sound
engineer etc etc.)
Wonderful, thank you very much for the additional work, i first
thought hcom would now miss the INT32 max check, but that was also
upstream. (Thanks, i really have _zero_ idea of the code.)
I hope it is ok, i still port [master], but now with the
additional patch as attached, that has your name on it.
Ciao!
--steffen
|
|Der Kragenbaer, The moon bear,
|der holt sich munter he cheerfully and one by one
|einen nach dem anderen runter wa.ks himself off
|(By Robert Gernhardt)
View attachment "grohne-sox.patch" of type "text/x-diff" (6620 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
