bf29e3620d
Heap-based buffer overflow in the cddb_read_disc_data function in cddb.c in libcdaudio 0.99.12p2 allows remote attackers to execute arbitrary code via long CDDB data. Buffer overflow in discdb.c for grip 3.1.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the cddb lookup to return more matches than expected. PR: 129050 Submitted by: Eygene Ryabinkin <rea-fbsd@codelabs.ru> Approved by: novel@ (maintainer) Security: http://www.vuxml.org/freebsd/bd730827-dfe0-11dd-a765-0030843d3802.html
45 lines
1.5 KiB
Text
45 lines
1.5 KiB
Text
--- src/cddb.c.orig 2004-09-09 05:26:39.000000000 +0400
|
|
+++ src/cddb.c 2008-11-21 17:33:50.000000000 +0300
|
|
@@ -1052,7 +1052,8 @@
|
|
}
|
|
|
|
query->query_matches = 0;
|
|
- while(!cddb_read_line(sock, inbuffer, 256)) {
|
|
+ while(query->query_matches < MAX_INEXACT_MATCHES &&
|
|
+ !cddb_read_line(sock, inbuffer, 256)) {
|
|
slashed = 0;
|
|
if(strchr(inbuffer, '/') != NULL && parse_disc_artist) {
|
|
index = 0;
|
|
@@ -1601,7 +1602,7 @@
|
|
return -1;
|
|
}
|
|
|
|
- if((inbuffer = malloc(256)) == NULL) {
|
|
+ if((inbuffer = malloc(512)) == NULL) {
|
|
free(root_dir);
|
|
free(file);
|
|
return -1;
|
|
--- src/coverart.c.orig 2008-11-21 17:36:39.000000000 +0300
|
|
+++ src/coverart.c 2008-11-21 17:39:41.000000000 +0300
|
|
@@ -131,7 +131,9 @@
|
|
}
|
|
} else if(strncmp(line, "Album", 5) == 0) {
|
|
long n = strtol((char *)line + 5, NULL, 10);
|
|
- if(parse_disc_artist && strchr(procbuffer, '/') != NULL) {
|
|
+ if(n >= MAX_INEXACT_MATCHES) {
|
|
+ // Too much data, can't store it
|
|
+ } else if(parse_disc_artist && strchr(procbuffer, '/') != NULL) {
|
|
strtok(procbuffer, "/");
|
|
strncpy(query->query_list[n].list_artist, procbuffer,
|
|
(strlen(procbuffer) < 64) ? (strlen(procbuffer) - 1) : 64);
|
|
@@ -143,7 +145,9 @@
|
|
}
|
|
} else if(strncmp(line, "Url", 3) == 0) {
|
|
long n = strtol((char *)line + 3, NULL, 10);
|
|
- cddb_process_url(&query->query_list[n].list_host, procbuffer);
|
|
+ if (n < MAX_INEXACT_MATCHES) {
|
|
+ cddb_process_url(&query->query_list[n].list_host, procbuffer);
|
|
+ }
|
|
}
|
|
|
|
return;
|