pkgsrc/audio/libvorbis/patches/patch-aa
drochner ef8ece7326 pull some patches from upstream CVS to fix integer overflows /
buffer overflows (CVE-2008-1419, CVE-2008-1420, CVE-2008-1423),
bump PKGREVISION
2008-05-14 16:36:18 +00:00

34 lines
1 KiB
Text

$NetBSD: patch-aa,v 1.3 2008/05/14 16:36:18 drochner Exp $
--- ./lib/res0.c.orig 2007-07-24 02:09:47.000000000 +0200
+++ ./lib/res0.c
@@ -223,6 +223,20 @@ vorbis_info_residue *res0_unpack(vorbis_
for(j=0;j<acc;j++)
if(info->booklist[j]>=ci->books)goto errout;
+ /* verify the phrasebook is not specifying an impossible or
+ inconsistent partitioning scheme. */
+ {
+ int entries = ci->book_param[info->groupbook]->entries;
+ int dim = ci->book_param[info->groupbook]->dim;
+ int partvals = 1;
+ while(dim>0){
+ partvals *= info->partitions;
+ if(partvals > entries) goto errout;
+ dim--;
+ }
+ if(partvals != entries) goto errout;
+ }
+
return(info);
errout:
res0_free_info(info);
@@ -263,7 +277,7 @@ vorbis_look_residue *res0_look(vorbis_ds
}
}
- look->partvals=rint(pow((float)look->parts,(float)dim));
+ look->partvals=look->phrasebook->entries;
look->stages=maxstage;
look->decodemap=_ogg_malloc(look->partvals*sizeof(*look->decodemap));
for(j=0;j<look->partvals;j++){