shithub: sox

Info  •  Files  •  Log  •  Branches

adpcm: fix stack overflow with >4 channels (CVE-2017-15372)

--- a/src/adpcm.c

+++ b/src/adpcm.c

@@ -71,6 +71,11 @@

                         { 392,-232}

 };

+extern void *lsx_ms_adpcm_alloc(unsigned chans)

+{

+        return lsx_malloc(chans * sizeof(MsState_t));

+}

+

 static inline sox_sample_t AdpcmDecode(sox_sample_t c, MsState_t *state,

                                sox_sample_t sample1, sox_sample_t sample2)

 {

@@ -102,6 +107,7 @@

 /* lsx_ms_adpcm_block_expand_i() outputs interleaved samples into one output buffer */

 const char *lsx_ms_adpcm_block_expand_i(

+        void *priv,

         unsigned chans,          /* total channels             */

         int nCoef,

         const short *coef,

@@ -113,7 +119,7 @@

   const unsigned char *ip;

   unsigned ch;

   const char *errmsg = NULL;

-  MsState_t state[4];  /* One decompressor state for each channel */

+  MsState_t *state = priv;  /* One decompressor state for each channel */

   /* Read the four-byte header for each channel */

   ip = ibuff;

--- a/src/adpcm.h

+++ b/src/adpcm.h

@@ -29,8 +29,11 @@

 /* default coef sets */

 extern const short lsx_ms_adpcm_i_coef[7][2];

+extern void *lsx_ms_adpcm_alloc(unsigned chans);

+

 /* lsx_ms_adpcm_block_expand_i() outputs interleaved samples into one output buffer */

 extern const char *lsx_ms_adpcm_block_expand_i(

+	void *priv,

 	unsigned chans,          /* total channels             */

 	int nCoef,

 	const short *coef,

--- a/src/wav.c

+++ b/src/wav.c

@@ -82,6 +82,7 @@

     /* following used by *ADPCM wav files */

     unsigned short nCoefs;          /* ADPCM: number of coef sets */

     short         *lsx_ms_adpcm_i_coefs;          /* ADPCM: coef sets           */

+    void          *ms_adpcm_data;   /* Private data of adpcm decoder */

     unsigned char *packet;          /* Temporary buffer for packets */

     short         *samples;         /* interleaved samples buffer */

     short         *samplePtr;       /* Pointer to current sample  */

@@ -175,7 +176,7 @@

         }

     }

-    errmsg = lsx_ms_adpcm_block_expand_i(ft->signal.channels, wav->nCoefs, wav->lsx_ms_adpcm_i_coefs, wav->packet, wav->samples, samplesThisBlock);

+    errmsg = lsx_ms_adpcm_block_expand_i(wav->ms_adpcm_data, ft->signal.channels, wav->nCoefs, wav->lsx_ms_adpcm_i_coefs, wav->packet, wav->samples, samplesThisBlock);

     if (errmsg)

         lsx_warn("%s", errmsg);

@@ -791,6 +792,7 @@

         /* nCoefs, lsx_ms_adpcm_i_coefs used by adpcm.c */

         wav->lsx_ms_adpcm_i_coefs = lsx_malloc(wav->nCoefs * 2 * sizeof(short));

+        wav->ms_adpcm_data = lsx_ms_adpcm_alloc(wChannels);

         {

             int i, errct=0;

             for (i=0; len>=2 && i < 2*wav->nCoefs; i++) {

@@ -1216,6 +1218,7 @@

     free(wav->packet);

     free(wav->samples);

     free(wav->lsx_ms_adpcm_i_coefs);

+    free(wav->ms_adpcm_data);

     free(wav->comment);

     wav->comment = NULL;