File libsndfile-CVE-2021-4156.patch of Package libsndfile.22298
From 4c30646abf7834e406f7e2429c70bc254e18beab Mon Sep 17 00:00:00 2001
From: yuawn <ssspeed00@gmail.com>
Date: Wed, 14 Apr 2021 08:38:23 +0000
Subject: [PATCH] flac: Fix improper buffer reusing
---
src/flac.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/flac.c b/src/flac.c
index 64d0172e6..800d81078 100644
--- a/src/flac.c
+++ b/src/flac.c
@@ -62,6 +62,7 @@ typedef struct
FLAC__StreamMetadata *metadata ;
const int32_t * const * wbuffer ;
+ unsigned wbuffer_size ;
int32_t * rbuffer [FLAC__MAX_CHANNELS] ;
int32_t* encbuffer ;
@@ -188,6 +189,12 @@ flac_buffer_copy (SF_PRIVATE *psf)
return 0 ;
} ;
+ if (frame->header.blocksize > pflac->wbuffer_size)
+ { psf_log_printf (psf, "Ooops : frame->header.blocksize (%d) > pflac->wbuffer_size (%d)\n", __func__, __LINE__, frame->header.blocksize, pflac->wbuffer_size) ;
+ psf->error = SFE_INTERNAL ;
+ return 0 ;
+ } ;
+
if (frame->header.channels > FLAC__MAX_CHANNELS)
psf_log_printf (psf, "Ooops : frame->header.channels (%d) > FLAC__MAX_BLOCK_SIZE (%d)\n", __func__, __LINE__, frame->header.channels, FLAC__MAX_CHANNELS) ;
@@ -393,6 +400,7 @@ sf_flac_write_callback (const FLAC__StreamDecoder * UNUSED (decoder), const FLAC
pflac->bufferpos = 0 ;
pflac->wbuffer = buffer ;
+ pflac->wbuffer_size = pflac->frame->header.blocksize ;
flac_buffer_copy (psf) ;