1From 0a4cd796df5b030cb866f3f4a5e41a4b92caddf5 Mon Sep 17 00:00:00 2001
2From: Ralph Giles <giles@thaumas.net>
3Date: Tue, 6 Sep 2022 19:04:31 -0700
4Subject: [PATCH] Propagate allocation failure from ogg_sync_buffer.
5
6Instead of segfault, report OP_EFAULT if ogg_sync_buffer returns
7a null pointer. This allows more graceful recovery by the caller
8in the unlikely event of a fallible ogg_malloc call.
9
10We do check the return value elsewhere in the code, so the new
11checks make the code more consistent.
12
13Thanks to https://github.com/xiph/opusfile/issues/36 for reporting.
14
15Signed-off-by: Timothy B. Terriberry <tterribe@xiph.org>
16Signed-off-by: Mark Harris <mark.hsj@gmail.com>
17
18CVE: CVE-2022-47021
19Upstream-Status: Backport [https://github.com/xiph/opusfile/commit/0a4cd796df5b030cb866f3f4a5e41a4b92caddf5]
20Signed-off-by: Peter Marko <peter.marko@siemens.com>
21---
22 src/opusfile.c | 2 ++
23 1 file changed, 2 insertions(+)
24
25diff --git a/src/opusfile.c b/src/opusfile.c
26index ca219b2..3c3c81e 100644
27--- a/src/opusfile.c
28+++ b/src/opusfile.c
29@@ -148,6 +148,7 @@ static int op_get_data(OggOpusFile *_of,int _nbytes){
30   int            nbytes;
31   OP_ASSERT(_nbytes>0);
32   buffer=(unsigned char *)ogg_sync_buffer(&_of->oy,_nbytes);
33+  if(OP_UNLIKELY(buffer==NULL))return OP_EFAULT;
34   nbytes=(int)(*_of->callbacks.read)(_of->stream,buffer,_nbytes);
35   OP_ASSERT(nbytes<=_nbytes);
36   if(OP_LIKELY(nbytes>0))ogg_sync_wrote(&_of->oy,nbytes);
37@@ -1527,6 +1528,7 @@ static int op_open1(OggOpusFile *_of,
38   if(_initial_bytes>0){
39     char *buffer;
40     buffer=ogg_sync_buffer(&_of->oy,(long)_initial_bytes);
41+    if(OP_UNLIKELY(buffer==NULL))return OP_EFAULT;
42     memcpy(buffer,_initial_data,_initial_bytes*sizeof(*buffer));
43     ogg_sync_wrote(&_of->oy,(long)_initial_bytes);
44   }
45