1From 25eb00ce913452c2e614548d7df93070bf0d066f Mon Sep 17 00:00:00 2001
2From: Antonio Larrosa <larrosa@kde.org>
3Date: Mon, 6 Mar 2017 18:02:31 +0100
4Subject: [PATCH] clamp index values to fix index overflow in IMA.cpp
5
6This fixes #33
7(also reported at https://bugzilla.opensuse.org/show_bug.cgi?id=1026981
8and https://blogs.gentoo.org/ago/2017/02/20/audiofile-global-buffer-overflow-in-decodesample-ima-cpp/)
9
10Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
11
12CVE: CVE-2017-6829
13Upstream-Status: Inactive-Upstream [lastrelease: 2013]
14Signed-off-by: Peter Marko <peter.marko@siemens.com>
15---
16 libaudiofile/modules/IMA.cpp | 4 ++--
17 1 file changed, 2 insertions(+), 2 deletions(-)
18
19diff --git a/libaudiofile/modules/IMA.cpp b/libaudiofile/modules/IMA.cpp
20index 7476d44..df4aad6 100644
21--- a/libaudiofile/modules/IMA.cpp
22+++ b/libaudiofile/modules/IMA.cpp
23@@ -169,7 +169,7 @@ int IMA::decodeBlockWAVE(const uint8_t *encoded, int16_t *decoded)
24 		if (encoded[1] & 0x80)
25 			m_adpcmState[c].previousValue -= 0x10000;
26
27-		m_adpcmState[c].index = encoded[2];
28+		m_adpcmState[c].index = clamp(encoded[2], 0, 88);
29
30 		*decoded++ = m_adpcmState[c].previousValue;
31
32@@ -210,7 +210,7 @@ int IMA::decodeBlockQT(const uint8_t *encoded, int16_t *decoded)
33 			predictor -= 0x10000;
34
35 		state.previousValue = clamp(predictor, MIN_INT16, MAX_INT16);
36-		state.index = encoded[1] & 0x7f;
37+		state.index = clamp(encoded[1] & 0x7f, 0, 88);
38 		encoded += 2;
39
40 		for (int n=0; n<m_framesPerPacket; n+=2)
41--
422.11.0
43
44