Skip to content

stb_vorbis CVE fixes #578

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Dec 11, 2023
Merged

stb_vorbis CVE fixes #578

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
301cde7
stb_vorbis: fix CVE-2023-45676 and CVE-2023-45677.
sezero Dec 11, 2023
2e91c9d
stb_vorbis: fix CVE-2023-45679 and CVE-2023-45680.
sezero Dec 11, 2023
2dde769
stb_vorbis: fix CVE-2023-45681 (integer overflow.)
sezero Dec 11, 2023
3b14cdd
stb_vorbis: fix CVE-2023-45682
sezero Dec 11, 2023
550f521
music_ogg_stb.c: error-out early if the vorbis file has no samples
sezero Dec 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion src/codecs/music_ogg_stb.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,6 +198,14 @@ static void *OGG_CreateFromRW(SDL_RWops *src, int freesrc)
}

rate = music->vi.sample_rate;

music->full_length = stb_vorbis_stream_length_in_samples(music->vf);
if (music->full_length <= 0) {
Mix_SetError("No samples in ogg/vorbis stream.");
OGG_Delete(music);
return NULL;
}

vc = stb_vorbis_get_comment(music->vf);
if (vc.comment_list != NULL) {
for (i = 0; i < vc.comment_list_length; i++) {
Expand Down Expand Up @@ -250,7 +258,6 @@ static void *OGG_CreateFromRW(SDL_RWops *src, int freesrc)
}
}

music->full_length = stb_vorbis_stream_length_in_samples(music->vf);
if ((music->loop_end > 0) && (music->loop_end <= music->full_length) &&
(music->loop_start < music->loop_end)) {
music->loop = 1;
Expand Down
15 changes: 12 additions & 3 deletions src/codecs/stb_vorbis/stb_vorbis.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -986,6 +986,7 @@ static void *make_block_array(void *mem, int count, int size)

static void *setup_malloc(vorb *f, int sz)
{
if (sz < 0 || INT_MAX - 7 < sz) return NULL;
sz = (sz+7) & ~7; // round up to nearest 8 for alignment of future allocs.
f->setup_memory_required += sz;
if (f->alloc.alloc_buffer) {
Expand Down Expand Up @@ -1839,7 +1840,7 @@ static int codebook_decode_scalar(vorb *f, Codebook *c)

#define DECODE(var,f,c) \
DECODE_RAW(var,f,c) \
if (c->sparse) var = c->sorted_values[var];
if (c->sparse && var >= 0) var = c->sorted_values[var];

#ifndef STB_VORBIS_DIVIDES_IN_CODEBOOK
#define DECODE_VQ(var,f,c) DECODE_RAW(var,f,c)
Expand Down Expand Up @@ -3749,8 +3750,16 @@ static int start_decoder(vorb *f)
f->comment_list = NULL;
if (f->comment_list_length > 0)
{
f->comment_list = (char**) setup_malloc(f, sizeof(char*) * (f->comment_list_length));
if (f->comment_list == NULL) return error(f, VORBIS_outofmem);
if (INT_MAX / sizeof(char*) < f->comment_list_length)
goto no_comment;
len = sizeof(char*) * f->comment_list_length;
f->comment_list = (char**) setup_malloc(f, len);
if (f->comment_list == NULL) {
no_comment:
f->comment_list_length = 0;
return error(f, VORBIS_outofmem);
}
memset(f->comment_list, 0, len);
}

for(i=0; i < f->comment_list_length; ++i) {
Expand Down