Update libvorbis from 1.3.5 to 1.3.6

* Fix CVE-2018-5146 - out-of-bounds write on codebook decoding.
* Fix CVE-2017-14632 - free() on unitialized data
* Fix CVE-2017-14633 - out-of-bounds read
This commit is contained in:
Zack Middleton 2018-03-16 12:30:08 -05:00
parent ebd3d516ac
commit b78c6e61bf
67 changed files with 46 additions and 125 deletions

View file

@ -11,7 +11,6 @@
********************************************************************
function: libvorbis codec headers
last mod: $Id: codec.h 17021 2010-03-24 09:29:41Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: vorbis encode-engine setup
last mod: $Id: vorbisenc.h 17021 2010-03-24 09:29:41Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: stdio-based convenience library for opening/seeking/decoding
last mod: $Id: vorbisfile.h 17182 2010-04-29 03:48:32Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: single-block PCM analysis mode dispatch
last mod: $Id: analysis.c 16226 2009-07-08 06:43:49Z xiphmont $
********************************************************************/

View file

@ -12,7 +12,6 @@
function: libvorbis backend and mapping structures; needed for
static mode headers
last mod: $Id: backends.h 16962 2010-03-11 07:30:34Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: bitrate tracking and management
last mod: $Id: bitrate.c 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: bitrate tracking and management
last mod: $Id: bitrate.h 13293 2007-07-24 00:09:47Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: PCM data vector blocking, windowing and dis/reassembly
last mod: $Id: block.c 19457 2015-03-03 00:15:29Z giles $
Handle windowing, overlap-add, etc of the PCM vectors. This is made
more amusing by Vorbis' current two allowed block sizes.

View file

@ -11,7 +11,6 @@
********************************************************************
*
* function: static codebooks for 5.1 surround
* last modified: $Id: res_books_51.h 19057 2014-01-22 12:32:31Z xiphmont $
*
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: static codebooks autogenerated by huff/huffbuld
last modified: $Id: res_books_stereo.h 19057 2014-01-22 12:32:31Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: static codebooks autogenerated by huff/huffbuld
last modified: $Id: floor_books.h 19057 2014-01-22 12:32:31Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: static codebooks autogenerated by huff/huffbuld
last modified: $Id: res_books_uncoupled.h 19057 2014-01-22 12:32:31Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: basic codebook pack/unpack/code/decode operations
last mod: $Id: codebook.c 19457 2015-03-03 00:15:29Z giles $
********************************************************************/
@ -387,7 +386,7 @@ long vorbis_book_decodevs_add(codebook *book,float *a,oggpack_buffer *b,int n){
t[i] = book->valuelist+entry[i]*book->dim;
}
for(i=0,o=0;i<book->dim;i++,o+=step)
for (j=0;j<step;j++)
for (j=0;o+j<n && j<step;j++)
a[o+j]+=t[j][i];
}
return(0);
@ -399,41 +398,12 @@ long vorbis_book_decodev_add(codebook *book,float *a,oggpack_buffer *b,int n){
int i,j,entry;
float *t;
if(book->dim>8){
for(i=0;i<n;){
entry = decode_packed_entry_number(book,b);
if(entry==-1)return(-1);
t = book->valuelist+entry*book->dim;
for (j=0;j<book->dim;)
a[i++]+=t[j++];
}
}else{
for(i=0;i<n;){
entry = decode_packed_entry_number(book,b);
if(entry==-1)return(-1);
t = book->valuelist+entry*book->dim;
j=0;
switch((int)book->dim){
case 8:
a[i++]+=t[j++];
case 7:
a[i++]+=t[j++];
case 6:
a[i++]+=t[j++];
case 5:
a[i++]+=t[j++];
case 4:
a[i++]+=t[j++];
case 3:
a[i++]+=t[j++];
case 2:
a[i++]+=t[j++];
case 1:
a[i++]+=t[j++];
case 0:
break;
}
}
for(i=0;i<n;){
entry = decode_packed_entry_number(book,b);
if(entry==-1)return(-1);
t = book->valuelist+entry*book->dim;
for(j=0;i<n && j<book->dim;)
a[i++]+=t[j++];
}
}
return(0);
@ -471,12 +441,13 @@ long vorbis_book_decodevv_add(codebook *book,float **a,long offset,int ch,
long i,j,entry;
int chptr=0;
if(book->used_entries>0){
for(i=offset/ch;i<(offset+n)/ch;){
int m=(offset+n)/ch;
for(i=offset/ch;i<m;){
entry = decode_packed_entry_number(book,b);
if(entry==-1)return(-1);
{
const float *t = book->valuelist+entry*book->dim;
for (j=0;j<book->dim;j++){
for (j=0;i<m && j<book->dim;j++){
a[chptr++][i]+=t[j];
if(chptr==ch){
chptr=0;

View file

@ -11,7 +11,6 @@
********************************************************************
function: basic shared codebook operations
last mod: $Id: codebook.h 19457 2015-03-03 00:15:29Z giles $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: libvorbis codec headers
last mod: $Id: codec_internal.h 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: PCM data envelope analysis
last mod: $Id: envelope.c 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: PCM data envelope analysis and manipulation
last mod: $Id: envelope.h 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: floor backend 0 implementation
last mod: $Id: floor0.c 19457 2015-03-03 00:15:29Z giles $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: floor backend 1 implementation
last mod: $Id: floor1.c 19457 2015-03-03 00:15:29Z giles $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: highlevel encoder setup struct separated out for vorbisenc clarity
last mod: $Id: highlevel.h 17195 2010-05-05 21:49:51Z giles $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: maintain the info structure, info <-> header packets
last mod: $Id: info.c 19441 2015-01-21 01:17:41Z xiphmont $
********************************************************************/
@ -31,8 +30,8 @@
#include "misc.h"
#include "os.h"
#define GENERAL_VENDOR_STRING "Xiph.Org libVorbis 1.3.5"
#define ENCODE_VENDOR_STRING "Xiph.Org libVorbis I 20150105 (⛄⛄⛄⛄)"
#define GENERAL_VENDOR_STRING "Xiph.Org libVorbis 1.3.6"
#define ENCODE_VENDOR_STRING "Xiph.Org libVorbis I 20180316 (Now 100% fewer shells)"
/* helpers */
static void _v_writestring(oggpack_buffer *o,const char *s, int bytes){
@ -65,11 +64,13 @@ void vorbis_comment_add(vorbis_comment *vc,const char *comment){
}
void vorbis_comment_add_tag(vorbis_comment *vc, const char *tag, const char *contents){
char *comment=alloca(strlen(tag)+strlen(contents)+2); /* +2 for = and \0 */
/* Length for key and value +2 for = and \0 */
char *comment=_ogg_malloc(strlen(tag)+strlen(contents)+2);
strcpy(comment, tag);
strcat(comment, "=");
strcat(comment, contents);
vorbis_comment_add(vc, comment);
_ogg_free(comment);
}
/* This is more or less the same as strncasecmp - but that doesn't exist
@ -88,27 +89,30 @@ char *vorbis_comment_query(vorbis_comment *vc, const char *tag, int count){
long i;
int found = 0;
int taglen = strlen(tag)+1; /* +1 for the = we append */
char *fulltag = alloca(taglen+ 1);
char *fulltag = _ogg_malloc(taglen+1);
strcpy(fulltag, tag);
strcat(fulltag, "=");
for(i=0;i<vc->comments;i++){
if(!tagcompare(vc->user_comments[i], fulltag, taglen)){
if(count == found)
if(count == found) {
/* We return a pointer to the data, not a copy */
return vc->user_comments[i] + taglen;
else
_ogg_free(fulltag);
return vc->user_comments[i] + taglen;
} else {
found++;
}
}
}
_ogg_free(fulltag);
return NULL; /* didn't find anything */
}
int vorbis_comment_query_count(vorbis_comment *vc, const char *tag){
int i,count=0;
int taglen = strlen(tag)+1; /* +1 for the = we append */
char *fulltag = alloca(taglen+1);
char *fulltag = _ogg_malloc(taglen+1);
strcpy(fulltag,tag);
strcat(fulltag, "=");
@ -117,6 +121,7 @@ int vorbis_comment_query_count(vorbis_comment *vc, const char *tag){
count++;
}
_ogg_free(fulltag);
return count;
}
@ -206,9 +211,9 @@ static int _vorbis_unpack_info(vorbis_info *vi,oggpack_buffer *opb){
vi->channels=oggpack_read(opb,8);
vi->rate=oggpack_read(opb,32);
vi->bitrate_upper=oggpack_read(opb,32);
vi->bitrate_nominal=oggpack_read(opb,32);
vi->bitrate_lower=oggpack_read(opb,32);
vi->bitrate_upper=(ogg_int32_t)oggpack_read(opb,32);
vi->bitrate_nominal=(ogg_int32_t)oggpack_read(opb,32);
vi->bitrate_lower=(ogg_int32_t)oggpack_read(opb,32);
ci->blocksizes[0]=1<<oggpack_read(opb,4);
ci->blocksizes[1]=1<<oggpack_read(opb,4);
@ -583,7 +588,8 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v,
oggpack_buffer opb;
private_state *b=v->backend_state;
if(!b||vi->channels<=0){
if(!b||vi->channels<=0||vi->channels>256){
b = NULL;
ret=OV_EFAULT;
goto err_out;
}
@ -642,7 +648,7 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v,
memset(op_code,0,sizeof(*op_code));
if(b){
oggpack_writeclear(&opb);
if(vi->channels>0)oggpack_writeclear(&opb);
if(b->header)_ogg_free(b->header);
if(b->header1)_ogg_free(b->header1);
if(b->header2)_ogg_free(b->header2);

View file

@ -11,7 +11,6 @@
********************************************************************
function: lookup based functions
last mod: $Id: lookup.c 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: lookup based functions
last mod: $Id: lookup.h 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: lookup data; generated by lookups.pl; edit there
last mod: $Id: lookup_data.h 16037 2009-05-26 21:10:58Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: LPC low level routines
last mod: $Id: lpc.c 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: LPC low level routines
last mod: $Id: lpc.h 16037 2009-05-26 21:10:58Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: LSP (also called LSF) conversion routines
last mod: $Id: lsp.c 19453 2015-03-02 22:35:34Z xiphmont $
The LSP generation code is taken (with minimal modification and a
few bugfixes) from "On the Computation of the LSP Frequencies" by

View file

@ -11,7 +11,6 @@
********************************************************************
function: LSP (also called LSF) conversion routines
last mod: $Id: lsp.h 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: channel mapping 0 implementation
last mod: $Id: mapping0.c 19441 2015-01-21 01:17:41Z xiphmont $
********************************************************************/
@ -93,7 +92,6 @@ static vorbis_info_mapping *mapping0_unpack(vorbis_info *vi,oggpack_buffer *opb)
int i,b;
vorbis_info_mapping0 *info=_ogg_calloc(1,sizeof(*info));
codec_setup_info *ci=vi->codec_setup;
memset(info,0,sizeof(*info));
if(vi->channels<=0)goto err_out;
b=oggpack_read(opb,1);

View file

@ -11,7 +11,6 @@
********************************************************************
function: masking curve data for psychoacoustics
last mod: $Id: masking.h 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -12,7 +12,6 @@
function: normalized modified discrete cosine transform
power of two length transform only [64 <= n ]
last mod: $Id: mdct.c 16227 2009-07-08 06:58:46Z xiphmont $
Original algorithm adapted long ago from _The use of multirate filter
banks for coding of high quality digital audio_, by T. Sporer,

View file

@ -11,7 +11,6 @@
********************************************************************
function: modified discrete cosine transform prototypes
last mod: $Id: mdct.h 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: miscellaneous prototypes
last mod: $Id: misc.h 19457 2015-03-03 00:15:29Z giles $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: key floor settings
last mod: $Id: floor_all.h 17050 2010-03-26 01:34:42Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: 11kHz settings
last mod: $Id: psych_11.h 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: 16kHz settings
last mod: $Id: psych_16.h 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: key psychoacoustic settings for 44.1/48kHz
last mod: $Id: psych_44.h 16962 2010-03-11 07:30:34Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: 8kHz psychoacoustic settings
last mod: $Id: psych_8.h 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: toplevel residue templates 16/22kHz
last mod: $Id: residue_16.h 16962 2010-03-11 07:30:34Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: toplevel residue templates for 32/44.1/48kHz
last mod: $Id: residue_44.h 16962 2010-03-11 07:30:34Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: toplevel residue templates for 32/44.1/48kHz uncoupled
last mod: $Id: residue_44p51.h 19013 2013-11-12 04:04:50Z giles $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: toplevel residue templates for 32/44.1/48kHz uncoupled
last mod: $Id: residue_44u.h 16962 2010-03-11 07:30:34Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: toplevel residue templates 8/11kHz
last mod: $Id: residue_8.h 16962 2010-03-11 07:30:34Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: 11kHz settings
last mod: $Id: setup_11.h 16894 2010-02-12 20:32:12Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: 16kHz settings
last mod: $Id: setup_16.h 16894 2010-02-12 20:32:12Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: 22kHz settings
last mod: $Id: setup_22.h 17026 2010-03-25 05:00:27Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: toplevel settings for 32kHz
last mod: $Id: setup_32.h 16894 2010-02-12 20:32:12Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: toplevel settings for 44.1/48kHz
last mod: $Id: setup_44.h 16962 2010-03-11 07:30:34Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: toplevel settings for 44.1/48kHz 5.1 surround modes
last mod: $Id: setup_44p51.h 19013 2013-11-12 04:04:50Z giles $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: toplevel settings for 44.1/48kHz uncoupled modes
last mod: $Id: setup_44u.h 16962 2010-03-11 07:30:34Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: 8kHz settings
last mod: $Id: setup_8.h 16894 2010-02-12 20:32:12Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: catch-all toplevel settings for q modes only
last mod: $Id: setup_X.h 16894 2010-02-12 20:32:12Z xiphmont $
********************************************************************/

View file

@ -13,7 +13,6 @@
********************************************************************
function: #ifdef jail to whip a few platforms into the UNIX ideal.
last mod: $Id: os.h 19457 2015-03-03 00:15:29Z giles $
********************************************************************/
@ -31,7 +30,7 @@
# ifdef __GNUC__
# define STIN static __inline__
# elif _WIN32
# elif defined(_WIN32)
# define STIN static __inline
# else
# define STIN static

View file

@ -11,7 +11,6 @@
********************************************************************
function: psychoacoustics not including preecho
last mod: $Id: psy.c 18077 2011-09-02 02:49:00Z giles $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: random psychoacoustics (not including preecho)
last mod: $Id: psy.h 16946 2010-03-03 16:12:40Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: registry for time, floor, res backends and channel mappings
last mod: $Id: registry.c 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: registry for time, floor, res backends and channel mappings
last mod: $Id: registry.h 15531 2008-11-24 23:50:06Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: residue backend 0, 1 and 2 implementation
last mod: $Id: res0.c 19441 2015-01-21 01:17:41Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: linear scale -> dB, Bark and Mel scales
last mod: $Id: scales.h 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,11 +11,11 @@
********************************************************************
function: basic shared codebook operations
last mod: $Id: sharedbook.c 19457 2015-03-03 00:15:29Z giles $
********************************************************************/
#include <stdlib.h>
#include <limits.h>
#include <math.h>
#include <string.h>
#include <ogg/ogg.h>
@ -158,25 +158,34 @@ ogg_uint32_t *_make_words(char *l,long n,long sparsecount){
that's portable and totally safe against roundoff, but I haven't
thought of it. Therefore, we opt on the side of caution */
long _book_maptype1_quantvals(const static_codebook *b){
long vals=floor(pow((float)b->entries,1.f/b->dim));
long vals;
if(b->entries<1){
return(0);
}
vals=floor(pow((float)b->entries,1.f/b->dim));
/* the above *should* be reliable, but we'll not assume that FP is
ever reliable when bitstream sync is at stake; verify via integer
means that vals really is the greatest value of dim for which
vals^b->bim <= b->entries */
/* treat the above as an initial guess */
if(vals<1){
vals=1;
}
while(1){
long acc=1;
long acc1=1;
int i;
for(i=0;i<b->dim;i++){
if(b->entries/vals<acc)break;
acc*=vals;
acc1*=vals+1;
if(LONG_MAX/(vals+1)<acc1)acc1=LONG_MAX;
else acc1*=vals+1;
}
if(acc<=b->entries && acc1>b->entries){
if(i>=b->dim && acc<=b->entries && acc1>b->entries){
return(vals);
}else{
if(acc>b->entries){
if(i<b->dim || acc>b->entries){
vals--;
}else{
vals++;

View file

@ -11,7 +11,6 @@
********************************************************************
function: *unnormalized* fft transform
last mod: $Id: smallft.c 16227 2009-07-08 06:58:46Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: fft transform
last mod: $Id: smallft.h 13293 2007-07-24 00:09:47Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: single-block PCM synthesis
last mod: $Id: synthesis.c 19441 2015-01-21 01:17:41Z xiphmont $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: simple programmatic interface for encoder mode setup
last mod: $Id: vorbisenc.c 19457 2015-03-03 00:15:29Z giles $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: stdio-based convenience library for opening/seeking/decoding
last mod: $Id: vorbisfile.c 19457 2015-03-03 00:15:29Z giles $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: window functions
last mod: $Id: window.c 19028 2013-12-02 23:23:39Z tterribe $
********************************************************************/

View file

@ -11,7 +11,6 @@
********************************************************************
function: window functions
last mod: $Id: window.h 19028 2013-12-02 23:23:39Z tterribe $
********************************************************************/