aboutsummaryrefslogtreecommitdiffstats
path: root/main/libao/CVE-2017-11548.patch
diff options
context:
space:
mode:
Diffstat (limited to 'main/libao/CVE-2017-11548.patch')
-rw-r--r--main/libao/CVE-2017-11548.patch177
1 files changed, 177 insertions, 0 deletions
diff --git a/main/libao/CVE-2017-11548.patch b/main/libao/CVE-2017-11548.patch
new file mode 100644
index 0000000000..6f2aa7a143
--- /dev/null
+++ b/main/libao/CVE-2017-11548.patch
@@ -0,0 +1,177 @@
+diff --git a/src/audio_out.c b/src/audio_out.c
+index bd8f6fc..f5942d6 100644
+--- a/src/audio_out.c
++++ b/src/audio_out.c
+@@ -634,6 +634,10 @@ static char *_sanitize_matrix(int maxchannels, char *matrix, ao_device *device){
+ char *ret = calloc(strlen(matrix)+1,1); /* can only get smaller */
+ char *p=matrix;
+ int count=0;
++
++ if(!ret)
++ return NULL;
++
+ while(count<maxchannels){
+ char *h,*t;
+ int m=0;
+@@ -706,6 +710,15 @@ static int _find_channel(int needle, char *haystack){
+ return -1;
+ }
+
++static void _free_map(char **m){
++ char **in=m;
++ while(m && *m){
++ free(*m);
++ m++;
++ }
++ if(in)free(in);
++}
++
+ static char **_tokenize_matrix(char *matrix){
+ char **ret=NULL;
+ char *p=matrix;
+@@ -730,6 +743,8 @@ static char **_tokenize_matrix(char *matrix){
+ }
+
+ ret = calloc(count+1,sizeof(*ret));
++ if(!ret)
++ return NULL;
+
+ p=matrix;
+ count=0;
+@@ -748,6 +763,10 @@ static char **_tokenize_matrix(char *matrix){
+ while(t>p && isspace(*(t-1)))t--;
+
+ ret[count] = calloc(t-p+1,1);
++ if(!ret[count]){
++ _free_map(ret);
++ return NULL;
++ }
+ memcpy(ret[count],p,t-p);
+ count++;
+ if(!*h)break;
+@@ -755,16 +774,6 @@ static char **_tokenize_matrix(char *matrix){
+ }
+
+ return ret;
+-
+-}
+-
+-static void _free_map(char **m){
+- char **in=m;
+- while(m && *m){
+- free(*m);
+- m++;
+- }
+- if(in)free(in);
+ }
+
+ static unsigned int _matrix_to_channelmask(int ch, char *matrix, char *premap, int **mout){
+@@ -772,7 +781,14 @@ static unsigned int _matrix_to_channelmask(int ch, char *matrix, char *premap, i
+ char *p=matrix;
+ int *perm=(*mout=malloc(ch*sizeof(*mout)));
+ int i;
+- char **map = _tokenize_matrix(premap);
++ char **map;
++
++ if(!perm)
++ return 0;
++
++ map = _tokenize_matrix(premap);
++ if(!map)
++ return 0;
+
+ for(i=0;i<ch;i++) perm[i] = -1;
+ i=0;
+@@ -810,6 +826,9 @@ static char *_channelmask_to_matrix(unsigned int mask, char *premap){
+ char buffer[257]={0};
+ char **map = _tokenize_matrix(premap);
+
++ if(!map)
++ return NULL;
++
+ while(map[m]){
+ if(mask & (1<<m)){
+ if(count)
+@@ -849,6 +868,9 @@ static char *_matrix_intersect(char *matrix,char *premap){
+ int count=0;
+ char **map = _tokenize_matrix(premap);
+
++ if(!map)
++ return NULL;
++
+ while(1){
+ char *h=p;
+ int m=0;
+@@ -1039,7 +1061,7 @@ static ao_device* _open_device(int driver_id, ao_sample_format *format,
+ device->output_matrix,
+ &device->input_map);
+ int channels = _channelmask_bits(mask);
+- if(channels<0){
++ if(channels<=0){
+ aerror("Unable to map any channels from input matrix to output");
+ errno = AO_EBADFORMAT;
+ goto error;
+@@ -1060,7 +1082,7 @@ static ao_device* _open_device(int driver_id, ao_sample_format *format,
+ device->output_matrix,
+ &device->input_map);
+ int channels = _channelmask_bits(mask);
+- if(channels<0){
++ if(channels<=0){
+ aerror("Unable to map any channels from input matrix to output");
+ errno = AO_EBADFORMAT;
+ goto error;
+@@ -1111,6 +1133,10 @@ static ao_device* _open_device(int driver_id, ao_sample_format *format,
+ int count=0;
+ device->inter_permute = calloc(device->output_channels,sizeof(int));
+
++ if (!device->inter_permute) {
++ errno = AO_EFAIL;
++ goto error;
++ }
+ adebug("\n");
+
+ while(count<device->output_channels){
+@@ -1157,8 +1183,10 @@ static ao_device* _open_device(int driver_id, ao_sample_format *format,
+ for(i=0;i<device->output_channels;i++)
+ if(device->inter_permute[i]==j)break;
+ if(i==device->output_channels){
+- adebug("input %d (%s)\t -> none\n",
+- j,inch[j]);
++ if(inch){
++ adebug("input %d (%s)\t -> none\n",
++ j,inch[j]);
++ }
+ unflag=1;
+ }
+ }
+diff --git a/src/plugins/macosx/ao_macosx.c b/src/plugins/macosx/ao_macosx.c
+index a3daf1b..129020d 100644
+--- a/src/plugins/macosx/ao_macosx.c
++++ b/src/plugins/macosx/ao_macosx.c
+@@ -594,11 +594,11 @@ int ao_plugin_open(ao_device *device, ao_sample_format *format)
+ internal->firstValidByteOffset = 0;
+ internal->validByteCount = 0;
+ internal->buffer = malloc(internal->bufferByteCount);
+- memset(internal->buffer, 0, internal->bufferByteCount);
+ if (!internal->buffer) {
+ aerror("Unable to allocate queue buffer.\n");
+ return 0;
+ }
++ memset(internal->buffer, 0, internal->bufferByteCount);
+
+ /* limited to stereo for now */
+ //if(!device->output_matrix)
+diff --git a/src/plugins/sndio/ao_sndio.c b/src/plugins/sndio/ao_sndio.c
+index ec251fb..e23fd47 100644
+--- a/src/plugins/sndio/ao_sndio.c
++++ b/src/plugins/sndio/ao_sndio.c
+@@ -67,6 +67,9 @@ int ao_plugin_device_init(ao_device *device)
+ {
+ ao_sndio_internal *internal;
+ internal = (ao_sndio_internal *) calloc(1,sizeof(*internal));
++ if (internal == NULL)
++ return 0;
++
+ internal->id=-1;
+ device->internal = internal;
+ device->output_matrix_order = AO_OUTPUT_MATRIX_FIXED;