0003-oggenc-fix-crash-on-raw-file-close-reported-by-Hanno.patch 2.0 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455
  1. From 514116d7bea89dad9f1deb7617b2277b5e9115cd Mon Sep 17 00:00:00 2001
  2. From: Gregory Maxwell <greg@xiph.org>
  3. Date: Wed, 16 Apr 2014 23:55:10 +0000
  4. Subject: [PATCH] oggenc: fix crash on raw file close, reported by Hanno in
  5. issue #2009. pointer to a non-static struct was escaping its scope. Also fix
  6. a C99-ism.
  7. svn path=/trunk/vorbis-tools/; revision=19117
  8. Fixes CVE-2014-9640
  9. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
  10. ---
  11. oggenc/oggenc.c | 4 ++--
  12. oggenc/skeleton.h | 2 +-
  13. 2 files changed, 3 insertions(+), 3 deletions(-)
  14. diff --git a/oggenc/oggenc.c b/oggenc/oggenc.c
  15. index 4a120f3..e7de0bb 100644
  16. --- a/oggenc/oggenc.c
  17. +++ b/oggenc/oggenc.c
  18. @@ -97,6 +97,8 @@ int main(int argc, char **argv)
  19. .3,-1,
  20. 0,0,0.f,
  21. 0, 0, 0, 0, 0};
  22. + input_format raw_format = {NULL, 0, raw_open, wav_close, "raw",
  23. + N_("RAW file reader")};
  24. int i;
  25. @@ -239,8 +241,6 @@ int main(int argc, char **argv)
  26. if(opt.rawmode)
  27. {
  28. - input_format raw_format = {NULL, 0, raw_open, wav_close, "raw",
  29. - N_("RAW file reader")};
  30. enc_opts.rate=opt.raw_samplerate;
  31. enc_opts.channels=opt.raw_channels;
  32. diff --git a/oggenc/skeleton.h b/oggenc/skeleton.h
  33. index cf87dc2..168b8b6 100644
  34. --- a/oggenc/skeleton.h
  35. +++ b/oggenc/skeleton.h
  36. @@ -41,7 +41,7 @@ typedef struct {
  37. ogg_int64_t granule_rate_d; /* granule rate denominator */
  38. ogg_int64_t start_granule; /* start granule value */
  39. ogg_uint32_t preroll; /* preroll */
  40. - unsigned char granule_shift; // a 8-bit field /* 1 byte value holding the granule shift */
  41. + unsigned char granule_shift; /* 1 byte value holding the granule shift */
  42. char *message_header_fields; /* holds all the message header fields */
  43. /* current total size of the message header fields, for realloc purpose, initially zero */
  44. ogg_uint32_t current_header_size;
  45. --
  46. 2.20.1