Copied from Debian.
; You can calculate where the next frame will start depending on things
; like the bitrate. See mad_header_decode(). It seems that when decoding
; the frame you can go past that boundary. This attempts to catch those cases,
; but might not catch all of them.
; For more info see http://bugs.debian.org/508133
Index: libmad-0.15.1b/layer12.c
===================================================================
--- libmad-0.15.1b.orig/layer12.c 2008-12-23 21:38:07.000000000 +0100
+++ libmad-0.15.1b/layer12.c 2008-12-23 21:38:12.000000000 +0100
@@ -134,6 +134,12 @@
for (sb = 0; sb < bound; ++sb) {
for (ch = 0; ch < nch; ++ch) {
nb = mad_bit_read(&stream->ptr, 4);
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
if (nb == 15) {
stream->error = MAD_ERROR_BADBITALLOC;
@@ -146,6 +152,12 @@
for (sb = bound; sb < 32; ++sb) {
nb = mad_bit_read(&stream->ptr, 4);
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
if (nb == 15) {
stream->error = MAD_ERROR_BADBITALLOC;
@@ -162,6 +174,12 @@
for (ch = 0; ch < nch; ++ch) {
if (allocation[ch][sb]) {
scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6);
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
# if defined(OPT_STRICT)
/*
@@ -187,6 +205,12 @@
frame->sbsample[ch][s][sb] = nb ?
mad_f_mul(I_sample(&stream->ptr, nb),
sf_table[scalefactor[ch][sb]]) : 0;
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
}
}
@@ -195,6 +219,12 @@
mad_fixed_t sample;
sample = I_sample(&stream->ptr, nb);
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
for (ch = 0; ch < nch; ++ch) {
frame->sbsample[ch][s][sb] =
@@ -403,7 +433,15 @@
nbal = bitalloc_table[offsets[sb]].nbal;
for (ch = 0; ch < nch; ++ch)
+ {
allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal);
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
+ }
}
for (sb = bound; sb < sblimit; ++sb) {
@@ -411,6 +449,13 @@
allocation[0][sb] =
allocation[1][sb] = mad_bit_read(&stream->ptr, nbal);
+
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
}
/* decode scalefactor selection info */
@@ -419,6 +464,12 @@
for (ch = 0; ch < nch; ++ch) {
if (allocation[ch][sb])
scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2);
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
}
}
@@ -442,6 +493,12 @@
for (ch = 0; ch < nch; ++ch) {
if (allocation[ch][sb]) {
scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6);
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
switch (scfsi[ch][sb]) {
case 2:
@@ -452,11 +509,23 @@
case 0:
scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6);
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
/* fall through */
case 1:
case 3:
scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6);
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
}
if (scfsi[ch][sb] & 1)
@@ -488,6 +557,12 @@
index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
II_samples(&stream->ptr, &qc_table[index], samples);
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
for (s = 0; s < 3; ++s) {
frame->sbsample[ch][3 * gr + s][sb] =
@@ -506,6 +581,12 @@
index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
II_samples(&stream->ptr, &qc_table[index], samples);
+ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
for (ch = 0; ch < nch; ++ch) {
for (s = 0; s < 3; ++s) {
Index: libmad-0.15.1b/layer3.c
===================================================================
--- libmad-0.15.1b.orig/layer3.c 2008-12-23 21:38:07.000000000 +0100
+++ libmad-0.15.1b/layer3.c 2008-12-23 21:38:12.000000000 +0100
@@ -2608,6 +2608,12 @@
next_md_begin = 0;
md_len = si.main_data_begin + frame_space - next_md_begin;
+ if (md_len + MAD_BUFFER_GUARD > MAD_BUFFER_MDLEN)
+ {
+ stream->error = MAD_ERROR_LOSTSYNC;
+ stream->sync = 0;
+ return -1;
+ }
frame_used = 0;
es.scm (run-memcached-test)
(run-postgresql-test, run-mysql-test): Likewise.
* gnu/tests/desktop.scm (run-elogind-test): Likewise.
* gnu/tests/dict.scm (run-dicod-test): Likewise.
* gnu/tests/docker.scm (run-docker-test): Likewise.
(run-docker-system-test): Likewise.
* gnu/tests/file-sharing.scm (run-transmission-daemon-test): Likewise.
* gnu/tests/ganeti.scm (run-ganeti-test): Likewise.
* gnu/tests/guix.scm (run-guix-build-coordinator-test): Likewise.
(run-guix-data-service-test): Likewise.
* gnu/tests/ldap.scm (run-ldap-test): Likewise.
* gnu/tests/linux-modules.scm (run-loadable-kernel-modules-test-base): Likewise.
* gnu/tests/mail.scm (run-opensmtpd-test)
(run-exim-test, run-dovecot-test, run-getmail-test): Likewise.
* gnu/tests/messaging.scm (run-xmpp-test)
(run-bitlbee-test, run-quassel-test): Likewise.
* gnu/tests/monitoring.scm (run-prometheus-node-exporter-server-test)
(run-zabbix-server-test): Likewise.
* gnu/tests/networking.scm (run-inetd-test, run-openvswitch-test)
(run-dhcpd-test, run-tor-test, run-iptables-test, run-ipfs-test): Likewise.
* gnu/tests/nfs.scm (run-nfs-test)
(run-nfs-server-test, run-nfs-root-fs-test): Likewise.
* gnu/tests/package-management.scm (run-nix-test): Likewise.
* gnu/tests/reconfigure.scm (run-switch-to-system-test)
(run-upgrade-services-test, run-install-bootloader-test): Likewise.
* gnu/tests/rsync.scm (run-rsync-test): Likewise.
* gnu/tests/security-token.scm (run-pcscd-test): Likewise.
* gnu/tests/singularity.scm (run-singularity-test): Likewise.
* gnu/tests/ssh.scm (run-ssh-test): Likewise.
* gnu/tests/telephony.scm (run-jami-test): Likewise.
* gnu/tests/version-control.scm (run-cgit-test): Likewise.
(run-git-http-test, run-gitolite-test, run-gitile-test): Likewise.
* gnu/tests/virtualization.scm (run-libvirt-test, run-childhurd-test): Likewise.
* gnu/tests/web.scm (run-webserver-test, run-php-fpm-test)
(run-hpcguix-web-server-test, run-tailon-test, run-patchwork-test): Likewise.
| Ludovic Courtès |
| 2021-04-18 | tests: ldap: Fix it....Fixes: <https://issues.guix.gnu.org/47745>.
* gnu/tests/ldap.scm (run-ldap-test): Use a password with more that 8
characters so that dscreate doesn't fail.
| Mathieu Othacehe |