Package list faad2 / 02b8509
Backport two patches from upstream to fix CVE-2018-20194 and CVE-2018-20362, thanks Hugo Lefeuvre. Fabian Greffrath 3 years ago
3 changed file(s) with 129 addition(s) and 0 deletion(s). Raw diff Collapse all Expand all
0 From 466b01d504d7e45f1e9169ac90b3e34ab94aed14 Mon Sep 17 00:00:00 2001
1 From: Hugo Lefeuvre <hle@debian.org>
2 Date: Mon, 25 Feb 2019 10:49:03 +0100
3 Subject: [PATCH 09/10] syntax.c: check for syntax element inconsistencies
4
5 Implicit channel mapping reconfiguration is explicitely forbidden by
6 ISO/IEC 13818-7:2006 (8.5.3.3). Decoders should be able to detect such
7 files and reject them. FAAD2 does not perform any kind of checks
8 regarding this.
9
10 This leads to security vulnerabilities when processing crafted AAC
11 files performing such reconfigurations.
12
13 Add checks to decode_sce_lfe and decode_cpe to make sure such
14 inconsistencies are detected as early as possible.
15
16 These checks first read hDecoder->frame: if this is not the first
17 frame then we make sure that the syntax element at the same position
18 in the previous frame also had element_id id_syn_ele. If not, return
19 21 as this is a fatal file structure issue.
20
21 This patch addresses CVE-2018-20362 (fixes #26) and possibly other
22 related issues.
23 ---
24 libfaad/syntax.c | 12 ++++++++++++
25 1 file changed, 12 insertions(+)
26
27 diff --git a/libfaad/syntax.c b/libfaad/syntax.c
28 index f8e808c..e7fb113 100644
29 --- a/libfaad/syntax.c
30 +++ b/libfaad/syntax.c
31 @@ -344,6 +344,12 @@ static void decode_sce_lfe(NeAACDecStruct *hDecoder,
32 can become 2 when some form of Parametric Stereo coding is used
33 */
34
35 + if (hDecoder->frame && hDecoder->element_id[hDecoder->fr_ch_ele] != id_syn_ele) {
36 + /* element inconsistency */
37 + hInfo->error = 21;
38 + return;
39 + }
40 +
41 /* save the syntax element id */
42 hDecoder->element_id[hDecoder->fr_ch_ele] = id_syn_ele;
43
44 @@ -395,6 +401,12 @@ static void decode_cpe(NeAACDecStruct *hDecoder, NeAACDecFrameInfo *hInfo, bitfi
45 return;
46 }
47
48 + if (hDecoder->frame && hDecoder->element_id[hDecoder->fr_ch_ele] != id_syn_ele) {
49 + /* element inconsistency */
50 + hInfo->error = 21;
51 + return;
52 + }
53 +
54 /* save the syntax element id */
55 hDecoder->element_id[hDecoder->fr_ch_ele] = id_syn_ele;
56
57 --
58 2.20.1
59
0 From 6b4a7cde30f2e2cb03e78ef476cc73179cfffda3 Mon Sep 17 00:00:00 2001
1 From: Hugo Lefeuvre <hle@debian.org>
2 Date: Thu, 11 Apr 2019 09:34:07 +0200
3 Subject: [PATCH 10/10] sbr_hfadj: sanitize frequency band borders
4
5 user passed f_table_lim contains frequency band borders. Frequency
6 bands are groups of consecutive QMF channels. This means that their
7 bounds, as provided by f_table_lim, should never exceed MAX_M (maximum
8 number of QMF channels). c.f. ISO/IEC 14496-3:2001
9
10 FAAD2 does not verify this, leading to security issues when
11 processing files defining f_table_lim with values > MAX_M.
12
13 This patch sanitizes the values of f_table_lim so that they can be safely
14 used as index for Q_M_lim and G_lim arrays.
15
16 Fixes #21 (CVE-2018-20194).
17 ---
18 libfaad/sbr_hfadj.c | 18 ++++++++++++++++++
19 1 file changed, 18 insertions(+)
20
21 diff --git a/libfaad/sbr_hfadj.c b/libfaad/sbr_hfadj.c
22 index 3f310b8..dda1ce8 100644
23 --- a/libfaad/sbr_hfadj.c
24 +++ b/libfaad/sbr_hfadj.c
25 @@ -485,6 +485,12 @@ static void calculate_gain(sbr_info *sbr, sbr_hfadj_info *adj, uint8_t ch)
26 ml1 = sbr->f_table_lim[sbr->bs_limiter_bands][k];
27 ml2 = sbr->f_table_lim[sbr->bs_limiter_bands][k+1];
28
29 + if (ml1 > MAX_M)
30 + ml1 = MAX_M;
31 +
32 + if (ml2 > MAX_M)
33 + ml2 = MAX_M;
34 +
35
36 /* calculate the accumulated E_orig and E_curr over the limiter band */
37 for (m = ml1; m < ml2; m++)
38 @@ -949,6 +955,12 @@ static void calculate_gain(sbr_info *sbr, sbr_hfadj_info *adj, uint8_t ch)
39 ml1 = sbr->f_table_lim[sbr->bs_limiter_bands][k];
40 ml2 = sbr->f_table_lim[sbr->bs_limiter_bands][k+1];
41
42 + if (ml1 > MAX_M)
43 + ml1 = MAX_M;
44 +
45 + if (ml2 > MAX_M)
46 + ml2 = MAX_M;
47 +
48
49 /* calculate the accumulated E_orig and E_curr over the limiter band */
50 for (m = ml1; m < ml2; m++)
51 @@ -1193,6 +1205,12 @@ static void calculate_gain(sbr_info *sbr, sbr_hfadj_info *adj, uint8_t ch)
52 ml1 = sbr->f_table_lim[sbr->bs_limiter_bands][k];
53 ml2 = sbr->f_table_lim[sbr->bs_limiter_bands][k+1];
54
55 + if (ml1 > MAX_M)
56 + ml1 = MAX_M;
57 +
58 + if (ml2 > MAX_M)
59 + ml2 = MAX_M;
60 +
61
62 /* calculate the accumulated E_orig and E_curr over the limiter band */
63 for (m = ml1; m < ml2; m++)
64 --
65 2.20.1
66
00 reproducible-build.patch
1 0009-syntax.c-check-for-syntax-element-inconsistencies.patch
2 0010-sbr_hfadj-sanitize-frequency-band-borders.patch