Backport two patches from upstream to fix CVE-2018-20194 and CVE-2018-20362, thanks Hugo Lefeuvre.
Fabian Greffrath
5 years ago
| 0 | From 466b01d504d7e45f1e9169ac90b3e34ab94aed14 Mon Sep 17 00:00:00 2001 | |
| 1 | From: Hugo Lefeuvre <hle@debian.org> | |
| 2 | Date: Mon, 25 Feb 2019 10:49:03 +0100 | |
| 3 | Subject: [PATCH 09/10] syntax.c: check for syntax element inconsistencies | |
| 4 | ||
| 5 | Implicit channel mapping reconfiguration is explicitely forbidden by | |
| 6 | ISO/IEC 13818-7:2006 (8.5.3.3). Decoders should be able to detect such | |
| 7 | files and reject them. FAAD2 does not perform any kind of checks | |
| 8 | regarding this. | |
| 9 | ||
| 10 | This leads to security vulnerabilities when processing crafted AAC | |
| 11 | files performing such reconfigurations. | |
| 12 | ||
| 13 | Add checks to decode_sce_lfe and decode_cpe to make sure such | |
| 14 | inconsistencies are detected as early as possible. | |
| 15 | ||
| 16 | These checks first read hDecoder->frame: if this is not the first | |
| 17 | frame then we make sure that the syntax element at the same position | |
| 18 | in the previous frame also had element_id id_syn_ele. If not, return | |
| 19 | 21 as this is a fatal file structure issue. | |
| 20 | ||
| 21 | This patch addresses CVE-2018-20362 (fixes #26) and possibly other | |
| 22 | related issues. | |
| 23 | --- | |
| 24 | libfaad/syntax.c | 12 ++++++++++++ | |
| 25 | 1 file changed, 12 insertions(+) | |
| 26 | ||
| 27 | diff --git a/libfaad/syntax.c b/libfaad/syntax.c | |
| 28 | index f8e808c..e7fb113 100644 | |
| 29 | --- a/libfaad/syntax.c | |
| 30 | +++ b/libfaad/syntax.c | |
| 31 | @@ -344,6 +344,12 @@ static void decode_sce_lfe(NeAACDecStruct *hDecoder, | |
| 32 | can become 2 when some form of Parametric Stereo coding is used | |
| 33 | */ | |
| 34 | ||
| 35 | + if (hDecoder->frame && hDecoder->element_id[hDecoder->fr_ch_ele] != id_syn_ele) { | |
| 36 | + /* element inconsistency */ | |
| 37 | + hInfo->error = 21; | |
| 38 | + return; | |
| 39 | + } | |
| 40 | + | |
| 41 | /* save the syntax element id */ | |
| 42 | hDecoder->element_id[hDecoder->fr_ch_ele] = id_syn_ele; | |
| 43 | ||
| 44 | @@ -395,6 +401,12 @@ static void decode_cpe(NeAACDecStruct *hDecoder, NeAACDecFrameInfo *hInfo, bitfi | |
| 45 | return; | |
| 46 | } | |
| 47 | ||
| 48 | + if (hDecoder->frame && hDecoder->element_id[hDecoder->fr_ch_ele] != id_syn_ele) { | |
| 49 | + /* element inconsistency */ | |
| 50 | + hInfo->error = 21; | |
| 51 | + return; | |
| 52 | + } | |
| 53 | + | |
| 54 | /* save the syntax element id */ | |
| 55 | hDecoder->element_id[hDecoder->fr_ch_ele] = id_syn_ele; | |
| 56 | ||
| 57 | -- | |
| 58 | 2.20.1 | |
| 59 |
| 0 | From 6b4a7cde30f2e2cb03e78ef476cc73179cfffda3 Mon Sep 17 00:00:00 2001 | |
| 1 | From: Hugo Lefeuvre <hle@debian.org> | |
| 2 | Date: Thu, 11 Apr 2019 09:34:07 +0200 | |
| 3 | Subject: [PATCH 10/10] sbr_hfadj: sanitize frequency band borders | |
| 4 | ||
| 5 | user passed f_table_lim contains frequency band borders. Frequency | |
| 6 | bands are groups of consecutive QMF channels. This means that their | |
| 7 | bounds, as provided by f_table_lim, should never exceed MAX_M (maximum | |
| 8 | number of QMF channels). c.f. ISO/IEC 14496-3:2001 | |
| 9 | ||
| 10 | FAAD2 does not verify this, leading to security issues when | |
| 11 | processing files defining f_table_lim with values > MAX_M. | |
| 12 | ||
| 13 | This patch sanitizes the values of f_table_lim so that they can be safely | |
| 14 | used as index for Q_M_lim and G_lim arrays. | |
| 15 | ||
| 16 | Fixes #21 (CVE-2018-20194). | |
| 17 | --- | |
| 18 | libfaad/sbr_hfadj.c | 18 ++++++++++++++++++ | |
| 19 | 1 file changed, 18 insertions(+) | |
| 20 | ||
| 21 | diff --git a/libfaad/sbr_hfadj.c b/libfaad/sbr_hfadj.c | |
| 22 | index 3f310b8..dda1ce8 100644 | |
| 23 | --- a/libfaad/sbr_hfadj.c | |
| 24 | +++ b/libfaad/sbr_hfadj.c | |
| 25 | @@ -485,6 +485,12 @@ static void calculate_gain(sbr_info *sbr, sbr_hfadj_info *adj, uint8_t ch) | |
| 26 | ml1 = sbr->f_table_lim[sbr->bs_limiter_bands][k]; | |
| 27 | ml2 = sbr->f_table_lim[sbr->bs_limiter_bands][k+1]; | |
| 28 | ||
| 29 | + if (ml1 > MAX_M) | |
| 30 | + ml1 = MAX_M; | |
| 31 | + | |
| 32 | + if (ml2 > MAX_M) | |
| 33 | + ml2 = MAX_M; | |
| 34 | + | |
| 35 | ||
| 36 | /* calculate the accumulated E_orig and E_curr over the limiter band */ | |
| 37 | for (m = ml1; m < ml2; m++) | |
| 38 | @@ -949,6 +955,12 @@ static void calculate_gain(sbr_info *sbr, sbr_hfadj_info *adj, uint8_t ch) | |
| 39 | ml1 = sbr->f_table_lim[sbr->bs_limiter_bands][k]; | |
| 40 | ml2 = sbr->f_table_lim[sbr->bs_limiter_bands][k+1]; | |
| 41 | ||
| 42 | + if (ml1 > MAX_M) | |
| 43 | + ml1 = MAX_M; | |
| 44 | + | |
| 45 | + if (ml2 > MAX_M) | |
| 46 | + ml2 = MAX_M; | |
| 47 | + | |
| 48 | ||
| 49 | /* calculate the accumulated E_orig and E_curr over the limiter band */ | |
| 50 | for (m = ml1; m < ml2; m++) | |
| 51 | @@ -1193,6 +1205,12 @@ static void calculate_gain(sbr_info *sbr, sbr_hfadj_info *adj, uint8_t ch) | |
| 52 | ml1 = sbr->f_table_lim[sbr->bs_limiter_bands][k]; | |
| 53 | ml2 = sbr->f_table_lim[sbr->bs_limiter_bands][k+1]; | |
| 54 | ||
| 55 | + if (ml1 > MAX_M) | |
| 56 | + ml1 = MAX_M; | |
| 57 | + | |
| 58 | + if (ml2 > MAX_M) | |
| 59 | + ml2 = MAX_M; | |
| 60 | + | |
| 61 | ||
| 62 | /* calculate the accumulated E_orig and E_curr over the limiter band */ | |
| 63 | for (m = ml1; m < ml2; m++) | |
| 64 | -- | |
| 65 | 2.20.1 | |
| 66 |