libsndfile: apply patch for CVE-2021-3246


(nia)

$NetBSD: patch-CVE-2021-3246,v 1.1 2021/09/09 12:03:10 nia Exp $

[PATCH] ms_adpcm: Fix and extend size checks

'blockalign' is the size of a block, and each block contains 7 samples
per channel as part of the preamble, so check against 'samplesperblock'
rather than 'blockalign'. Also add an additional check that the block
is big enough to hold the samples it claims to hold.

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26803
https://github.com/libsndfile/libsndfile/pull/713

--- src/ms_adpcm.c.orig	2021-01-23 16:12:45.000000000 +0000
+++ src/ms_adpcm.c
@@ -128,8 +128,14 @@ wavlike_msadpcm_init	(SF_PRIVATE *psf, i
 	if (psf->file.mode == SFM_WRITE)
 		samplesperblock = 2 + 2 * (blockalign - 7 * psf->sf.channels) / psf->sf.channels ;
 
-	if (blockalign < 7 * psf->sf.channels)
-	{	psf_log_printf (psf, "*** Error blockalign (%d) should be > %d.\n", blockalign, 7 * psf->sf.channels) ;
+	/* There's 7 samples per channel in the preamble of each block */
+	if (samplesperblock < 7 * psf->sf.channels)
+	{	psf_log_printf (psf, "*** Error samplesperblock (%d) should be >= %d.\n", samplesperblock, 7 * psf->sf.channels) ;
+		return SFE_INTERNAL ;
+		} ;
+
+	if (2 * blockalign < samplesperblock * psf->sf.channels)
+	{	psf_log_printf (psf, "*** Error blockalign (%d) should be >= %d.\n", blockalign, samplesperblock * psf->sf.channels / 2) ;
 		return SFE_INTERNAL ;
 		} ;
 

$NetBSD: patch-src_wavlike.c,v 1.1 2021/09/09 12:03:10 nia Exp $

[PATCH] wavlike: Fix incorrect size check

The SF_CART_INFO_16K struct has an additional 4 byte field to hold
the size of 'tag_text' which the file header doesn't, so don't
include it as part of the check when looking for the max length.

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26026
https://github.com/libsndfile/libsndfile/pull/713

--- src/wavlike.c.orig	2021-01-23 16:12:45.000000000 +0000
+++ src/wavlike.c
@@ -830,7 +830,11 @@ wavlike_read_cart_chunk (SF_PRIVATE *psf
 		return 0 ;
 		} ;
 
-	if (chunksize >= sizeof (SF_CART_INFO_16K))
+	/*
+	**	SF_CART_INFO_16K has an extra field 'tag_text_size' that isn't part
+	**	of the chunk, so don't include it in the size check.
+	*/
+	if (chunksize >= sizeof (SF_CART_INFO_16K) - 4)
 	{	psf_log_printf (psf, "cart : %u too big to be handled\n", chunksize) ;
 		psf_binheader_readf (psf, "j", chunksize) ;
 		return 0 ;