Anonymous avatar Anonymous committed 87dcebe

Merged revisions 81046 from the python2.6 branch:

Issue #8674: Fix incorrect and UB-inducing overflow checks in audioop
module. Thanks Tomas Hoger for the patch.

Comments (0)

Files changed (3)

 Gregor Hoffleit
 Chris Hoffman
 Albert Hofkamp
+Tomas Hoger
 Jonathan Hogg
 Gerrit Holl
 Rune Holm
 
 *Release date: XX-XXX-2010*
 
+Library
+-------
+
+- Issue #8674: Fixed a number of incorrect or undefined-behaviour-inducing
+  overflow checks in the audioop module (CVE-2010-1634).
+
 
 What's New in Python 2.5.5?
 ===========================

Modules/audioop.c

 audioop_tostereo(PyObject *self, PyObject *args)
 {
         signed char *cp, *ncp;
-        int len, new_len, size, val1, val2, val = 0;
+        int len, size, val1, val2, val = 0;
         double fac1, fac2, fval, maxval;
         PyObject *rv;
         int i;
                 return 0;
         }
     
-        new_len = len*2;
-        if (new_len < 0) {
+        if (len > INT_MAX/2) {
                 PyErr_SetString(PyExc_MemoryError,
                                 "not enough memory for output buffer");
                 return 0;
         }
 
-        rv = PyString_FromStringAndSize(NULL, new_len);
+        rv = PyString_FromStringAndSize(NULL, len*2);
         if ( rv == 0 )
                 return 0;
         ncp = (signed char *)PyString_AsString(rv);
 {
         signed char *cp;
         unsigned char *ncp;
-        int len, new_len, size, size2, val = 0;
+        int len, size, size2, val = 0;
         PyObject *rv;
         int i, j;
 
                 return 0;
         }
     
-        new_len = (len/size)*size2;
-        if (new_len < 0) {
+        if (len/size > INT_MAX/size2) {
                 PyErr_SetString(PyExc_MemoryError,
                                 "not enough memory for output buffer");
                 return 0;
         }
-        rv = PyString_FromStringAndSize(NULL, new_len);
+        rv = PyString_FromStringAndSize(NULL, (len/size)*size2);
         if ( rv == 0 )
                 return 0;
         ncp = (unsigned char *)PyString_AsString(rv);
         int chan, d, *prev_i, *cur_i, cur_o;
         PyObject *state, *samps, *str, *rv = NULL;
         int bytes_per_frame;
-        size_t alloc_size;
 
         weightA = 1;
         weightB = 0;
         inrate /= d;
         outrate /= d;
 
-        alloc_size = sizeof(int) * (unsigned)nchannels;
-        if (alloc_size < nchannels) {
+        if ((size_t)nchannels > PY_SIZE_MAX/sizeof(int)) {
                 PyErr_SetString(PyExc_MemoryError,
                                 "not enough memory for output buffer");
                 return 0;
         }
-        prev_i = (int *) malloc(alloc_size);
-        cur_i = (int *) malloc(alloc_size);
+        prev_i = (int *) malloc(nchannels * sizeof(int));
+        cur_i = (int *) malloc(nchannels * sizeof(int));
         if (prev_i == NULL || cur_i == NULL) {
                 (void) PyErr_NoMemory();
                 goto exit;
         unsigned char *cp;
         unsigned char cval;
         signed char *ncp;
-        int len, new_len, size, val;
+        int len, size, val;
         PyObject *rv;
         int i;
 
                 return 0;
         }
     
-        new_len = len*size;
-        if (new_len < 0) {
+        if (len > INT_MAX/size) {
                 PyErr_SetString(PyExc_MemoryError,
                                 "not enough memory for output buffer");
                 return 0;
         }
-        rv = PyString_FromStringAndSize(NULL, new_len);
+        rv = PyString_FromStringAndSize(NULL, len*size);
         if ( rv == 0 )
                 return 0;
         ncp = (signed char *)PyString_AsString(rv);
     
-        for ( i=0; i < new_len; i += size ) {
+        for ( i=0; i < len*size; i += size ) {
                 cval = *cp++;
                 val = st_ulaw2linear16(cval);
         
         unsigned char *cp;
         unsigned char cval;
         signed char *ncp;
-        int len, new_len, size, val;
+        int len, size, val;
         PyObject *rv;
         int i;
 
                 return 0;
         }
     
-        new_len = len*size;
-        if (new_len < 0) {
+        if (len > INT_MAX/size) {
                 PyErr_SetString(PyExc_MemoryError,
                                 "not enough memory for output buffer");
                 return 0;
         }
-        rv = PyString_FromStringAndSize(NULL, new_len);
+        rv = PyString_FromStringAndSize(NULL, len*size);
         if ( rv == 0 )
                 return 0;
         ncp = (signed char *)PyString_AsString(rv);
     
-        for ( i=0; i < new_len; i += size ) {
+        for ( i=0; i < len*size; i += size ) {
                 cval = *cp++;
                 val = st_alaw2linear16(cval);
         
 {
         signed char *cp;
         signed char *ncp;
-        int len, new_len, size, valpred, step, delta, index, sign, vpdiff;
+        int len, size, valpred, step, delta, index, sign, vpdiff;
         PyObject *rv, *str, *state;
         int i, inputbuffer = 0, bufferstep;
 
         } else if ( !PyArg_ParseTuple(state, "ii", &valpred, &index) )
                 return 0;
     
-        new_len = len*size*2;
-        if (new_len < 0) {
+        if (len > (INT_MAX/2)/size) {
                 PyErr_SetString(PyExc_MemoryError,
                                 "not enough memory for output buffer");
                 return 0;
         }
-        str = PyString_FromStringAndSize(NULL, new_len);
+        str = PyString_FromStringAndSize(NULL, len*size*2);
         if ( str == 0 )
                 return 0;
         ncp = (signed char *)PyString_AsString(str);
         step = stepsizeTable[index];
         bufferstep = 0;
     
-        for ( i=0; i < new_len; i += size ) {
+        for ( i=0; i < len*size*2; i += size ) {
                 /* Step 1 - get the delta value and compute next index */
                 if ( bufferstep ) {
                         delta = inputbuffer & 0xf;
Tip: Filter by directory path e.g. /media app.js to search for public/media/app.js.
Tip: Use camelCasing e.g. ProjME to search for ProjectModifiedEvent.java.
Tip: Filter by extension type e.g. /repo .js to search for all .js files in the /repo directory.
Tip: Separate your search with spaces e.g. /ssh pom.xml to search for src/ssh/pom.xml.
Tip: Use ↑ and ↓ arrow keys to navigate and return to view the file.
Tip: You can also navigate files with Ctrl+j (next) and Ctrl+k (previous) and view the file with Ctrl+o.
Tip: You can also navigate files with Alt+j (next) and Alt+k (previous) and view the file with Alt+o.