Menu

#118 Fix CVE-2019-13590

None
closed-rejected
nobody
None
5
2020-02-04
2020-02-04
Judy Hsiao
No

bug reference: https://sourceforge.net/p/sox/bugs/325/
This issue is also reported as CVE-2019-13590

Patch Detail:
Fix sox-14.4.2 NULL pointer dereference on lsx_readbuf in formats_i.c by
doing a prior check that it is a valid pointer before passing into lsx_calloc.

Test: run soxi sox-fmt_56_integer_overflow.mp3.
The soxi command should return a error: "premature EOF" rather than giving
a core dump.

1 Attachments

Discussion

  • Mans Rullgard

    Mans Rullgard - 2020-02-04
    • status: open --> closed-rejected
    • Group: -->
     
  • Mans Rullgard

    Mans Rullgard - 2020-02-04

    This doesn't fix the bug.

     

Log in to post a comment.

MongoDB Logo MongoDB