#

# Fix CVE-2014-8145[0]:

# two heap-based buffer overflows

# Upstream changesets 7d3f38 and f39c57.

# http://sourceforge.net/p/sox/code/ci/7d3f38007a1eeaf5ab7669aba0d2a7e4d3def57e/

# http://sourceforge.net/p/sox/code/ci/f39c574bc423fd5b12bd6510264512f5d5366183/

#

--- a/src/sphere.c

+++ b/src/sphere.c

@@ -47,6 +47,11 @@

/* Determine header size, and allocate a buffer large enough to hold it. */

sscanf(fldsval, "%lu", &header_size_ul);

+ if (header_size_ul < 16) {

+ lsx_fail_errno(ft, SOX_EHDR, "Error reading Sphere header");

+ return (SOX_EOF);

+ }

+

buf = lsx_malloc(header_size = header_size_ul);

/* Skip what we have read so far */

--- a/src/wav.c

+++ b/src/wav.c

@@ -166,7 +166,7 @@

/* work with partial blocks. Specs say it should be null */

/* padded but I guess this is better than trailing quiet. */

samplesThisBlock = lsx_ms_adpcm_samples_in((size_t)0, (size_t)ft->signal.channels, bytesRead, (size_t)0);

- if (samplesThisBlock == 0)

+ if (samplesThisBlock == 0 || samplesThisBlock > wav->samplesPerBlock)

{

lsx_warn("Premature EOF on .wav input file");

return 0;