In case of an unknown/invalid encoding, id3_parse_string() will
|
return NULL, but the return value wasn't checked resulting
|
in segfault in id3_ucs4_length(). This is the only place
|
the return value wasn't checked.
|
|
Patch taken from Debian:
|
https://sources.debian.org/patches/libid3tag/0.15.1b-14/11_unknown_encoding.dpatch/
|
|
CVE: CVE-2017-11550
|
Upstream-Status: Pending
|
Signed-off-by: Ross Burton <ross.burton@intel.com>
|
|
diff -urNad libid3tag-0.15.1b~/compat.gperf libid3tag-0.15.1b/compat.gperf
|
--- libid3tag-0.15.1b~/compat.gperf 2004-01-23 09:41:32.000000000 +0000
|
+++ libid3tag-0.15.1b/compat.gperf 2007-01-14 14:36:53.000000000 +0000
|
@@ -236,6 +236,10 @@
|
|
encoding = id3_parse_uint(&data, 1);
|
string = id3_parse_string(&data, end - data, encoding, 0);
|
+ if (!string)
|
+ {
|
+ continue;
|
+ }
|
|
if (id3_ucs4_length(string) < 4) {
|
free(string);
|
diff -urNad libid3tag-0.15.1b~/parse.c libid3tag-0.15.1b/parse.c
|
--- libid3tag-0.15.1b~/parse.c 2004-01-23 09:41:32.000000000 +0000
|
+++ libid3tag-0.15.1b/parse.c 2007-01-14 14:37:34.000000000 +0000
|
@@ -165,6 +165,9 @@
|
case ID3_FIELD_TEXTENCODING_UTF_8:
|
ucs4 = id3_utf8_deserialize(ptr, length);
|
break;
|
+ default:
|
+ /* FIXME: Unknown encoding! Print warning? */
|
+ return NULL;
|
}
|
|
if (ucs4 && !full) {
|
