Skip to content

C
cpython
Commit 15e5b1bf authored by Victor Stinner's avatar Victor Stinner
Browse files
Options

Issue #7673: Fix security vulnerability (CVE-2010-2089) in the audioop module, 

ensure that the input string length is a multiple of the frame size
parent 7b18c93d
Show whitespace changes
Inline Side-by-side
Showing with 108 additions and 74 deletions
Lib/test/test_audioop.py
View file @ 15e5b1bf
...@@ -20,6 +20,12 @@ def gendata4(): ...@@ -20,6 +20,12 @@ def gendata4():
data = [gendata1(), gendata2(), gendata4()] data = [gendata1(), gendata2(), gendata4()]
INVALID_DATA = [
('abc', 0),
('abc', 2),
('abc', 4),
]
class TestAudioop(unittest.TestCase): class TestAudioop(unittest.TestCase):
...@@ -166,6 +172,33 @@ class TestAudioop(unittest.TestCase): ...@@ -166,6 +172,33 @@ class TestAudioop(unittest.TestCase):
self.assertRaises(audioop.error, self.assertRaises(audioop.error,
audioop.findmax, ''.join( chr(x) for x in xrange(256)), -2392392) audioop.findmax, ''.join( chr(x) for x in xrange(256)), -2392392)
def test_issue7673(self):
state = None
for data, size in INVALID_DATA:
size2 = size
self.assertRaises(audioop.error, audioop.getsample, data, size, 0)
self.assertRaises(audioop.error, audioop.max, data, size)
self.assertRaises(audioop.error, audioop.minmax, data, size)
self.assertRaises(audioop.error, audioop.avg, data, size)
self.assertRaises(audioop.error, audioop.rms, data, size)
self.assertRaises(audioop.error, audioop.avgpp, data, size)
self.assertRaises(audioop.error, audioop.maxpp, data, size)
self.assertRaises(audioop.error, audioop.cross, data, size)
self.assertRaises(audioop.error, audioop.mul, data, size, 1.0)
self.assertRaises(audioop.error, audioop.tomono, data, size, 0.5, 0.5)
self.assertRaises(audioop.error, audioop.tostereo, data, size, 0.5, 0.5)
self.assertRaises(audioop.error, audioop.add, data, data, size)
self.assertRaises(audioop.error, audioop.bias, data, size, 0)
self.assertRaises(audioop.error, audioop.reverse, data, size)
self.assertRaises(audioop.error, audioop.lin2lin, data, size, size2)
self.assertRaises(audioop.error, audioop.ratecv, data, size, 1, 1, 1, state)
self.assertRaises(audioop.error, audioop.lin2ulaw, data, size)
self.assertRaises(audioop.error, audioop.ulaw2lin, data, size)
self.assertRaises(audioop.error, audioop.lin2alaw, data, size)
self.assertRaises(audioop.error, audioop.alaw2lin, data, size)
self.assertRaises(audioop.error, audioop.lin2adpcm, data, size, state)
self.assertRaises(audioop.error, audioop.adpcm2lin, data, size, state)
def test_main(): def test_main():
run_unittest(TestAudioop) run_unittest(TestAudioop)
......
Misc/NEWS
View file @ 15e5b1bf
...@@ -17,6 +17,9 @@ Core and Builtins ...@@ -17,6 +17,9 @@ Core and Builtins
Library Library
------- -------
- Issue #7673: Fix security vulnerability (CVE-2010-2089) in the audioop
module, ensure that the input string length is a multiple of the frame size
- Issue #9075: In the ssl module, remove the setting of a ``debug`` flag - Issue #9075: In the ssl module, remove the setting of a ``debug`` flag
on an OpenSSL structure. on an OpenSSL structure.
......
Modules/audioop.c
View file @ 15e5b1bf
...@@ -295,6 +295,29 @@ static int stepsizeTable[89] = { ...@@ -295,6 +295,29 @@ static int stepsizeTable[89] = {
static PyObject *AudioopError; static PyObject *AudioopError;
static int
audioop_check_size(int size)
{
if (size != 1 && size != 2 && size != 4) {
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4");
return 0;
}
else
return 1;
}
static int
audioop_check_parameters(int len, int size)
{
if (!audioop_check_size(size))
return 0;
if (len % size != 0) {
PyErr_SetString(AudioopError, "not a whole number of frames");
return 0;
}
return 1;
}
static PyObject * static PyObject *
audioop_getsample(PyObject *self, PyObject *args) audioop_getsample(PyObject *self, PyObject *args)
{ {
...@@ -304,10 +327,8 @@ audioop_getsample(PyObject *self, PyObject *args) ...@@ -304,10 +327,8 @@ audioop_getsample(PyObject *self, PyObject *args)
if ( !PyArg_ParseTuple(args, "s#ii:getsample", &cp, &len, &size, &i) ) if ( !PyArg_ParseTuple(args, "s#ii:getsample", &cp, &len, &size, &i) )
return 0; return 0;
if ( size != 1 && size != 2 && size != 4 ) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
if ( i < 0 || i >= len/size ) { if ( i < 0 || i >= len/size ) {
PyErr_SetString(AudioopError, "Index out of range"); PyErr_SetString(AudioopError, "Index out of range");
return 0; return 0;
...@@ -328,10 +349,8 @@ audioop_max(PyObject *self, PyObject *args) ...@@ -328,10 +349,8 @@ audioop_max(PyObject *self, PyObject *args)
if ( !PyArg_ParseTuple(args, "s#i:max", &cp, &len, &size) ) if ( !PyArg_ParseTuple(args, "s#i:max", &cp, &len, &size) )
return 0; return 0;
if ( size != 1 && size != 2 && size != 4 ) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
for ( i=0; i<len; i+= size) { for ( i=0; i<len; i+= size) {
if ( size == 1 ) val = (int)*CHARP(cp, i); if ( size == 1 ) val = (int)*CHARP(cp, i);
else if ( size == 2 ) val = (int)*SHORTP(cp, i); else if ( size == 2 ) val = (int)*SHORTP(cp, i);
...@@ -352,10 +371,8 @@ audioop_minmax(PyObject *self, PyObject *args) ...@@ -352,10 +371,8 @@ audioop_minmax(PyObject *self, PyObject *args)
if (!PyArg_ParseTuple(args, "s#i:minmax", &cp, &len, &size)) if (!PyArg_ParseTuple(args, "s#i:minmax", &cp, &len, &size))
return NULL; return NULL;
if (size != 1 && size != 2 && size != 4) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4");
return NULL; return NULL;
}
for (i = 0; i < len; i += size) { for (i = 0; i < len; i += size) {
if (size == 1) val = (int) *CHARP(cp, i); if (size == 1) val = (int) *CHARP(cp, i);
else if (size == 2) val = (int) *SHORTP(cp, i); else if (size == 2) val = (int) *SHORTP(cp, i);
...@@ -376,10 +393,8 @@ audioop_avg(PyObject *self, PyObject *args) ...@@ -376,10 +393,8 @@ audioop_avg(PyObject *self, PyObject *args)
if ( !PyArg_ParseTuple(args, "s#i:avg", &cp, &len, &size) ) if ( !PyArg_ParseTuple(args, "s#i:avg", &cp, &len, &size) )
return 0; return 0;
if ( size != 1 && size != 2 && size != 4 ) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
for ( i=0; i<len; i+= size) { for ( i=0; i<len; i+= size) {
if ( size == 1 ) val = (int)*CHARP(cp, i); if ( size == 1 ) val = (int)*CHARP(cp, i);
else if ( size == 2 ) val = (int)*SHORTP(cp, i); else if ( size == 2 ) val = (int)*SHORTP(cp, i);
...@@ -403,10 +418,8 @@ audioop_rms(PyObject *self, PyObject *args) ...@@ -403,10 +418,8 @@ audioop_rms(PyObject *self, PyObject *args)
if ( !PyArg_ParseTuple(args, "s#i:rms", &cp, &len, &size) ) if ( !PyArg_ParseTuple(args, "s#i:rms", &cp, &len, &size) )
return 0; return 0;
if ( size != 1 && size != 2 && size != 4 ) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
for ( i=0; i<len; i+= size) { for ( i=0; i<len; i+= size) {
if ( size == 1 ) val = (int)*CHARP(cp, i); if ( size == 1 ) val = (int)*CHARP(cp, i);
else if ( size == 2 ) val = (int)*SHORTP(cp, i); else if ( size == 2 ) val = (int)*SHORTP(cp, i);
...@@ -612,10 +625,8 @@ audioop_avgpp(PyObject *self, PyObject *args) ...@@ -612,10 +625,8 @@ audioop_avgpp(PyObject *self, PyObject *args)
if ( !PyArg_ParseTuple(args, "s#i:avgpp", &cp, &len, &size) ) if ( !PyArg_ParseTuple(args, "s#i:avgpp", &cp, &len, &size) )
return 0; return 0;
if ( size != 1 && size != 2 && size != 4 ) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
/* Compute first delta value ahead. Also automatically makes us /* Compute first delta value ahead. Also automatically makes us
** skip the first extreme value ** skip the first extreme value
*/ */
...@@ -669,10 +680,8 @@ audioop_maxpp(PyObject *self, PyObject *args) ...@@ -669,10 +680,8 @@ audioop_maxpp(PyObject *self, PyObject *args)
if ( !PyArg_ParseTuple(args, "s#i:maxpp", &cp, &len, &size) ) if ( !PyArg_ParseTuple(args, "s#i:maxpp", &cp, &len, &size) )
return 0; return 0;
if ( size != 1 && size != 2 && size != 4 ) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
/* Compute first delta value ahead. Also automatically makes us /* Compute first delta value ahead. Also automatically makes us
** skip the first extreme value ** skip the first extreme value
*/ */
...@@ -720,10 +729,8 @@ audioop_cross(PyObject *self, PyObject *args) ...@@ -720,10 +729,8 @@ audioop_cross(PyObject *self, PyObject *args)
if ( !PyArg_ParseTuple(args, "s#i:cross", &cp, &len, &size) ) if ( !PyArg_ParseTuple(args, "s#i:cross", &cp, &len, &size) )
return 0; return 0;
if ( size != 1 && size != 2 && size != 4 ) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
ncross = -1; ncross = -1;
prevval = 17; /* Anything <> 0,1 */ prevval = 17; /* Anything <> 0,1 */
for ( i=0; i<len; i+= size) { for ( i=0; i<len; i+= size) {
...@@ -748,6 +755,8 @@ audioop_mul(PyObject *self, PyObject *args) ...@@ -748,6 +755,8 @@ audioop_mul(PyObject *self, PyObject *args)
if ( !PyArg_ParseTuple(args, "s#id:mul", &cp, &len, &size, &factor ) ) if ( !PyArg_ParseTuple(args, "s#id:mul", &cp, &len, &size, &factor ) )
return 0; return 0;
if (!audioop_check_parameters(len, size))
return NULL;
if ( size == 1 ) maxval = (double) 0x7f; if ( size == 1 ) maxval = (double) 0x7f;
else if ( size == 2 ) maxval = (double) 0x7fff; else if ( size == 2 ) maxval = (double) 0x7fff;
...@@ -790,6 +799,12 @@ audioop_tomono(PyObject *self, PyObject *args) ...@@ -790,6 +799,12 @@ audioop_tomono(PyObject *self, PyObject *args)
if ( !PyArg_ParseTuple(args, "s#idd:tomono", if ( !PyArg_ParseTuple(args, "s#idd:tomono",
&cp, &len, &size, &fac1, &fac2 ) ) &cp, &len, &size, &fac1, &fac2 ) )
return 0; return 0;
if (!audioop_check_parameters(len, size))
return NULL;
if (((len / size) & 1) != 0) {
PyErr_SetString(AudioopError, "not a whole number of frames");
return NULL;
}
if ( size == 1 ) maxval = (double) 0x7f; if ( size == 1 ) maxval = (double) 0x7f;
else if ( size == 2 ) maxval = (double) 0x7fff; else if ( size == 2 ) maxval = (double) 0x7fff;
...@@ -835,6 +850,8 @@ audioop_tostereo(PyObject *self, PyObject *args) ...@@ -835,6 +850,8 @@ audioop_tostereo(PyObject *self, PyObject *args)
if ( !PyArg_ParseTuple(args, "s#idd:tostereo", if ( !PyArg_ParseTuple(args, "s#idd:tostereo",
&cp, &len, &size, &fac1, &fac2 ) ) &cp, &len, &size, &fac1, &fac2 ) )
return 0; return 0;
if (!audioop_check_parameters(len, size))
return NULL;
if ( size == 1 ) maxval = (double) 0x7f; if ( size == 1 ) maxval = (double) 0x7f;
else if ( size == 2 ) maxval = (double) 0x7fff; else if ( size == 2 ) maxval = (double) 0x7fff;
...@@ -893,7 +910,8 @@ audioop_add(PyObject *self, PyObject *args) ...@@ -893,7 +910,8 @@ audioop_add(PyObject *self, PyObject *args)
if ( !PyArg_ParseTuple(args, "s#s#i:add", if ( !PyArg_ParseTuple(args, "s#s#i:add",
&cp1, &len1, &cp2, &len2, &size ) ) &cp1, &len1, &cp2, &len2, &size ) )
return 0; return 0;
if (!audioop_check_parameters(len1, size))
return NULL;
if ( len1 != len2 ) { if ( len1 != len2 ) {
PyErr_SetString(AudioopError, "Lengths should be the same"); PyErr_SetString(AudioopError, "Lengths should be the same");
return 0; return 0;
...@@ -948,10 +966,8 @@ audioop_bias(PyObject *self, PyObject *args) ...@@ -948,10 +966,8 @@ audioop_bias(PyObject *self, PyObject *args)
&cp, &len, &size , &bias) ) &cp, &len, &size , &bias) )
return 0; return 0;
if ( size != 1 && size != 2 && size != 4) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
rv = PyString_FromStringAndSize(NULL, len); rv = PyString_FromStringAndSize(NULL, len);
if ( rv == 0 ) if ( rv == 0 )
...@@ -984,10 +1000,8 @@ audioop_reverse(PyObject *self, PyObject *args) ...@@ -984,10 +1000,8 @@ audioop_reverse(PyObject *self, PyObject *args)
&cp, &len, &size) ) &cp, &len, &size) )
return 0; return 0;
if ( size != 1 && size != 2 && size != 4 ) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
rv = PyString_FromStringAndSize(NULL, len); rv = PyString_FromStringAndSize(NULL, len);
if ( rv == 0 ) if ( rv == 0 )
...@@ -1021,11 +1035,10 @@ audioop_lin2lin(PyObject *self, PyObject *args) ...@@ -1021,11 +1035,10 @@ audioop_lin2lin(PyObject *self, PyObject *args)
&cp, &len, &size, &size2) ) &cp, &len, &size, &size2) )
return 0; return 0;
if ( (size != 1 && size != 2 && size != 4) || if (!audioop_check_parameters(len, size))
(size2 != 1 && size2 != 2 && size2 != 4)) { return NULL;
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); if (!audioop_check_size(size2))
return 0; return NULL;
}
if (len/size > INT_MAX/size2) { if (len/size > INT_MAX/size2) {
PyErr_SetString(PyExc_MemoryError, PyErr_SetString(PyExc_MemoryError,
...@@ -1075,10 +1088,8 @@ audioop_ratecv(PyObject *self, PyObject *args) ...@@ -1075,10 +1088,8 @@ audioop_ratecv(PyObject *self, PyObject *args)
&nchannels, &inrate, &outrate, &state, &nchannels, &inrate, &outrate, &state,
&weightA, &weightB)) &weightA, &weightB))
return NULL; return NULL;
if (size != 1 && size != 2 && size != 4) { if (!audioop_check_size(size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4");
return NULL; return NULL;
}
if (nchannels < 1) { if (nchannels < 1) {
PyErr_SetString(AudioopError, "# of channels should be >= 1"); PyErr_SetString(AudioopError, "# of channels should be >= 1");
return NULL; return NULL;
...@@ -1255,10 +1266,8 @@ audioop_lin2ulaw(PyObject *self, PyObject *args) ...@@ -1255,10 +1266,8 @@ audioop_lin2ulaw(PyObject *self, PyObject *args)
&cp, &len, &size) ) &cp, &len, &size) )
return 0 ; return 0 ;
if ( size != 1 && size != 2 && size != 4) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
rv = PyString_FromStringAndSize(NULL, len/size); rv = PyString_FromStringAndSize(NULL, len/size);
if ( rv == 0 ) if ( rv == 0 )
...@@ -1289,10 +1298,8 @@ audioop_ulaw2lin(PyObject *self, PyObject *args) ...@@ -1289,10 +1298,8 @@ audioop_ulaw2lin(PyObject *self, PyObject *args)
&cp, &len, &size) ) &cp, &len, &size) )
return 0; return 0;
if ( size != 1 && size != 2 && size != 4) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
if (len > INT_MAX/size) { if (len > INT_MAX/size) {
PyErr_SetString(PyExc_MemoryError, PyErr_SetString(PyExc_MemoryError,
...@@ -1328,10 +1335,8 @@ audioop_lin2alaw(PyObject *self, PyObject *args) ...@@ -1328,10 +1335,8 @@ audioop_lin2alaw(PyObject *self, PyObject *args)
&cp, &len, &size) ) &cp, &len, &size) )
return 0; return 0;
if ( size != 1 && size != 2 && size != 4) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
rv = PyString_FromStringAndSize(NULL, len/size); rv = PyString_FromStringAndSize(NULL, len/size);
if ( rv == 0 ) if ( rv == 0 )
...@@ -1362,10 +1367,8 @@ audioop_alaw2lin(PyObject *self, PyObject *args) ...@@ -1362,10 +1367,8 @@ audioop_alaw2lin(PyObject *self, PyObject *args)
&cp, &len, &size) ) &cp, &len, &size) )
return 0; return 0;
if ( size != 1 && size != 2 && size != 4) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
if (len > INT_MAX/size) { if (len > INT_MAX/size) {
PyErr_SetString(PyExc_MemoryError, PyErr_SetString(PyExc_MemoryError,
...@@ -1402,11 +1405,8 @@ audioop_lin2adpcm(PyObject *self, PyObject *args) ...@@ -1402,11 +1405,8 @@ audioop_lin2adpcm(PyObject *self, PyObject *args)
&cp, &len, &size, &state) ) &cp, &len, &size, &state) )
return 0; return 0;
if (!audioop_check_parameters(len, size))
if ( size != 1 && size != 2 && size != 4) { return NULL;
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4");
return 0;
}
str = PyString_FromStringAndSize(NULL, len/(size*2)); str = PyString_FromStringAndSize(NULL, len/(size*2));
if ( str == 0 ) if ( str == 0 )
...@@ -1509,10 +1509,8 @@ audioop_adpcm2lin(PyObject *self, PyObject *args) ...@@ -1509,10 +1509,8 @@ audioop_adpcm2lin(PyObject *self, PyObject *args)
&cp, &len, &size, &state) ) &cp, &len, &size, &state) )
return 0; return 0;
if ( size != 1 && size != 2 && size != 4) { if (!audioop_check_parameters(len, size))
PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); return NULL;
return 0;
}
/* Decode state, should have (value, step) */ /* Decode state, should have (value, step) */
if ( state == Py_None ) { if ( state == Py_None ) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7