Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Signed integer overflow in src/mat4.c:323 #789

Closed
shao-hua-li opened this issue Nov 14, 2021 · 3 comments
Closed

Signed integer overflow in src/mat4.c:323 #789

shao-hua-li opened this issue Nov 14, 2021 · 3 comments
Labels
Bug Something isn't working

Comments

@shao-hua-li
Copy link
Contributor

shao-hua-li commented Nov 14, 2021 •
edited
Loading

Hi there,

I found an undefined behavior in src/mat4.c:323, which is a signed integer overflow.

  • libsndfile version: commit c7b69d7
  • Compile args: CFLAGS='-fsanitize=undefined' ./configure --disable-shared && make
  • Compiler: clang13
  • Platform: Ubuntu 20.04.2 LTS, x86_64
  • Reproduce: ./programs/sndfile-metadata-get mat4.c_int_overflow
  • POC: mat4.c_int_overflow.tar.gz

Undefined Behavior Sanitizer report:

src/mat4.c:323:41: runtime error: signed integer overflow: 205 * -100663296 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:41 in
src/mat4.c:323:48: runtime error: signed integer overflow: 838860800 * 4 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:48 in

A possible quick fix is to add explicit type casting in mat4.c:323, like psf->dataend = psf->dataoffset + (long)rows * cols * psf->bytewidth ;

Another consequence of this bug is for clang -O1 and clang -O2, the frame filed in outputs would be different.
@evpobr evpobr added the Bug Something isn't working label Nov 16, 2021
@arthurt
Copy link
Member

arthurt commented Jan 28, 2022 •
edited
Loading

mat4.c

	int		rows, cols, imag ;
...
		psf->dataend = psf->dataoffset + rows * cols * psf->bytewidth ;

So clang is complaining that the result of rows * cols overflows a 32-bit int. (Rows and cols are read from the file, and are stored as 32-bit there.)

psf->dataend is a sf_count_t, so 64-bits. A change of bracketing, or casting rows and cols each to (sf_count_t) before the multiplication would fix this.

@evpobr evpobr mentioned this issue May 2, 2022
Closed
@rfrohl
Copy link

rfrohl commented Jul 19, 2023

FTR: someone assigned a CVE to this bug report: CVE-2022-33065

@stiepan
Copy link

stiepan commented Aug 9, 2023

Hi,
Are there any plans/timeline to address this issue and the CVE-2022-33065 vulnerability?

amstewart added a commit to amstewart/libsndfile that referenced this issue Oct 17, 2023
@amstewart
mat4/mat5: fix int overflow in dataend calculation
85515d8 
The clang sanitizer warns of a possible signed integer overflow when
calculating the `dataend` value in `mat4_read_header()`.

```
src/mat4.c:323:41: runtime error: signed integer overflow: 205 * -100663296 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:41 in
src/mat4.c:323:48: runtime error: signed integer overflow: 838860800 * 4 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:48 in
```

Cast the offending `rows` and `cols` ints to `st_count_t` (the type of
`dataend` before performing the calculation, to avoid the issue.

CVE: CVE-2022-33065
Fixes: libsndfile#789
Fixes: libsndfile#833

Signed-off-by: Alex Stewart <alex.stewart@ni.com>
@amstewart amstewart mentioned this issue Oct 17, 2023
Merged
3 tasks
amstewart added a commit to amstewart/libsndfile that referenced this issue Oct 19, 2023
@amstewart
mat4/mat5: fix int overflow in dataend calculation
57ad7b6 
The clang sanitizer warns of a possible signed integer overflow when
calculating the `dataend` value in `mat4_read_header()`.

```
src/mat4.c:323:41: runtime error: signed integer overflow: 205 * -100663296 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:41 in
src/mat4.c:323:48: runtime error: signed integer overflow: 838860800 * 4 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:48 in
```

Cast the offending `rows` and `cols` ints to `sf_count_t` (the type of
`dataend` before performing the calculation, to avoid the issue.

CVE: CVE-2022-33065
Fixes: libsndfile#789
Fixes: libsndfile#833

Signed-off-by: Alex Stewart <alex.stewart@ni.com>
@evpobr evpobr closed this as completed in 0754562 Oct 20, 2023
jpautler pushed a commit to jpautler/libsndfile that referenced this issue Nov 28, 2023
@amstewart @jpautler
mat4/mat5: fix int overflow in dataend calculation
4538e81 
The clang sanitizer warns of a possible signed integer overflow when
calculating the `dataend` value in `mat4_read_header()`.

```
src/mat4.c:323:41: runtime error: signed integer overflow: 205 * -100663296 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:41 in
src/mat4.c:323:48: runtime error: signed integer overflow: 838860800 * 4 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:48 in
```

Cast the offending `rows` and `cols` ints to `sf_count_t` (the type of
`dataend` before performing the calculation, to avoid the issue.

CVE: CVE-2022-33065
Fixes: libsndfile#789
Fixes: libsndfile#833

Upstream-Status: Backport [9a82911]

Signed-off-by: Alex Stewart <alex.stewart@ni.com>
jpautler pushed a commit to jpautler/libsndfile that referenced this issue Nov 29, 2023
@amstewart @jpautler
mat4/mat5: fix int overflow in dataend calculation
7bf4881 
The clang sanitizer warns of a possible signed integer overflow when
calculating the `dataend` value in `mat4_read_header()`.

```
src/mat4.c:323:41: runtime error: signed integer overflow: 205 * -100663296 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:41 in
src/mat4.c:323:48: runtime error: signed integer overflow: 838860800 * 4 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/mat4.c:323:48 in
```

Cast the offending `rows` and `cols` ints to `sf_count_t` (the type of
`dataend` before performing the calculation, to avoid the issue.

CVE: CVE-2022-33065
Fixes: libsndfile#789
Fixes: libsndfile#833

Upstream-Status: Backport [9a82911]

Signed-off-by: Alex Stewart <alex.stewart@ni.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@arthurt @rfrohl @shao-hua-li @evpobr @stiepan