diff --git a/Misc/NEWS b/Misc/NEWS index c9b3b9c6527..3aea1f331bf 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -15,6 +15,9 @@ Library - Issue #8674: Fixed a number of incorrect or undefined-behaviour-inducing overflow checks in the audioop module (CVE-2010-1634). +- Issue #7673: Fix security vulnerability (CVE-2010-2089) in the audioop + module, ensure that the input string length is a multiple of the frame size. + What's New in Python 2.5.5? =========================== diff --git a/Modules/audioop.c b/Modules/audioop.c index 12c47671dd1..35c2b437e08 100644 --- a/Modules/audioop.c +++ b/Modules/audioop.c @@ -295,6 +295,29 @@ static int stepsizeTable[89] = { static PyObject *AudioopError; +static int +audioop_check_size(int size) +{ + if (size != 1 && size != 2 && size != 4) { + PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); + return 0; + } + else + return 1; +} + +static int +audioop_check_parameters(int len, int size) +{ + if (!audioop_check_size(size)) + return 0; + if (len % size != 0) { + PyErr_SetString(AudioopError, "not a whole number of frames"); + return 0; + } + return 1; +} + static PyObject * audioop_getsample(PyObject *self, PyObject *args) { @@ -304,10 +327,8 @@ audioop_getsample(PyObject *self, PyObject *args) if ( !PyArg_ParseTuple(args, "s#ii:getsample", &cp, &len, &size, &i) ) return 0; - if ( size != 1 && size != 2 && size != 4 ) { - PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); - return 0; - } + if (!audioop_check_parameters(len, size)) + return NULL; if ( i < 0 || i >= len/size ) { PyErr_SetString(AudioopError, "Index out of range"); return 0; @@ -328,10 +349,8 @@ audioop_max(PyObject *self, PyObject *args) if ( !PyArg_ParseTuple(args, "s#i:max", &cp, &len, &size) ) return 0; - if ( size != 1 && size != 2 && size != 4 ) { - PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); - return 0; - } + if (!audioop_check_parameters(len, size)) + return NULL; for ( i=0; i 0,1 */ for ( i=0; i INT_MAX/size2) { PyErr_SetString(PyExc_MemoryError, @@ -1072,10 +1085,8 @@ audioop_ratecv(PyObject *self, PyObject *args) &nchannels, &inrate, &outrate, &state, &weightA, &weightB)) return NULL; - if (size != 1 && size != 2 && size != 4) { - PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); + if (!audioop_check_size(size)) return NULL; - } if (nchannels < 1) { PyErr_SetString(AudioopError, "# of channels should be >= 1"); return NULL; @@ -1252,10 +1263,8 @@ audioop_lin2ulaw(PyObject *self, PyObject *args) &cp, &len, &size) ) return 0 ; - if ( size != 1 && size != 2 && size != 4) { - PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); - return 0; - } + if (!audioop_check_parameters(len, size)) + return NULL; rv = PyString_FromStringAndSize(NULL, len/size); if ( rv == 0 ) @@ -1286,10 +1295,8 @@ audioop_ulaw2lin(PyObject *self, PyObject *args) &cp, &len, &size) ) return 0; - if ( size != 1 && size != 2 && size != 4) { - PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); - return 0; - } + if (!audioop_check_parameters(len, size)) + return NULL; if (len > INT_MAX/size) { PyErr_SetString(PyExc_MemoryError, @@ -1325,10 +1332,8 @@ audioop_lin2alaw(PyObject *self, PyObject *args) &cp, &len, &size) ) return 0; - if ( size != 1 && size != 2 && size != 4) { - PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); - return 0; - } + if (!audioop_check_parameters(len, size)) + return NULL; rv = PyString_FromStringAndSize(NULL, len/size); if ( rv == 0 ) @@ -1359,10 +1364,8 @@ audioop_alaw2lin(PyObject *self, PyObject *args) &cp, &len, &size) ) return 0; - if ( size != 1 && size != 2 && size != 4) { - PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); - return 0; - } + if (!audioop_check_parameters(len, size)) + return NULL; if (len > INT_MAX/size) { PyErr_SetString(PyExc_MemoryError, @@ -1399,12 +1402,9 @@ audioop_lin2adpcm(PyObject *self, PyObject *args) &cp, &len, &size, &state) ) return 0; + if (!audioop_check_parameters(len, size)) + return NULL; - if ( size != 1 && size != 2 && size != 4) { - PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); - return 0; - } - str = PyString_FromStringAndSize(NULL, len/(size*2)); if ( str == 0 ) return 0; @@ -1507,10 +1507,8 @@ audioop_adpcm2lin(PyObject *self, PyObject *args) &cp, &len, &size, &state) ) return 0; - if ( size != 1 && size != 2 && size != 4) { - PyErr_SetString(AudioopError, "Size should be 1, 2 or 4"); - return 0; - } + if (!audioop_check_parameters(len, size)) + return NULL; /* Decode state, should have (value, step) */ if ( state == Py_None ) {