Bug 142387 – media-libs/dumb - buffer overflow (CVE-2006-3668)

• Product: Gentoo Security
• Status: VERIFIED FIXED

[Description Carsten Lohrke (RETIRED) 2006-08-01 02:07:36 UTC]

it_read_envelope is the function called by it_read_instrument for
reading the envelope values for volume, pan and pitch of each
instrument in the IT (Impulse Tracker) file if it's major or equal than
version 0x200.

The function reads an 8 bit value (envelope->n_nodes) which describes
the number of nodes in the envelope and then starts to read them using
8 bit for node_y and 16 for node_t.

The problem is that both node_y and moreover node_t have a fixed size of
25 elements allocated when the number of instruments in the IT file is
read initially.

The memory allocated is that of the IT_INSTRUMENT structure which
already contains the three IT_ENVELOPE structures used for volume, pan
and pitch.

The amount of data needed to overflow the allocated memory is about 371
bytes, from the end of pitch_envelope to the end of map_sample, which
means we need to specify at least about 213 n_nodes for causing the
heap overflow.


http://aluigi.altervista.org/adv/dumbit-adv.txt

[Comment 1 Christian Birchinger (RETIRED) 2006-08-02 15:50:55 UTC]

Anyone with good C knowledge knows a quick fix? The security report has no patch
or url for it, and i'm not capable of fixing it i think.

[Comment 2 Carsten Lohrke (RETIRED) 2006-08-02 18:17:53 UTC]

You can grab the patch from the corresponding Debian diff.

http://ftp.debian.org/debian/pool/main/libd/libdumb/libdumb_0.9.3-5.diff.gz

[Comment 3 Christian Birchinger (RETIRED) 2006-08-03 08:51:24 UTC]

I've just commited dumb-0.9.3-r1 to CVS which includes the debian patch
for this problem.

There are problems with older versions and aldumb (allegro version) though.
aldumb needs some kind of fix too and maybe a bump to 0.9.3.
Problem is like with non-allegro dumb that some games only work with older
versions. Those game maintainers need to be contacted and asked what solution
they would want.

[Comment 4 Christian Birchinger (RETIRED) 2006-08-03 08:56:15 UTC]

The game i know about is: games-strategy/ufo2000

[Comment 5 Stefan Cornelius (RETIRED) 2006-08-03 09:31:23 UTC]

Arches: please test and stable dumb-0.9.3-r1, thanks


Games: please comment on comment #3

[Comment 6 Tobias Scherbaum (RETIRED) 2006-08-03 11:18:15 UTC]

ppc stable

[Comment 7 Christian Faulhammer (RETIRED) 2006-08-03 12:29:01 UTC]

1) emerges fine
2) passes collision test
3) aldumb emerges fine on it, on wich raptor2 emerges fine and is playable

Portage 2.1-r1 (default-linux/x86/2006.0, gcc-3.4.6, glibc-2.3.6-r4, 2.6.17-gentoo-r4 i686)
=================================================================
System uname: 2.6.17-gentoo-r4 i686 AMD Athlon(tm) XP 2500+
Gentoo Base System version 1.6.15
app-admin/eselect-compiler: [Not Present]
dev-lang/python:     2.4.3-r1
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     [Not Present]
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r3
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/splash /etc/terminfo"
CXXFLAGS="-O2"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig ccache collision-protect distlocks metadata-transfer parallel-fetch sandbox sfperms strict test"
GENTOO_MIRRORS="ftp://sunsite.informatik.rwth-aachen.de/pub/Linux/gentoo/"
LANG="de_DE@euro"
LC_ALL="de_DE@euro"
LINGUAS="de"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.informatik.rwth-aachen.de/gentoo-portage"
USE="x86 3dnow 3dnowext X Xaw3d a52 alsa arts artworkextra asf audiofile avi bash-completion beagle berkdb bidi bitmap-fonts bootsplash branding bzip2 cairo cdda cddb cdparanoia cdr cli cracklib crypt css cups curl custom-cflags dbus dga directfb divx4linux dlloader dri dts dvd dvdr dvdread dvi eds emacs emboss encode esd evo exif expat fam fat fbcon fdftk ffmpeg firefox foomaticdb fortran ftp gb gcj gdbm gif gnome gpm gstreamer gtk gtk2 gtkhtml hal icq idn imagemagick imap imlib ipv6 isdnlog java javascript jikes jpeg jpeg2k ldap leim libg++ libwww lm_sensors mad maildir matroska mbox mikmod mime mmx mmxext mng mono motif mp3 mpeg mpeg2 mule nautilus ncurses nforce2 nls nocardbus nptl nptlonly nsplugin nvidia objc ogg opengl pam pcre pdf pdflib perl plotutils pmu png ppds pppd preview-latex print python qt qt3 qt4 quicktime readline reflection reiserfs samba sdk session slang spell spl sse ssl svg svga t1lib tcltk tcpd theora thunderbird tiff truetype truetype-fonts type1-fonts udev usb vcd videos vorbis win32codecs wmf wxwindows xine xml xorg xosd xv xvid zlib elibc_glibc input_devices_mouse input_devices_keyboard kernel_linux linguas_de userland_GNU video_cards_radeon video_cards_vesa video_cards_fbdev"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS

[Comment 8 Thomas Cort (RETIRED) 2006-08-06 12:28:00 UTC]

alpha stable.

[Comment 9 Jason Wever (RETIRED) 2006-08-06 12:29:00 UTC]

It's just another SPARCin' Sunday...

[Comment 10 Simon Stelling (RETIRED) 2006-08-06 12:40:09 UTC]

amd64 stable

[Comment 11 Andrej Kacian (RETIRED) 2006-08-06 14:39:08 UTC]

x86 stable. Thanks for testing, Christian!

[Comment 12 Raphael Marichez (Falco) (RETIRED) 2006-08-09 03:22:39 UTC]

GLSA-200608-14. thanks to all.

ia64, feel free to stabilize in order to benefit from the GLSA.

[Comment 13 Raphael Marichez (Falco) (RETIRED) 2006-08-09 03:23:27 UTC]

 You have to specify a comment on this change. Please explain your change.

[Comment 14 Wolf Giesen (RETIRED) 2006-08-09 03:32:18 UTC]

/me pats Falco

[Comment 15 Peter Volkov (RETIRED) 2008-03-06 09:41:17 UTC]

Does not affect current (2008.0) release. Removing release.