Bug 762154 (CVE-2020-35738)

Summary:	<media-sound/wavpack-5.3.2-r1: Out of bounds write (CVE-2020-35738)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	fordfrog, sound
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/dbry/WavPack/issues/91
Whiteboard:	B3 [noglsa]
Package list:		Runtime testing required:	---

Description Sam James archtester

2020-12-28 04:51:09 UTC

Description:
"WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument."

NOTE: the CVE text is misleading; this is still unfixed upstream and affects master too.

Comment 1 Larry the Git Cow gentoo-dev

2021-01-02 11:53:27 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=22ab7121945950659d4325be712f786164699a6c

commit 22ab7121945950659d4325be712f786164699a6c
Author:     Miroslav Šulc <fordfrog@gentoo.org>
AuthorDate: 2021-01-02 11:53:18 +0000
Commit:     Miroslav Šulc <fordfrog@gentoo.org>
CommitDate: 2021-01-02 11:53:24 +0000

    media-sound/wavpack: fixed out of bound write
    
    Bug: https://bugs.gentoo.org/762154
    Package-Manager: Portage-3.0.12, Repoman-3.0.2
    Signed-off-by: Miroslav Šulc <fordfrog@gentoo.org>

 .../files/wavpack-5.3.2-fix-overflows.patch        | 52 ++++++++++++++++++++++
 ...avpack-5.3.2.ebuild => wavpack-5.3.2-r1.ebuild} |  6 ++-
 2 files changed, 57 insertions(+), 1 deletion(-)

Comment 2 Miroslav Šulc gentoo-dev

2021-01-02 11:54:57 UTC

tested

wavpack-5.3.2:
$ wavpack -y crash.wav

 WAVPACK  Hybrid Lossless Audio Compressor  Linux Version 5.3.2
 Copyright (c) 1998 - 2020 David Bryant.  All Rights Reserved.

creating crash.wv,Neoprávněný přístup do paměti (SIGSEGV)

wavpack-5.3.2-r1:
$ wavpack -y crash.wav

 WAVPACK  Hybrid Lossless Audio Compressor  Linux Version 5.3.2
 Copyright (c) 1998 - 2020 David Bryant.  All Rights Reserved.

created crash.wv in 0.01 secs (lossless, 58.10%)

Comment 3 John Helmert III archtester

2021-01-03 06:27:27 UTC

Thank you!

Comment 4 Miroslav Šulc gentoo-dev

2021-04-29 07:58:56 UTC

ping

Comment 5 Thomas Deutschmann (RETIRED) gentoo-dev

2021-05-01 17:10:26 UTC

GLSA Vote: No

Repository is clean, all done.