mirror of
https://github.com/asterisk/asterisk
synced 2026-08-07 10:32:13 -04:00
The ogg_speex_read() function copies OGG packet data via memcpy() without validating the packet size against the destination buffer (BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG audio packet causes a heap buffer overflow that corrupts the adjacent speex_desc structure containing libogg heap pointers, leading to a crash (SIGSEGV) on playback. Add a bounds check for both negative and oversized values before the memcpy, consistent with how format_ogg_vorbis bounds its reads via ov_read(). Resolves: #GHSA-8jhw-m2hg-vp3h |
||
|---|---|---|
| .. | ||
| format_g719.c | ||
| format_g723.c | ||
| format_g726.c | ||
| format_g729.c | ||
| format_gsm.c | ||
| format_h263.c | ||
| format_h264.c | ||
| format_ilbc.c | ||
| format_ogg_speex.c | ||
| format_ogg_vorbis.c | ||
| format_pcm.c | ||
| format_siren7.c | ||
| format_siren14.c | ||
| format_sln.c | ||
| format_vox.c | ||
| format_wav.c | ||
| format_wav_gsm.c | ||
| Makefile | ||
| msgsm.h | ||