asterisk/formats
Milan Kyselica 1cf1895499 format_ogg_speex: Add bounds check to prevent heap buffer overflow
The ogg_speex_read() function copies OGG packet data via memcpy()
without validating the packet size against the destination buffer
(BUF_SIZE = 200 bytes). A crafted .spx file with an oversized OGG
audio packet causes a heap buffer overflow that corrupts the
adjacent speex_desc structure containing libogg heap pointers,
leading to a crash (SIGSEGV) on playback.

Add a bounds check for both negative and oversized values before
the memcpy, consistent with how format_ogg_vorbis bounds its reads
via ov_read().

Resolves: #GHSA-8jhw-m2hg-vp3h
2026-06-25 08:21:09 -06:00
..
format_g719.c Remove as much trailing whitespace as possible. 2017-12-22 09:23:22 -05:00
format_g723.c Remove as much trailing whitespace as possible. 2017-12-22 09:23:22 -05:00
format_g726.c various files - fix some alerts raised by lgtm code analysis 2019-11-18 08:30:45 -06:00
format_g729.c Remove as much trailing whitespace as possible. 2017-12-22 09:23:22 -05:00
format_gsm.c format_gsm.c: Added mime type 2024-12-10 13:25:08 +00:00
format_h263.c Remove as much trailing whitespace as possible. 2017-12-22 09:23:22 -05:00
format_h264.c Remove as much trailing whitespace as possible. 2017-12-22 09:23:22 -05:00
format_ilbc.c Remove as much trailing whitespace as possible. 2017-12-22 09:23:22 -05:00
format_ogg_speex.c format_ogg_speex: Add bounds check to prevent heap buffer overflow 2026-06-25 08:21:09 -06:00
format_ogg_vorbis.c formats: Spelling fixes 2021-11-16 06:01:45 -06:00
format_pcm.c Add the ability to read the media file type from HTTP header for playback 2018-04-30 16:30:44 -04:00
format_siren7.c Remove as much trailing whitespace as possible. 2017-12-22 09:23:22 -05:00
format_siren14.c Remove as much trailing whitespace as possible. 2017-12-22 09:23:22 -05:00
format_sln.c format_sln: add .slin as supported file extension 2023-03-16 12:47:34 -06:00
format_vox.c Add the ability to read the media file type from HTTP header for playback 2018-04-30 16:30:44 -04:00
format_wav.c format_wav: replace ast_log(LOG_DEBUG, ...) by ast_debug(1, ...) 2023-01-10 13:33:11 -06:00
format_wav_gsm.c Remove as much trailing whitespace as possible. 2017-12-22 09:23:22 -05:00
Makefile Remove as much trailing whitespace as possible. 2017-12-22 09:23:22 -05:00
msgsm.h various files - fix some alerts raised by lgtm code analysis 2019-11-18 08:30:45 -06:00