Headline
CVE-2022-47021: Propagate allocation failure from ogg_sync_buffer. · xiph/opusfile@0a4cd79
A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.
Permalink
Browse files
Propagate allocation failure from ogg_sync_buffer.
Instead of segfault, report OP_EFAULT if ogg_sync_buffer returns a null pointer. This allows more graceful recovery by the caller in the unlikely event of a fallible ogg_malloc call.
We do check the return value elsewhere in the code, so the new checks make the code more consistent.
Thanks to #36 for reporting.
Signed-off-by: Timothy B. Terriberry [email protected] Signed-off-by: Mark Harris [email protected]
- Loading branch information
Related news
Ubuntu Security Notice 5937-1 - It was discovered that Opusfile was not properly validating pointer arguments in some of its functions, which could lead to a NULL pointer dereference. An attacker could possibly use this issue to cause a denial of service or have other unspecified impacts.