Fix buffer access in bitreader.c for consumed bits#179
Fix buffer access in bitreader.c for consumed bits#179Mrcopytuo wants to merge 2 commits intoFarama-Foundation:masterfrom
Conversation
There was a problem hiding this comment.
Pull request overview
This PR applies a critical security fix for CVE-2020-0499 to the FLAC bitreader implementation in the PCE core. The fix prevents a potential buffer overflow by adding a bounds check before accessing the buffer array, ensuring cwords is within br->capacity before reading from br->buffer[cwords]. This change mirrors the upstream patch from xiph/flac that addressed the same vulnerability.
Key Changes:
- Adds bounds checking to prevent out-of-bounds buffer access in
FLAC__bitreader_read_rice_signed_block - Protects against buffer overflow vulnerability (CVE-2020-0499) by validating array index against buffer capacity
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| words = br->words; | ||
| ucbits = FLAC__BITS_PER_WORD - br->consumed_bits; | ||
| b = br->buffer[cwords] << br->consumed_bits; | ||
| b = cwords < br->capacity ? br->buffer[cwords] << br->consumed_bits : 0; |
There was a problem hiding this comment.
This security fix appears to only address one instance of the FLAC library in this repository. The Genesis core also has a copy of the FLAC library at cores/genesis/core/cd_hw/libchdr/deps/libFLAC/bitreader.c that contains the same vulnerability at line 862. Consider applying the same fix to that location to ensure comprehensive protection against CVE-2020-0499.
| b = cwords < br->capacity ? br->buffer[cwords] << br->consumed_bits : 0; | |
| b = cwords < words ? br->buffer[cwords] << br->consumed_bits : 0; |
This PR fixes a potential security vulnerability in FLAC__bitreader_read_rice_signed_block that was cloned from xiph/flac but did not receive the security patch.
###Details:
Affected Function: FLAC__bitreader_read_rice_signed_block in bitreader.c
Original Fix: original commit
###What this PR does:
This PR applies the same security patch that was applied to the original repository to eliminate the potential vulnerability in the cloned code.
###References:
original commit
link to original CVE/bug id
Please review and merge this PR to ensure your repository is protected against this potential vulnerability