Issue #13806: The size check in audioop decompression functions was too strict and...

Patch by Oleg Plakhotnyuk.

diff --git a/Lib/test/test_audioop.py b/Lib/test/test_audioop.py
index 308c3e314b51934b5efc273b45a59eeb86fc16c6..ff60a7d93fb6aa68c678ceac14d91408b796f7ed 100644 (file)
--- a/Lib/test/test_audioop.py
+++ b/Lib/test/test_audioop.py
@@ -21,9 +21,9 @@ def gendata4():
 data = [gendata1(), gendata2(), gendata4()]
 
 INVALID_DATA = [
-    ('abc', 0),
-    ('abc', 2),
-    ('abc', 4),
+    (b'abc', 0),
+    (b'abc', 2),
+    (b'abc', 4),
 ]
 
 
@@ -94,7 +94,9 @@ class TestAudioop(unittest.TestCase):
 
     def test_adpcm2lin(self):
         # Very cursory test
-        self.assertEqual(audioop.adpcm2lin(b'\0\0', 1, None), (b'\0\0\0\0', (0,0)))
+        self.assertEqual(audioop.adpcm2lin(b'\0\0', 1, None), (b'\0' * 4, (0,0)))
+        self.assertEqual(audioop.adpcm2lin(b'\0\0', 2, None), (b'\0' * 8, (0,0)))
+        self.assertEqual(audioop.adpcm2lin(b'\0\0', 4, None), (b'\0' * 16, (0,0)))
 
     def test_lin2adpcm(self):
         # Very cursory test
@@ -109,6 +111,9 @@ class TestAudioop(unittest.TestCase):
         # Cursory
         d = audioop.lin2alaw(data[0], 1)
         self.assertEqual(audioop.alaw2lin(d, 1), data[0])
+        self.assertEqual(audioop.alaw2lin(d, 2), b'\x08\x00\x08\x01\x10\x02')
+        self.assertEqual(audioop.alaw2lin(d, 4),
+            b'\x00\x00\x08\x00\x00\x00\x08\x01\x00\x00\x10\x02')
 
     def test_lin2ulaw(self):
         self.assertEqual(audioop.lin2ulaw(data[0], 1), b'\xff\xe7\xdb')
@@ -119,6 +124,9 @@ class TestAudioop(unittest.TestCase):
         # Cursory
         d = audioop.lin2ulaw(data[0], 1)
         self.assertEqual(audioop.ulaw2lin(d, 1), data[0])
+        self.assertEqual(audioop.ulaw2lin(d, 2), b'\x00\x00\x04\x01\x0c\x02')
+        self.assertEqual(audioop.ulaw2lin(d, 4),
+            b'\x00\x00\x00\x00\x00\x00\x04\x01\x00\x00\x0c\x02')
 
     def test_mul(self):
         data2 = []
@@ -195,10 +203,15 @@ class TestAudioop(unittest.TestCase):
             self.assertRaises(audioop.error, audioop.lin2lin, data, size, size2)
             self.assertRaises(audioop.error, audioop.ratecv, data, size, 1, 1, 1, state)
             self.assertRaises(audioop.error, audioop.lin2ulaw, data, size)
-            self.assertRaises(audioop.error, audioop.ulaw2lin, data, size)
             self.assertRaises(audioop.error, audioop.lin2alaw, data, size)
-            self.assertRaises(audioop.error, audioop.alaw2lin, data, size)
             self.assertRaises(audioop.error, audioop.lin2adpcm, data, size, state)
+
+    def test_wrongsize(self):
+        data = b'abc'
+        state = None
+        for size in (-1, 3, 5):
+            self.assertRaises(audioop.error, audioop.ulaw2lin, data, size)
+            self.assertRaises(audioop.error, audioop.alaw2lin, data, size)
             self.assertRaises(audioop.error, audioop.adpcm2lin, data, size, state)
 
 def test_main():

diff --git a/Misc/NEWS b/Misc/NEWS
index 06cefe2642e0c0998a129acf8079fcfb28d79edc..e02a7c923921ca7baa9a56e8c5cc1ecd064e0842 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -111,6 +111,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #13806: The size check in audioop decompression functions was too
+  strict and could reject valid compressed data.  Patch by Oleg Plakhotnyuk.
+
 - Issue #13812: When a multiprocessing Process child raises an exception,
   flush stderr after printing the exception traceback.
 

diff --git a/Modules/audioop.c b/Modules/audioop.c
index a031d42b0f17452dfd1d3d38b68d4cdabd707981..9ab4834e29c2b9dc81b17a5aa04b0a98f0daa17a 100644 (file)
--- a/Modules/audioop.c
+++ b/Modules/audioop.c
@@ -1313,7 +1313,7 @@ audioop_ulaw2lin(PyObject *self, PyObject *args)
                            &cp, &len, &size) )
         return 0;
 
-    if (!audioop_check_parameters(len, size))
+    if (!audioop_check_size(size))
         return NULL;
 
     if (len > PY_SSIZE_T_MAX/size) {
@@ -1382,7 +1382,7 @@ audioop_alaw2lin(PyObject *self, PyObject *args)
                            &cp, &len, &size) )
         return 0;
 
-    if (!audioop_check_parameters(len, size))
+    if (!audioop_check_size(size))
         return NULL;
 
     if (len > PY_SSIZE_T_MAX/size) {
@@ -1527,7 +1527,7 @@ audioop_adpcm2lin(PyObject *self, PyObject *args)
                            &cp, &len, &size, &state) )
         return 0;
 
-    if (!audioop_check_parameters(len, size))
+    if (!audioop_check_size(size))
         return NULL;
 
     /* Decode state, should have (value, step) */