File gstreamer-mptssection-add-checks.patch of Package gstreamer-plugins-bad.3891

From d58f668ece8795bddb3316832e1848c7b7cf38ac Mon Sep 17 00:00:00 2001
From: Edward Hervey <edward@centricular.com>
Date: Sat, 26 Nov 2016 10:44:43 +0100
Subject: [PATCH] mpegtssection: Add more section size checks

The smallest section ever needs to be at least 3 bytes (i.e. just the short
header).
Non-short headers need to be at least 11 bytes long (3 for the minimum header,
5 for the non-short header, and 4 for the CRC).

https://bugzilla.gnome.org/show_bug.cgi?id=775048

Backported by Mike Gorse <mgorse@suse.com>
---
diff -urp gst-plugins-bad-1.2.4.orig/gst-libs/gst/mpegts/gstmpegtssection.c gst-plugins-bad-1.2.4/gst-libs/gst/mpegts/gstmpegtssection.c
--- gst-plugins-bad-1.2.4.orig/gst-libs/gst/mpegts/gstmpegtssection.c	2013-09-24 08:06:21.000000000 -0500
+++ gst-plugins-bad-1.2.4/gst-libs/gst/mpegts/gstmpegtssection.c	2016-12-13 13:31:24.920016174 -0600
@@ -739,13 +739,20 @@ gst_mpegts_section_new (guint16 pid, gui
 {
   GstMpegTsSection *res = NULL;
   guint8 tmp;
-  guint16 section_length;
+  guint16 section_length = 0;
 
+  /* The smallest section ever is 3 bytes */
+  if (G_UNLIKELY (data_size < 3))
+    goto short_packet;
+ 
   /* Check for length */
   section_length = GST_READ_UINT16_BE (data + 1) & 0x0FFF;
   if (G_UNLIKELY (data_size < section_length + 3))
     goto short_packet;
 
+  GST_LOG ("data_size:%" G_GSIZE_FORMAT " section_length:%u",
+      data_size, section_length);
+
   res = g_slice_new0 (GstMpegTsSection);
   gst_mini_object_init (GST_MINI_OBJECT_CAST (res), 0, MPEG_TYPE_TS_SECTION,
       (GstMiniObjectCopyFunction) _gst_mpegts_section_copy, NULL,
@@ -761,6 +768,13 @@ gst_mpegts_section_new (guint16 pid, gui
   /* section_length (already parsed) : 12 bit */
   res->section_length = section_length + 3;
   if (!res->short_section) {
+    /* A long packet needs to be at least 11 bytes long
+     * _ 3 for the bytes above
+     * _ 5 for the bytes below
+     * _ 4 for the CRC */
+    if (G_UNLIKELY (data_size < 11))
+      goto bad_long_packet;
+
     /* CRC is after section_length (-4 for the size of the CRC) */
     res->crc = GST_READ_UINT32_BE (res->data + res->section_length - 4);
     /* Skip to after section_length */
@@ -791,4 +805,11 @@ short_packet:
         ", need:%d)", pid, data_size, section_length + 3);
     return NULL;
   }
+bad_long_packet:
+  {
+    GST_WARNING ("PID 0x%04x long section is too short (%" G_GSIZE_FORMAT
+        " bytes, need at least 11)", pid, data_size);
+    gst_mpegts_section_unref (res);
+    return NULL;
+  }
 }