File 0001-qtdemux-Fix-out-of-bounds-read-in-tag-pars... of Package gstreamer-plugins-good

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-qtdemux-Fix-out-of-bounds-read-in-tag-parsing-code.patch of Package gstreamer-plugins-good (Revision f9face8658f5bbc072b5614cdd33d870)

Currently displaying revision f9face8658f5bbc072b5614cdd33d870 , Show latest

From d0949baf3dadea6021d54abef6802fed5a06af75 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 1 Dec 2016 13:32:22 +0200
Subject: [PATCH] qtdemux: Fix out of bounds read in tag parsing code

We can't simply assume that the length of the tag value as given
inside the stream is correct but should also check against the amount of
data we have actually available.

https://bugzilla.gnome.org/show_bug.cgi?id=775451
---
 gst/isomp4/qtdemux.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
index c5ff799..b1d2de8 100644
--- a/gst/isomp4/qtdemux.c
+++ b/gst/isomp4/qtdemux.c
@@ -11045,7 +11045,7 @@ qtdemux_tag_add_str_full (GstQTDemux * qtdemux, GstTagList * taglist,
   } else {
     len = QT_UINT32 (node->data);
     type = QT_UINT32 ((guint8 *) node->data + 4);
-    if ((type >> 24) == 0xa9) {
+    if ((type >> 24) == 0xa9 && len > 8 + 4) {
       gint str_len;
       gint lang_code;
 
@@ -11064,7 +11064,7 @@ qtdemux_tag_add_str_full (GstQTDemux * qtdemux, GstTagList * taglist,
       }
 
       offset = 12;
-      len = str_len + 8 + 4;    /* remove trailing strings that we don't use */
+      len = MIN (len, str_len + 8 + 4); /* remove trailing strings that we don't use */
       GST_DEBUG_OBJECT (qtdemux, "found international text tag");
 
       if (lang_code < 0x800) {  /* MAC encoded string */

Places

File 0001-qtdemux-Fix-out-of-bounds-read-in-tag-parsing-code.patch of Package gstreamer-plugins-good (Revision f9face8658f5bbc072b5614cdd33d870)

Places