File CVE-2024-47601.patch of Package gstreamer-plugins-good.36927
From 395f2b3ffdc5e600b49e950f62df46e4ad2265ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Mon, 30 Sep 2024 19:04:51 +0300
Subject: [PATCH 4/7] matroskademux: Don't take data out of an empty adapter
when processing WavPack frames
Thanks to Antonio Morales for finding and reporting the issue.
Fixes GHSL-2024-249
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3865
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057>
---
.../gst-plugins-good/gst/matroska/matroska-demux.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff -urp gst-plugins-good-1.24.7.orig/gst/matroska/matroska-demux.c gst-plugins-good-1.24.7/gst/matroska/matroska-demux.c
--- gst-plugins-good-1.24.7.orig/gst/matroska/matroska-demux.c 2024-12-16 03:36:37.921506756 -0500
+++ gst-plugins-good-1.24.7/gst/matroska/matroska-demux.c 2024-12-16 03:52:30.938709625 -0500
@@ -4037,11 +4037,16 @@ gst_matroska_demux_add_wvpk_header (GstE
}
gst_buffer_unmap (*buf, &map);
- newbuf = gst_adapter_take_buffer (adapter, gst_adapter_available (adapter));
+ size = gst_adapter_available (adapter);
+ if (size > 0) {
+ newbuf = gst_adapter_take_buffer (adapter, size);
+ gst_buffer_copy_into (newbuf, *buf,
+ GST_BUFFER_COPY_TIMESTAMPS | GST_BUFFER_COPY_FLAGS, 0, -1);
+ } else {
+ newbuf = NULL;
+ }
g_object_unref (adapter);
- gst_buffer_copy_into (newbuf, *buf,
- GST_BUFFER_COPY_TIMESTAMPS | GST_BUFFER_COPY_FLAGS, 0, -1);
gst_buffer_unref (*buf);
*buf = newbuf;