|
 |
eb6b57 |
From 24267889a717e1e799037a0f1841d5416eb56e75 Mon Sep 17 00:00:00 2001
|
|
|
eb6b57 |
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
|
|
eb6b57 |
Date: Mon, 30 May 2022 10:15:37 +0300
|
|
|
eb6b57 |
Subject: [PATCH 3/4] qtdemux: Fix integer overflows in zlib decompression code
|
|
|
eb6b57 |
|
|
|
eb6b57 |
Various variables were of smaller types than needed and there were no
|
|
|
eb6b57 |
checks for any overflows when doing additions on the sizes. This is all
|
|
|
eb6b57 |
checked now.
|
|
|
eb6b57 |
|
|
|
eb6b57 |
In addition the size of the decompressed data is limited to 200MB now as
|
|
|
eb6b57 |
any larger sizes are likely pathological and we can avoid out of memory
|
|
|
eb6b57 |
situations in many cases like this.
|
|
|
eb6b57 |
|
|
|
eb6b57 |
Also fix a bug where the available output size on the next iteration in
|
|
|
eb6b57 |
the zlib decompression code was provided too large and could
|
|
|
eb6b57 |
potentially lead to out of bound writes.
|
|
|
eb6b57 |
|
|
|
eb6b57 |
Thanks to Adam Doupe for analyzing and reporting the issue.
|
|
|
eb6b57 |
|
|
|
eb6b57 |
CVE: tbd
|
|
|
eb6b57 |
|
|
|
eb6b57 |
https://gstreamer.freedesktop.org/security/sa-2022-0003.html
|
|
|
eb6b57 |
|
|
|
eb6b57 |
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225
|
|
|
eb6b57 |
|
|
|
eb6b57 |
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2610>
|
|
|
eb6b57 |
---
|
|
|
eb6b57 |
gst/isomp4/qtdemux.c | 8 +++++++-
|
|
|
eb6b57 |
1 file changed, 7 insertions(+), 1 deletion(-)
|
|
|
eb6b57 |
|
|
|
eb6b57 |
diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
|
|
|
eb6b57 |
index 182d0bc06f..a9cbbd4cd3 100644
|
|
|
eb6b57 |
--- a/gst/isomp4/qtdemux.c
|
|
|
eb6b57 |
+++ b/gst/isomp4/qtdemux.c
|
|
|
eb6b57 |
@@ -7611,10 +7611,16 @@ qtdemux_inflate (void *z_buffer, guint z_length, guint * length)
|
|
|
eb6b57 |
break;
|
|
|
eb6b57 |
}
|
|
|
eb6b57 |
|
|
|
eb6b57 |
+ if (*length > G_MAXUINT - 4096 || *length > QTDEMUX_MAX_SAMPLE_INDEX_SIZE) {
|
|
|
eb6b57 |
+ GST_WARNING ("too big decompressed data");
|
|
|
eb6b57 |
+ ret = Z_MEM_ERROR;
|
|
|
eb6b57 |
+ break;
|
|
|
eb6b57 |
+ }
|
|
|
eb6b57 |
+
|
|
|
eb6b57 |
*length += 4096;
|
|
|
eb6b57 |
buffer = (guint8 *) g_realloc (buffer, *length);
|
|
|
eb6b57 |
z.next_out = (Bytef *) (buffer + z.total_out);
|
|
|
eb6b57 |
- z.avail_out += 4096;
|
|
|
eb6b57 |
+ z.avail_out += *length - z.total_out;
|
|
|
eb6b57 |
} while (z.avail_in > 0);
|
|
|
eb6b57 |
|
|
|
eb6b57 |
if (ret != Z_STREAM_END) {
|
|
|
eb6b57 |
--
|
|
|
eb6b57 |
2.38.1
|
|
|
eb6b57 |
|