Fix out of bounds reads when parsing audio and video packets: https://security-tracker.debian.org/tracker/TEMP-0000000-4DAA44 https://gitlab.freedesktop.org/gstreamer/gst-plugins-ugly/-/issues/37 Patch copied from upstream source repository: https://gitlab.freedesktop.org/gstreamer/gst-plugins-ugly/-/commit/3aba7d1e625554b2407bc77b3d09b4928b937d5f From 3aba7d1e625554b2407bc77b3d09b4928b937d5f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Wed, 3 Mar 2021 11:05:14 +0200 Subject: [PATCH] rmdemux: Make sure we have enough data available when parsing audio/video packets Otherwise there will be out-of-bounds reads and potential crashes. Thanks to Natalie Silvanovich for reporting. Fixes https://gitlab.freedesktop.org/gstreamer/gst-plugins-ugly/-/issues/37 Part-of: --- gst/realmedia/rmdemux.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/gst/realmedia/rmdemux.c b/gst/realmedia/rmdemux.c index 6cc659a1..68b0736b 100644 --- a/gst/realmedia/rmdemux.c +++ b/gst/realmedia/rmdemux.c @@ -2223,6 +2223,9 @@ gst_rmdemux_parse_video_packet (GstRMDemux * rmdemux, GstRMDemuxStream * stream, gst_buffer_map (in, &map, GST_MAP_READ); + if (map.size < offset) + goto not_enough_data; + data = map.data + offset; size = map.size - offset; @@ -2289,6 +2292,9 @@ gst_rmdemux_parse_video_packet (GstRMDemux * rmdemux, GstRMDemuxStream * stream, } GST_DEBUG_OBJECT (rmdemux, "fragment size %d", fragment_size); + if (map.size < (data - map.data) + fragment_size) + goto not_enough_data; + /* get the fragment */ fragment = gst_buffer_copy_region (in, GST_BUFFER_COPY_ALL, data - map.data, @@ -2437,6 +2443,9 @@ gst_rmdemux_parse_audio_packet (GstRMDemux * rmdemux, GstRMDemuxStream * stream, GstFlowReturn ret; GstBuffer *buffer; + if (gst_buffer_get_size (in) < offset) + goto not_enough_data; + buffer = gst_buffer_copy_region (in, GST_BUFFER_COPY_MEMORY, offset, -1); if (rmdemux->first_ts != -1 && timestamp > rmdemux->first_ts) @@ -2467,9 +2476,19 @@ gst_rmdemux_parse_audio_packet (GstRMDemux * rmdemux, GstRMDemuxStream * stream, ret = gst_pad_push (stream->pad, buffer); } +done: gst_buffer_unref (in); return ret; + + /* ERRORS */ +not_enough_data: + { + GST_ELEMENT_WARNING (rmdemux, STREAM, DECODE, ("Skipping bad packet."), + (NULL)); + ret = GST_FLOW_OK; + goto done; + } } static GstFlowReturn @@ -2490,6 +2509,9 @@ gst_rmdemux_parse_packet (GstRMDemux * rmdemux, GstBuffer * in, guint16 version) data = map.data; size = map.size; + if (size < 4 + 6 + 1 + 2) + goto not_enough_data; + /* stream number */ id = RMDEMUX_GUINT16_GET (data); @@ -2525,6 +2547,9 @@ gst_rmdemux_parse_packet (GstRMDemux * rmdemux, GstBuffer * in, guint16 version) /* version 1 has an extra byte */ if (version == 1) { + if (size < 1) + goto not_enough_data; + data += 1; size -= 1; } @@ -2596,6 +2621,16 @@ unknown_stream: gst_buffer_unref (in); return GST_FLOW_OK; } + + /* ERRORS */ +not_enough_data: + { + GST_ELEMENT_WARNING (rmdemux, STREAM, DECODE, ("Skipping bad packet."), + (NULL)); + gst_buffer_unmap (in, &map); + gst_buffer_unref (in); + return GST_FLOW_OK; + } } gboolean -- 2.31.1 rity.scm, gnu/tests/ssh.scm, gnu/tests/telephony.scm, gnu/tests/version-control.scm, gnu/tests/virtualization.scm, gnu/tests/web.scm: Remove (mkdir #$output) (chdir #$output) and pass #$output as argument to 'system-test-runner'. Ludovic Courtès 2021-09-25tests: Adjust to SRFI-64 as found in Guile 3.0.7....In Guile 3.0.7, 'test-runner-current' is set to #f upon 'test-end'. Consequently, the previous strategy, where we'd call 'test-runner-current' after 'test-end', no longer works. Instead, set the test runner in each test right before 'test-begin'. * gnu/build/marionette.scm (system-test-runner): New procedure. * gnu/tests/audio.scm (run-mpd-test): Replace (exit (= ...)) idiom by (test-runner-current (system-test-runner)). * gnu/tests/base.scm (run-basic-test) (run-cleanup-test, run-mcron-test, run-nss-mdns-test): Likewise. * gnu/tests/ci.scm (run-laminar-test): Likewise. * gnu/tests/cups.scm (run-cups-test): Likewise. * gnu/tests/databases.scm (run-memcached-test) (run-postgresql-test, run-mysql-test): Likewise. * gnu/tests/desktop.scm (run-elogind-test): Likewise. * gnu/tests/dict.scm (run-dicod-test): Likewise. * gnu/tests/docker.scm (run-docker-test): Likewise. (run-docker-system-test): Likewise. * gnu/tests/file-sharing.scm (run-transmission-daemon-test): Likewise. * gnu/tests/ganeti.scm (run-ganeti-test): Likewise. * gnu/tests/guix.scm (run-guix-build-coordinator-test): Likewise. (run-guix-data-service-test): Likewise. * gnu/tests/ldap.scm (run-ldap-test): Likewise. * gnu/tests/linux-modules.scm (run-loadable-kernel-modules-test-base): Likewise. * gnu/tests/mail.scm (run-opensmtpd-test) (run-exim-test, run-dovecot-test, run-getmail-test): Likewise. * gnu/tests/messaging.scm (run-xmpp-test) (run-bitlbee-test, run-quassel-test): Likewise. * gnu/tests/monitoring.scm (run-prometheus-node-exporter-server-test) (run-zabbix-server-test): Likewise. * gnu/tests/networking.scm (run-inetd-test, run-openvswitch-test) (run-dhcpd-test, run-tor-test, run-iptables-test, run-ipfs-test): Likewise. * gnu/tests/nfs.scm (run-nfs-test) (run-nfs-server-test, run-nfs-root-fs-test): Likewise. * gnu/tests/package-management.scm (run-nix-test): Likewise. * gnu/tests/reconfigure.scm (run-switch-to-system-test) (run-upgrade-services-test, run-install-bootloader-test): Likewise. * gnu/tests/rsync.scm (run-rsync-test): Likewise. * gnu/tests/security-token.scm (run-pcscd-test): Likewise. * gnu/tests/singularity.scm (run-singularity-test): Likewise. * gnu/tests/ssh.scm (run-ssh-test): Likewise. * gnu/tests/telephony.scm (run-jami-test): Likewise. * gnu/tests/version-control.scm (run-cgit-test): Likewise. (run-git-http-test, run-gitolite-test, run-gitile-test): Likewise. * gnu/tests/virtualization.scm (run-libvirt-test, run-childhurd-test): Likewise. * gnu/tests/web.scm (run-webserver-test, run-php-fpm-test) (run-hpcguix-web-server-test, run-tailon-test, run-patchwork-test): Likewise. Ludovic Courtès