Discussion:
[Bug 777955] New: asfdemux: out of bounds read in gst_asf_demux_process_ext_content_desc
Add Reply
"GStreamer" (GNOME Bugzilla)
2017-01-30 21:55:22 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777955

Bug ID: 777955
Summary: asfdemux: out of bounds read in
gst_asf_demux_process_ext_content_desc
Classification: Platform
Product: GStreamer
Version: unspecified
OS: Linux
Status: NEW
Severity: normal
Priority: Normal
Component: gst-plugins-ugly
Assignee: gstreamer-***@lists.freedesktop.org
Reporter: ***@hboeck.de
QA Contact: gstreamer-***@lists.freedesktop.org
GNOME version: ---

Created attachment 344585
--> https://bugzilla.gnome.org/attachment.cgi?id=344585&action=edit
poc file

The attached file causes an out of bounds heap read.

asan error:
==21528==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x602000036f50 at pc 0x7fc0f14f51ad bp 0x7fc0f0b3efb0 sp 0x7fc0f0b3efa8
READ of size 4 at 0x602000036f50 thread T2 (asfdemux0:sink)
#0 0x7fc0f14f51ac in __gst_fast_read32
/usr/include/gstreamer-1.0/gst/gstutils.h:122:10
#1 0x7fc0f14f51ac in gst_asf_demux_process_ext_content_desc
/f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:3442
#2 0x7fc0f14f51ac in gst_asf_demux_process_object
/f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:4437
#3 0x7fc0f14f0225 in gst_asf_demux_process_header
/f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:3638:11
#4 0x7fc0f14f0225 in gst_asf_demux_process_object
/f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:4422
#5 0x7fc0f14dd682 in gst_asf_demux_pull_headers
/f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:1229:10
#6 0x7fc0f14dd682 in gst_asf_demux_loop
/f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:1984
#7 0x7fc0fe747983 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:335:5
#8 0x7fc0fd944b2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
#9 0x7fc0fd944154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
#10 0x7fc0fd3c2453 in start_thread (/lib64/libpthread.so.0+0x7453)
#11 0x7fc0fcef25dc in clone (/lib64/libc.so.6+0xe75dc)

0x602000036f51 is located 0 bytes to the right of 1-byte region
[0x602000036f50,0x602000036f51)
allocated by thread T2 (asfdemux0:sink) here:
#0 0x4cbbb8 in malloc (/usr/bin/gst-discoverer-1.0+0x4cbbb8)
#1 0x7fc0fd922768 in g_malloc
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gmem.c:94

Thread T2 (asfdemux0:sink) created by T1 (typefind:sink) here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7fc0fd9611bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Thread T1 (typefind:sink) created by T0 here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7fc0fd9611bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-31 06:04:21 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777955

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@coaxion.net

--- Comment #1 from Sebastian Dröge (slomo) <***@coaxion.net> ---
valgrind does not seem to be complaining here
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-31 06:07:29 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777955

--- Comment #2 from Sebastian Dröge (slomo) <***@coaxion.net> ---
... but some length checks would be useful nonetheless here :)
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-31 11:51:36 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777955

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED

--- Comment #3 from Sebastian Dröge (slomo) <***@coaxion.net> ---
I can't reproduce it, but this should fix it.

commit d21017b52a585f145e8d62781bcc1c5fefc7ee37
Author: Sebastian Dröge <***@centricular.com>
Date: Tue Jan 31 13:50:21 2017 +0200

asfdemux: Check that we have enough data available before parsing bool/uint
extended content descriptors

https://bugzilla.gnome.org/show_bug.cgi?id=777955
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-31 11:52:03 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777955

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|git master |1.11.2
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-02 10:42:16 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777955

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|1.11.2 |1.10.4
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-14 06:25:25 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777955

Salvatore Bonaccorso <***@debian.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@debian.org
Alias| |CVE-2017-5847
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
Loading...