Discussion:
[Bug 777262] New: gstavidemux: floating point exception in gst_riff_create_audio_caps
(too old to reply)
"GStreamer" (GNOME Bugzilla)
2017-01-15 09:37:52 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777262

Bug ID: 777262
Summary: gstavidemux: floating point exception in
gst_riff_create_audio_caps
Classification: Platform
Product: GStreamer
Version: unspecified
OS: Linux
Status: NEW
Severity: normal
Priority: Normal
Component: gst-plugins-good
Assignee: gstreamer-***@lists.freedesktop.org
Reporter: ***@hboeck.de
QA Contact: gstreamer-***@lists.freedesktop.org
GNOME version: ---

Created attachment 343488
--> https://bugzilla.gnome.org/attachment.cgi?id=343488&action=edit
fpe poc

Attached file will crash gstreamer with a floating point exception.
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-15 09:41:50 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777262

--- Comment #1 from Hanno Boeck <***@hboeck.de> ---
asan stack trace:

==2291==ERROR: AddressSanitizer: FPE on unknown address 0x7f7aa1563af2 (pc
0x7f7aa1563af2 bp 0x7f7aa154b060 sp 0x7f7aa154aec0 T2)
#0 0x7f7aa1563af1 in gst_riff_create_audio_caps
/f/gstreamer/gst-plugins-base/gst-libs/gst/riff/riff-media.c:1620:30
#1 0x7f7aa17fceed in gst_avi_demux_parse_stream
/f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:2334:14
#2 0x7f7aa17ec818 in gst_avi_demux_stream_header_pull
/f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:4063:19
#3 0x7f7aa17e6786 in gst_avi_demux_loop
/f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:5687:13
#4 0x7f7aaea938b3 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:334:5
#5 0x7f7aadc90b2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
#6 0x7f7aadc90154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
#7 0x7f7aad70e453 in start_thread (/lib64/libpthread.so.0+0x7453)
#8 0x7f7aad23e5dc in clone (/lib64/libc.so.6+0xe75dc)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE
/f/gstreamer/gst-plugins-base/gst-libs/gst/riff/riff-media.c:1620:30 in
gst_riff_create_audio_caps
Thread T2 (avidemux0:sink) created by T1 (typefind:sink) here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7f7aadcad1bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Thread T1 (typefind:sink) created by T0 here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7f7aadcad1bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

==2291==ABORTING
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-15 17:33:07 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777262

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
CC| |***@coaxion.net
Component|gst-plugins-good |gst-plugins-base
Resolution|--- |FIXED
Target Milestone|git master |1.11.2
Summary|gstavidemux: floating point |riff-media: floating point
|exception in |exception in
|gst_riff_create_audio_caps |gst_riff_create_audio_caps

--- Comment #2 from Sebastian Dröge (slomo) <***@coaxion.net> ---
commit 81d3ba3fa212bb25fe2ac661993887c4b69af6f1
Author: Sebastian Dröge <***@centricular.com>
Date: Sun Jan 15 18:31:56 2017 +0100

riff-media: Check for valid channels/rate before using the values

Otherwise we might divide by zero or otherwise create invalid caps.

https://bugzilla.gnome.org/show_bug.cgi?id=777262
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-16 17:26:00 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777262

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|1.11.2 |1.10.3
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-14 06:20:51 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777262

Salvatore Bonaccorso <***@debian.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@debian.org
Alias| |CVE-2017-5837
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-14 06:21:00 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777262

--- Comment #3 from Salvatore Bonaccorso <***@debian.org> ---
This is CVE-2017-5837
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
Loading...