Discussion:
[Bug 777502] New: samiparse: heap oob in html_context_handle_element
(too old to reply)
"GStreamer" (GNOME Bugzilla)
2017-01-19 17:48:01 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777502

Bug ID: 777502
Summary: samiparse: heap oob in html_context_handle_element
Classification: Platform
Product: GStreamer
Version: unspecified
OS: Linux
Status: NEW
Severity: normal
Priority: Normal
Component: gst-plugins-good
Assignee: gstreamer-***@lists.freedesktop.org
Reporter: ***@hboeck.de
QA Contact: gstreamer-***@lists.freedesktop.org
GNOME version: ---

File:
https://samples.mplayerhq.hu/sub/sami/OneNote_Manager.smi

Causes heap oob. asan error:
==21397==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60200003e40f at pc 0x7f7d31ac3ed3 bp 0x7f7d324e5380 sp 0x7f7d324e5378
READ of size 1 at 0x60200003e40f thread T1 (typefind:sink)
#0 0x7f7d31ac3ed2 in html_context_handle_element
/f/gstreamer/gst-plugins-base/gst/subparse/samiparse.c:507:9
#1 0x7f7d31ac005c in html_context_parse
/f/gstreamer/gst-plugins-base/gst/subparse/samiparse.c:550:9
#2 0x7f7d31ac005c in parse_sami
/f/gstreamer/gst-plugins-base/gst/subparse/samiparse.c:881
#3 0x7f7d31aaf0cc in handle_buffer
/f/gstreamer/gst-plugins-base/gst/subparse/gstsubparse.c:1767:16
#4 0x7f7d31aaf0cc in gst_sub_parse_chain
/f/gstreamer/gst-plugins-base/gst/subparse/gstsubparse.c:1831
#5 0x7f7d3dd97277 in gst_pad_chain_data_unchecked
/f/gstreamer/gstreamer/gst/gstpad.c:4204:11
#6 0x7f7d3dd9aa47 in gst_pad_push_data
/f/gstreamer/gstreamer/gst/gstpad.c:4456:9
#7 0x7f7d3dd9a0bf in gst_pad_push
/f/gstreamer/gstreamer/gst/gstpad.c:4575:9
#8 0x7f7d325f8429 in gst_type_find_element_loop
/f/gstreamer/gstreamer/plugins/elements/gsttypefindelement.c:1186:11
#9 0x7f7d3de61883 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:334:5
#10 0x7f7d3d05eb2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
#11 0x7f7d3d05e154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
#12 0x7f7d3cadc453 in start_thread (/lib64/libpthread.so.0+0x7453)
#13 0x7f7d3c60c5dc in clone (/lib64/libc.so.6+0xe75dc)

0x60200003e40f is located 1 bytes to the left of 1-byte region
[0x60200003e410,0x60200003e411)
allocated by thread T1 (typefind:sink) here:
#0 0x4cbbb8 in malloc (/usr/bin/gst-discoverer-1.0+0x4cbbb8)
#1 0x7f7d3d03c768 in g_malloc
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gmem.c:94
#2 0x7f7d3d056097 in g_strndup
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gstrfuncs.c:425
#3 0x7f7d31ac3b05 in string_token
/f/gstreamer/gst-plugins-base/gst/subparse/samiparse.c:458:14
#4 0x7f7d31ac3b05 in html_context_handle_element
/f/gstreamer/gst-plugins-base/gst/subparse/samiparse.c:497
#5 0x7f7d31ac005c in html_context_parse
/f/gstreamer/gst-plugins-base/gst/subparse/samiparse.c:550:9
#6 0x7f7d31ac005c in parse_sami
/f/gstreamer/gst-plugins-base/gst/subparse/samiparse.c:881
#7 0x7f7d31aaf0cc in handle_buffer
/f/gstreamer/gst-plugins-base/gst/subparse/gstsubparse.c:1767:16
#8 0x7f7d31aaf0cc in gst_sub_parse_chain
/f/gstreamer/gst-plugins-base/gst/subparse/gstsubparse.c:1831
#9 0x7f7d3dd97277 in gst_pad_chain_data_unchecked
/f/gstreamer/gstreamer/gst/gstpad.c:4204:11
#10 0x7f7d3dd9aa47 in gst_pad_push_data
/f/gstreamer/gstreamer/gst/gstpad.c:4456:9
#11 0x7f7d3dd9a0bf in gst_pad_push
/f/gstreamer/gstreamer/gst/gstpad.c:4575:9
#12 0x7f7d325f8429 in gst_type_find_element_loop
/f/gstreamer/gstreamer/plugins/elements/gsttypefindelement.c:1186:11
#13 0x7f7d3de61883 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:334:5
#14 0x7f7d3d05eb2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
#15 0x7f7d3d05e154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
#16 0x7f7d3cadc453 in start_thread (/lib64/libpthread.so.0+0x7453)
#17 0x7f7d3c60c5dc in clone (/lib64/libc.so.6+0xe75dc)

Thread T1 (typefind:sink) created by T0 here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7f7d3d07b1bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

SUMMARY: AddressSanitizer: heap-buffer-overflow
/f/gstreamer/gst-plugins-base/gst/subparse/samiparse.c:507:9 in
html_context_handle_element
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 06:03:28 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777502

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@coaxion.net
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 06:03:42 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777502

--- Comment #1 from Sebastian Dröge (slomo) <***@coaxion.net> ---
Created attachment 343860
--> https://bugzilla.gnome.org/attachment.cgi?id=343860&action=edit
samiparse: Check that the string has a non-zero length before overwriting the
last byte with '\0'
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 06:04:08 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777502

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Attachment #343860|none |committed
status| |
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 06:04:04 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777502

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED

--- Comment #2 from Sebastian Dröge (slomo) <***@coaxion.net> ---
Attachment 343860 pushed as d894c19 - samiparse: Check that the string has a
non-zero length before overwriting the last byte with '\0'
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 06:04:21 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777502

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|git master |1.11.2
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 09:09:56 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777502

Hanno Boeck <***@hboeck.de> changed:

What |Removed |Added
----------------------------------------------------------------------------
Component|gst-plugins-good |gst-plugins-base
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-25 12:29:48 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777502

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|1.11.2 |1.10.3
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-14 06:23:45 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777502

Salvatore Bonaccorso <***@debian.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@debian.org
Alias| |CVE-2017-5842
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
Loading...