Discussion:
[Bug 777500] New: avidemux: gst_avi_demux_parse_ncdt heap out of bounds read
(too old to reply)
"GStreamer" (GNOME Bugzilla)
2017-01-19 17:45:48 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777500

Bug ID: 777500
Summary: avidemux: gst_avi_demux_parse_ncdt heap out of bounds
read
Classification: Platform
Product: GStreamer
Version: unspecified
OS: Linux
Status: NEW
Severity: normal
Priority: Normal
Component: gst-plugins-good
Assignee: gstreamer-***@lists.freedesktop.org
Reporter: ***@hboeck.de
QA Contact: gstreamer-***@lists.freedesktop.org
GNOME version: ---

This file causes a heap oob read in the current gstreamer git code:
https://samples.mplayerhq.hu/ffmpeg-bugs/trac/ticket3279/DSC_0131.AVI

asan stack trace:
==14052==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x62500002cec2 at pc 0x7fd5ad70215f bp 0x7fd5ad44b410 sp 0x7fd5ad44b408
READ of size 4 at 0x62500002cec2 thread T2 (avidemux0:sink)
#0 0x7fd5ad70215e in __gst_fast_read32
/usr/include/gstreamer-1.0/gst/gstutils.h:122:10
#1 0x7fd5ad70215e in gst_avi_demux_parse_ncdt
/f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:3889
#2 0x7fd5ad6ee49e in gst_avi_demux_stream_header_pull
/f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:4244:13
#3 0x7fd5ad6e6786 in gst_avi_demux_loop
/f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:5687:13
#4 0x7fd5ba9d0883 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:334:5
#5 0x7fd5b9bcdb2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
#6 0x7fd5b9bcd154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
#7 0x7fd5b964b453 in start_thread (/lib64/libpthread.so.0+0x7453)
#8 0x7fd5b917b5dc in clone (/lib64/libc.so.6+0xe75dc)

0x62500002cec5 is located 0 bytes to the right of 9669-byte region
[0x62500002a900,0x62500002cec5)
allocated by thread T2 (avidemux0:sink) here:
#0 0x4cbbb8 in malloc (/usr/bin/gst-discoverer-1.0+0x4cbbb8)
#1 0x7fd5b9bab768 in g_malloc
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gmem.c:94
#2 0x7fd5b9bc34d2 in g_slice_alloc
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gslice.c:1025
#3 0x7fd5ba7ec26c in _sysmem_new_block
/f/gstreamer/gstreamer/gst/gstallocator.c:416:9
#4 0x7fd5ba7ec26c in default_alloc
/f/gstreamer/gstreamer/gst/gstallocator.c:515
#5 0x7fd5ba7ea9a2 in gst_allocator_alloc
/f/gstreamer/gstreamer/gst/gstallocator.c:313:11
#6 0x7fd5ba81153c in gst_buffer_new_allocate
/f/gstreamer/gstreamer/gst/gstbuffer.c:838:11
#7 0x7fd5bae9d68c in gst_base_src_default_alloc
/f/gstreamer/gstreamer/libs/gst/base/gstbasesrc.c:1439:15
#8 0x7fd5bae9d076 in gst_base_src_default_create
/f/gstreamer/gstreamer/libs/gst/base/gstbasesrc.c:1477:11
#9 0x7fd5baea4233 in gst_base_src_get_range
/f/gstreamer/gstreamer/libs/gst/base/gstbasesrc.c:2465:9
#10 0x7fd5bae9fbb7 in gst_base_src_getrange
/f/gstreamer/gstreamer/libs/gst/base/gstbasesrc.c:2633:9
#11 0x7fd5ba90ce51 in gst_pad_get_range_unchecked
/f/gstreamer/gstreamer/gst/gstpad.c:4665:9
#12 0x7fd5ba90f64b in gst_pad_pull_range
/f/gstreamer/gstreamer/gst/gstpad.c:4906:9
#13 0x7fd5ba8b3c2a in gst_proxy_pad_getrange_default
/f/gstreamer/gstreamer/gst/gstghostpad.c:184:9
#14 0x7fd5ba90ce51 in gst_pad_get_range_unchecked
/f/gstreamer/gstreamer/gst/gstpad.c:4665:9
#15 0x7fd5ba90f64b in gst_pad_pull_range
/f/gstreamer/gstreamer/gst/gstpad.c:4906:9
#16 0x7fd5ba90ce51 in gst_pad_get_range_unchecked
/f/gstreamer/gstreamer/gst/gstpad.c:4665:9
#17 0x7fd5ba90f64b in gst_pad_pull_range
/f/gstreamer/gstreamer/gst/gstpad.c:4906:9
#18 0x7fd5ad46a8b5 in gst_riff_read_chunk
/f/gstreamer/gst-plugins-base/gst-libs/gst/riff/riff-read.c:92:14
#19 0x7fd5ad6ee137 in gst_avi_demux_stream_header_pull
/f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:4229:17
#20 0x7fd5ad6e6786 in gst_avi_demux_loop
/f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:5687:13
#21 0x7fd5ba9d0883 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:334:5
#22 0x7fd5b9bcdb2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
#23 0x7fd5b9bcd154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
#24 0x7fd5b964b453 in start_thread (/lib64/libpthread.so.0+0x7453)
#25 0x7fd5b917b5dc in clone (/lib64/libc.so.6+0xe75dc)

Thread T2 (avidemux0:sink) created by T1 (typefind:sink) here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7fd5b9bea1bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Thread T1 (typefind:sink) created by T0 here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7fd5b9bea1bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

SUMMARY: AddressSanitizer: heap-buffer-overflow
/usr/include/gstreamer-1.0/gst/gstutils.h:122:10 in __gst_fast_read32
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 05:58:54 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777500

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@coaxion.net
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 05:58:59 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777500

--- Comment #1 from Sebastian Dröge (slomo) <***@coaxion.net> ---
Created attachment 343859
--> https://bugzilla.gnome.org/attachment.cgi?id=343859&action=edit
avidemux: Fix various out of bounds reads when parsing ncdt tags
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 10:42:37 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777500

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED

--- Comment #2 from Sebastian Dröge (slomo) <***@coaxion.net> ---
Attachment 343859 pushed as 32d9f3c - avidemux: Fix various out of bounds reads
when parsing ncdt tags
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 10:42:41 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777500

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Attachment #343859|none |committed
status| |
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 10:42:57 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777500

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|git master |1.11.2
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-25 12:29:55 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777500

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|1.11.2 |1.10.3
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-14 06:23:29 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777500

Salvatore Bonaccorso <***@debian.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@debian.org
Alias| |CVE-2017-5841
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
Loading...