Discussion:
[Bug 777263] New: heap out of bounds read in gst_date_time_new_from_iso8601_string
(too old to reply)
"GStreamer" (GNOME Bugzilla)
2017-01-15 09:41:00 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777263

Bug ID: 777263
Summary: heap out of bounds read in
gst_date_time_new_from_iso8601_string
Classification: Platform
Product: GStreamer
Version: unspecified
OS: Linux
Status: NEW
Severity: normal
Priority: Normal
Component: gstreamer (core)
Assignee: gstreamer-***@lists.freedesktop.org
Reporter: ***@hboeck.de
QA Contact: gstreamer-***@lists.freedesktop.org
GNOME version: ---

Created attachment 343489
--> https://bugzilla.gnome.org/attachment.cgi?id=343489&action=edit
oob heap poc

When compiled with asan the attached file will trigger an out of bounds heap
read.

ASAN error:
==17371==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60300004dcf6 at pc 0x7ffb7e6935fb bp 0x7ffb7124b150 sp 0x7ffb7124b148
READ of size 1 at 0x60300004dcf6 thread T2 (avidemux0:sink)
#0 0x7ffb7e6935fa in gst_date_time_new_from_iso8601_string
/f/gstreamer/gstreamer/gst/gstdatetime.c:870:11
#1 0x7ffb7e85dd85 in gst_value_deserialize_date_time
/f/gstreamer/gstreamer/gst/gstvalue.c:6224:14
#2 0x7ffb7e84d555 in gst_value_deserialize
/f/gstreamer/gstreamer/gst/gstvalue.c:5607:12
#3 0x7ffb7127168f in parse_tag_value
/f/gstreamer/gst-plugins-base/gst-libs/gst/riff/riff-read.c:642:11
#4 0x7ffb7127168f in gst_riff_parse_info
/f/gstreamer/gst-plugins-base/gst-libs/gst/riff/riff-read.c:802
#5 0x7ffb714ee5f9 in gst_avi_demux_stream_header_pull
/f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:4209:13
#6 0x7ffb714e6786 in gst_avi_demux_loop
/f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:5687:13
#7 0x7ffb7e7f78b3 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:334:5
#8 0x7ffb7d9f4b2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
#9 0x7ffb7d9f4154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
#10 0x7ffb7d472453 in start_thread (/lib64/libpthread.so.0+0x7453)
#11 0x7ffb7cfa25dc in clone (/lib64/libc.so.6+0xe75dc)

0x60300004dcf6 is located 0 bytes to the right of 22-byte region
[0x60300004dce0,0x60300004dcf6)
allocated by thread T2 (avidemux0:sink) here:
#0 0x4cbbb8 in malloc (/usr/bin/gst-discoverer-1.0+0x4cbbb8)
#1 0x7ffb7d9d2768 in g_malloc
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gmem.c:94

Thread T2 (avidemux0:sink) created by T1 (typefind:sink) here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7ffb7da111bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Thread T1 (typefind:sink) created by T0 here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7ffb7da111bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-15 11:56:27 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777263

Tim-Philipp Müller <***@zen.co.uk> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
CC| |***@zen.co.uk
Version|unspecified |git master
Resolution|--- |FIXED
Target Milestone|git master |1.10.3
Summary|heap out of bounds read in |datetime: out of bounds
|gst_date_time_new_from_iso8 |read in
|601_string |gst_date_time_new_from_iso8
| |601_string()

--- Comment #1 from Tim-Philipp Müller <***@zen.co.uk> ---
Thanks, should be fixed now:

commit 9398b7f1a75b38844ae7050b5a7967e4cdebe24f
Author: Tim-Philipp Müller <***@centricular.com>
Date: Sun Jan 15 11:52:44 2017 +0000

datetime: fix potential out-of-bound read on malformed datetime string

https://bugzilla.gnome.org/show_bug.cgi?id=777263
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-14 06:21:34 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777263

Salvatore Bonaccorso <***@debian.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@debian.org
Alias| |CVE-2017-5838
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-14 06:21:44 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777263

--- Comment #2 from Salvatore Bonaccorso <***@debian.org> ---
This is CVE-2017-5838
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
Loading...