Discussion:
[Bug 777957] New: mpegdemux: Invalid memory read in gst_ps_demux_parse_psm
(too old to reply)
"GStreamer" (GNOME Bugzilla)
2017-01-30 22:54:16 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777957

Bug ID: 777957
Summary: mpegdemux: Invalid memory read in
gst_ps_demux_parse_psm
Classification: Platform
Product: GStreamer
Version: unspecified
OS: Linux
Status: NEW
Severity: normal
Priority: Normal
Component: gst-plugins-bad
Assignee: gstreamer-***@lists.freedesktop.org
Reporter: ***@hboeck.de
QA Contact: gstreamer-***@lists.freedesktop.org
GNOME version: ---

File:
https://samples.mplayerhq.hu/ffmpeg-bugs/trac/ticket4182/alamic.mpg

asan error:
==6863==ERROR: AddressSanitizer: SEGV on unknown address 0x62d0014f31a8 (pc
0x7f44fe7c0477 bp 0x62d0014f31a8 sp 0x7f44fe79a900 T2)
==6863==The signal is caused by a READ memory access.
#0 0x7f44fe7c0476 in __gst_fast_read_swap16
/usr/include/gstreamer-1.0/gst/gstutils.h:128:10
#1 0x7f44fe7c0476 in gst_ps_demux_parse_psm
/f/gstreamer/gst-plugins-bad/gst/mpegdemux/gstmpegdemux.c:2121
#2 0x7f44fe7c0476 in gst_ps_demux_chain
/f/gstreamer/gst-plugins-bad/gst/mpegdemux/gstmpegdemux.c:3201
#3 0x7f44fe7bddeb in gst_ps_demux_pull_block
/f/gstreamer/gst-plugins-bad/gst/mpegdemux/gstmpegdemux.c:2875:9
#4 0x7f44fe7b5eb1 in gst_ps_demux_loop
/f/gstreamer/gst-plugins-bad/gst/mpegdemux/gstmpegdemux.c:2905:11
#5 0x7f450be3e983 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:335:5
#6 0x7f450b03bb2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
#7 0x7f450b03b154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
#8 0x7f450aab9453 in start_thread (/lib64/libpthread.so.0+0x7453)
#9 0x7f450a5e95dc in clone (/lib64/libc.so.6+0xe75dc)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
/usr/include/gstreamer-1.0/gst/gstutils.h:128:10 in __gst_fast_read_swap16
Thread T2 (mpegpsdemux0:si) created by T1 (typefind:sink) here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7f450b0581bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Thread T1 (typefind:sink) created by T0 here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7f450b0581bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

==6863==ABORTING
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-31 06:04:18 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777957

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@coaxion.net

--- Comment #1 from Sebastian Dröge (slomo) <***@coaxion.net> ---
valgrind does not seem to be complaining here
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-31 06:07:32 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777957

--- Comment #2 from Sebastian Dröge (slomo) <***@coaxion.net> ---
... but some length checks would be useful nonetheless here :)
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-01 03:41:30 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777957

Jan Schmidt <***@noraisin.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@noraisin.net
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-01 03:41:36 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777957

--- Comment #3 from Jan Schmidt <***@noraisin.net> ---
Created attachment 344676
--> https://bugzilla.gnome.org/attachment.cgi?id=344676&action=edit
psdemux: Rewrite PSM parsing using GstByteReader

Avoid possible buffer overflows and ignore invalid PSM packets better
by using GstByteReader.
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-01 03:47:30 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777957

Jan Schmidt <***@noraisin.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED
Target Milestone|git master |1.11.2

--- Comment #4 from Jan Schmidt <***@noraisin.net> ---
I also can't find the same error, but the psm parsing code definitely isn't
safe. Here's a rewrite - thanks!
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-01 08:05:19 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777957

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Attachment #344676|none |committed
status| |
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-02 10:42:10 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777957

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|1.11.2 |1.10.4
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-07 11:04:29 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777957

Victor Toso <***@victortoso.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@victortoso.com

--- Comment #5 from Victor Toso <***@victortoso.com> ---
For those who want to cherry pick

commit 948b87bf1514de55ee96575d204140eeec3a80a8
Author: Jan Schmidt <***@centricular.com>
Date: Wed Feb 1 14:25:32 2017 +1100

psdemux: Rewrite PSM parsing using GstByteReader

Avoid possible buffer overflows and ignore invalid PSM packets better
by using GstByteReader.

https://bugzilla.gnome.org/show_bug.cgi?id=777957
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-14 06:27:13 UTC
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777957

Salvatore Bonaccorso <***@debian.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@debian.org
Alias| |CVE-2017-5848
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
Loading...