Discussion:
[Bug 777532] New: avidemux: invalid memory read in gst_avi_demux_parse_ncdt
Add Reply
"GStreamer" (GNOME Bugzilla)
2017-01-20 12:08:42 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777532

Bug ID: 777532
Summary: avidemux: invalid memory read in
gst_avi_demux_parse_ncdt
Classification: Platform
Product: GStreamer
Version: unspecified
OS: Linux
Status: NEW
Severity: normal
Priority: Normal
Component: gst-plugins-good
Assignee: gstreamer-***@lists.freedesktop.org
Reporter: ***@hboeck.de
QA Contact: gstreamer-***@lists.freedesktop.org
GNOME version: ---

This may be a followup bug of the fix of
https://bugzilla.gnome.org/show_bug.cgi?id=777500

file:
https://samples.mplayerhq.hu/ffmpeg-bugs/trac/ticket3330/DSCN0902.AVI

asan trace:
==31237==ERROR: AddressSanitizer: SEGV on unknown address 0x622000023fbc (pc
0x7fb741b01274 bp 0x7fb74184b5b0 sp 0x7fb74184b420 T2)
==31237==The signal is caused by a READ memory access.
#0 0x7fb741b01273 in __gst_fast_read16
/usr/include/gstreamer-1.0/gst/gstutils.h:119:10
#1 0x7fb741b01273 in gst_avi_demux_parse_ncdt
/f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:3910
#2 0x7fb741aee4ae in gst_avi_demux_stream_header_pull
/f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:4248:13
#3 0x7fb741ae6796 in gst_avi_demux_loop
/f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:5691:13
#4 0x7fb74ed81973 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:334:5
#5 0x7fb74df7eb2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
#6 0x7fb74df7e154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
#7 0x7fb74d9fc453 in start_thread (/lib64/libpthread.so.0+0x7453)
#8 0x7fb74d52c5dc in clone (/lib64/libc.so.6+0xe75dc)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
/usr/include/gstreamer-1.0/gst/gstutils.h:119:10 in __gst_fast_read16
Thread T2 (avidemux0:sink) created by T1 (typefind:sink) here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7fb74df9b1bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Thread T1 (typefind:sink) created by T0 here:
#0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
#1 0x7fb74df9b1bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

==31237==ABORTING
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 12:42:16 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777532

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@coaxion.net

--- Comment #1 from Sebastian Dröge (slomo) <***@coaxion.net> ---
Confirmed, but not sure why yet. Looking again later
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 15:18:42 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777532

--- Comment #2 from Sebastian Dröge (slomo) <***@coaxion.net> ---
Created attachment 343909
--> https://bugzilla.gnome.org/attachment.cgi?id=343909&action=edit
avidemux: Stop reading a ncdt sub-tag if it goes behind the surrounding tag
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 15:18:55 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777532

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED

--- Comment #3 from Sebastian Dröge (slomo) <***@coaxion.net> ---
Attachment 343909 pushed as 4f47835 - avidemux: Stop reading a ncdt sub-tag if
it goes behind the surrounding tag
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 15:18:58 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777532

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Attachment #343909|none |committed
status| |
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-20 15:19:17 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777532

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|git master |1.11.2
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-01-25 12:29:58 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777532

Sebastian Dröge (slomo) <***@coaxion.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|1.11.2 |1.10.3
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
"GStreamer" (GNOME Bugzilla)
2017-02-14 06:24:45 UTC
Reply
Permalink
Raw Message
https://bugzilla.gnome.org/show_bug.cgi?id=777532

Salvatore Bonaccorso <***@debian.org> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@debian.org
Alias| |CVE-2017-5845
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
Loading...