GNOME Bugzilla – Bug 384996
Tailored or broken Real Media mux file crashes RM demuxer
Last modified: 2006-12-12 10:27:08 UTC
Steps to reproduce: 1. Download the sample file (attached below) 2. Try to play in any app that uses GStreamer. * bang * Stack trace: Don't pay too much attention to the stack trace; the cause is self-evident.
+ Trace 93505
Other information: Please see bug #384989. The crash happens because rmdemux blindly believes the length field in the mux file. I've changed it from 0x00000008 to 0xffffffff. Thus, rmdemux.c tries to allocate 4Gb of RAM for the data, which obviously fails: rmdemux.c:1640: stream->extra_data_size = RMDEMUX_GUINT32_GET (data + offset + 74); stream->extra_data = (guint8 *) data + offset + 78; rmdemux.c:1391: buffer = gst_buffer_new_and_alloc (stream->extra_data_size); memcpy (GST_BUFFER_DATA (buffer), stream->extra_data, stream->extra_data_size); Note: The sample file contains a version 5 stream, so this should happen with CVS HEAD (i.e. without the patch submitted to bug #384989).
Created attachment 78191 [details] Malicious RM mux file designed to crash GStreamer. I've had to truncate the mux file because it was too large to attach. However, the effect is the same.
Created attachment 78194 [details] [review] check extra codec data size Includes patch from bug #384989 to read the extra codec data size for stream version 4 instead of assuming it is always 16.
> Includes patch from bug #384989 to read the extra codec data size for stream > version 4 instead of assuming it is always 16. Actually, not quite true, I forgot the offset adjustment for the codec data for version 4 streams (71 => 73). Fixed in the commit. 2006-12-12 Tim-Philipp Müller <tim at centricular dot net> Based on patch by: Roland Kay <roland.kay at ox compsoc net> * gst/realmedia/rmdemux.c: (gst_rmdemux_parse_mdpr): For version 4 streams, read the extra codec data size from the header instead of assuming it is always 16 (also read it from the right position) (#384989). For version 4 and 5 streams, check that the specified extra codec data size doesn't make us read beyond the chunk boundary (#384989).