Bug 777263 – datetime: out of bounds read in gst_date_time_new_from_iso8601_string()

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 777263 - (CVE-2017-5838) datetime: out of bounds read in gst_date_time_new_from_iso8601_string()

(CVE-2017-5838)
Summary:	datetime: out of bounds read in gst_date_time_new_from_iso8601_string()


Status:	RESOLVED FIXED

Product:	GStreamer
Classification:	Platform
Component:	gstreamer (core)
Version:	git master
Hardware:	Other Linux

Importance:	Normal normal
Target Milestone:	1.10.3
Assigned To:	GStreamer Maintainers
QA Contact:	GStreamer Maintainers

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2017-01-15 09:41 UTC by Hanno Böck
Modified:	2017-02-14 06:21 UTC

See Also:
GNOME target:	---
GNOME version:	---

Attachments
oob heap poc (500 bytes, video/x-msvideo) 2017-01-15 09:41 UTC, Hanno Böck	Details

Description Hanno Böck 2017-01-15 09:41:00 UTC

Created attachment 343489 [details]
oob heap poc

When compiled with asan the attached file will trigger an out of bounds heap read.

ASAN error:
==17371==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300004dcf6 at pc 0x7ffb7e6935fb bp 0x7ffb7124b150 sp 0x7ffb7124b148
READ of size 1 at 0x60300004dcf6 thread T2 (avidemux0:sink)
    #0 0x7ffb7e6935fa in gst_date_time_new_from_iso8601_string /f/gstreamer/gstreamer/gst/gstdatetime.c:870:11
    #1 0x7ffb7e85dd85 in gst_value_deserialize_date_time /f/gstreamer/gstreamer/gst/gstvalue.c:6224:14
    #2 0x7ffb7e84d555 in gst_value_deserialize /f/gstreamer/gstreamer/gst/gstvalue.c:5607:12
    #3 0x7ffb7127168f in parse_tag_value /f/gstreamer/gst-plugins-base/gst-libs/gst/riff/riff-read.c:642:11
    #4 0x7ffb7127168f in gst_riff_parse_info /f/gstreamer/gst-plugins-base/gst-libs/gst/riff/riff-read.c:802
    #5 0x7ffb714ee5f9 in gst_avi_demux_stream_header_pull /f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:4209:13
    #6 0x7ffb714e6786 in gst_avi_demux_loop /f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:5687:13
    #7 0x7ffb7e7f78b3 in gst_task_func /f/gstreamer/gstreamer/gst/gsttask.c:334:5
    #8 0x7ffb7d9f4b2d in g_thread_pool_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
    #9 0x7ffb7d9f4154 in g_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
    #10 0x7ffb7d472453 in start_thread (/lib64/libpthread.so.0+0x7453)
    #11 0x7ffb7cfa25dc in clone (/lib64/libc.so.6+0xe75dc)

0x60300004dcf6 is located 0 bytes to the right of 22-byte region [0x60300004dce0,0x60300004dcf6)
allocated by thread T2 (avidemux0:sink) here:
    #0 0x4cbbb8 in malloc (/usr/bin/gst-discoverer-1.0+0x4cbbb8)
    #1 0x7ffb7d9d2768 in g_malloc /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gmem.c:94

Thread T2 (avidemux0:sink) created by T1 (typefind:sink) here:
    #0 0x42df2d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7ffb7da111bf in g_system_thread_new /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Thread T1 (typefind:sink) created by T0 here:
    #0 0x42df2d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7ffb7da111bf in g_system_thread_new /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Comment 1 Tim-Philipp Müller 2017-01-15 11:56:27 UTC

Thanks, should be fixed now:

 commit 9398b7f1a75b38844ae7050b5a7967e4cdebe24f
 Author: Tim-Philipp Müller <tim@centricular.com>
 Date:   Sun Jan 15 11:52:44 2017 +0000

    datetime: fix potential out-of-bound read on malformed datetime string
    
    https://bugzilla.gnome.org/show_bug.cgi?id=777263

Comment 2 Salvatore Bonaccorso 2017-02-14 06:21:44 UTC

This is CVE-2017-5838