After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 759547 - dashdemux: insufficient validation of UTCtiming element
dashdemux: insufficient validation of UTCtiming element
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-bad
git master
Other Linux
: Normal normal
: 1.7.1
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2015-12-16 13:57 UTC by Florin Apostol
Modified: 2015-12-16 16:21 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
proposed fix and unit tests (4.06 KB, patch)
2015-12-16 14:02 UTC, Florin Apostol 		committed Details | Review

Description Florin Apostol 2015-12-16 13:57:44 UTC 
gst_mpdparser_parse_utctiming_node does not validate the parsed values completely. The following scenarios are incorrectly accepted:
- elements with no schemeIdUri property should be rejected
- elements with unrecognized UTCTiming scheme should be rejected
- elements with empty values should be rejected

The last one triggers a division by 0 in gst_dash_demux_poll_clock_drift:
clock_drift->selected_url = clock_drift->selected_url % g_strv_length (urls);
because it urls is a valid pointer to an empty array.
Comment 1 Florin Apostol 2015-12-16 14:02:16 UTC 
Created attachment 317499 [details] [review]
proposed fix and unit tests
Comment 2 Sebastian Dröge (slomo) 2015-12-16 16:21:11 UTC 
commit b2e689890f046d9679932347e08648b4bc2f3d93
Author: Florin Apostol <florin.apostol@oregan.net>
Date:   Wed Dec 16 13:59:18 2015 +0000

    dashdemux: improve validation of UTCtiming element
    
    gst_mpdparser_parse_utctiming_node does not validate the parsed values completely. The following scenarios are incorrectly accepted:
    - elements with no schemeIdUri property should be rejected
    - elements with unrecognized UTCTiming scheme should be rejected
    - elements with empty values should be rejected
    
    The last one triggers a division by 0 in gst_dash_demux_poll_clock_drift:
    clock_drift->selected_url = clock_drift->selected_url % g_strv_length (urls);
    because it urls is a valid pointer to an empty array.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=759547