After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 399342 - [mpeg2dec] crash in libmpeg2 with specially crafted .m2v file
[mpeg2dec] crash in libmpeg2 with specially crafted .m2v file
Status: RESOLVED NOTGNOME
Product: GStreamer
Classification: Platform
Component: gst-plugins-ugly
0.10.5
Other Linux
: Normal major
: NONE
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2007-01-22 11:27 UTC by Loïc Minier
Modified: 2007-03-08 14:05 UTC
See Also:
GNOME target: ---
GNOME version: ---


Description Loïc Minier 2007-01-22 11:27:12 UTC 
Hi,

Sam Hocevar reported three different issues with GStreamer 0.10 modules in
Debian bug http://bugs.debian.org/407004.  The bugs were discovered with the
help of a new media file fuzzer, "zzuf", which is available from
http://sam.zoy.org/zzuf/.

This particular bug is about the hang that happens when trying to play
http://sam.zoy.org/zzuf/lol-gstreamer.m2v.

This results in a segfault, obviously during MPEG2 decoding, but I couldn't get a clean backtrace:

+ Trace 104252

Thread 4 (Thread -1238971472 (LWP 1146))

  • #0 ??
  • #1 mpeg2_slice
    from /usr/lib/libmpeg2.so.0
  • #2 ??
  • #3 ?? 

This is with plugins-ugly 0.10.5, plugins-base 0.10.11, and GStreamer 0.10.11.

Bye,
Comment 1 Tim-Philipp Müller 2007-03-08 13:15:18 UTC 
Stack trace against libmpeg2 CVS from today:

Program received signal SIGSEGV, Segmentation fault.

mpeg2_init_fbuf (decoder=0x813a840, current_fbuf=0x0, forward_fbuf=0x813ec40, backward_fbuf=0x813ec30) at slice.c:1600

1600        decoder->picture_dest[0] = current_fbuf[0] + offset;

(gdb) print current_fbuf[0]
Cannot access memory at address 0x0

(gdb) bt

+ Trace 116881

  • #0 mpeg2_init_fbuf
    at slice.c line 1600
  • #1 mpeg2_header_slice_start
    at header.c line 923
  • #2 mpeg2_parse
    at decode.c line 159
  • #3 gst_mpeg2dec_chain
    at gstmpeg2dec.c line 985 


Anyone know if this is our fault or libmpeg2dec's?

(Also - regarding the security keyword - is a NULL dereference actually exploitable?)
Comment 2 Loïc Minier 2007-03-08 13:43:58 UTC 
Re: security: It's at least a DoS.  :-)
Comment 3 Loïc Minier 2007-03-08 13:55:24 UTC 
Concerning upstream-ness, I asked Sam Hocevar who is the current upstream for libmpeg2, and he said this is a libmpeg2 issue, not a GStreamer issue.

He prefers tracking the issue in the Debian bug tracker as he is co-maintaining the Debian packages with me there; hence, I'll reassign Debian bug 407004 to libmpeg2.
Comment 4 Loïc Minier 2007-03-08 13:58:00 UTC 
Err Debian bug http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=407922, sorry.
Comment 5 Tim-Philipp Müller 2007-03-08 14:05:57 UTC 
Okay, will close this as NOTGNOME then. Thanks for following this up.