GNOME Bugzilla – Bug 665988
mpegtsparse: segfault on malformed packets when retrieving table_id
Last modified: 2011-12-13 09:45:34 UTC
Created attachment 203237 [details] pcap sample to reproduce the problem steps to reproduce: GST_DEBUG=mpegtsparse:2 gst-launch-0.10 filesrc location=espn_small_3.pcap ! pcapparse ! mpegtsparse ! fakesink
Created attachment 203238 [details] [review] check pointer when retrieving table id on malformed packets
Review of attachment 203238 [details] [review]: ::: gst/mpegdemux/mpegtsparse.c @@ +895,3 @@ data += pointer; + if (!(data - GST_BUFFER_DATA (packet->buffer) < + GST_BUFFER_SIZE (packet->buffer))) { This check is not very intuitive, maybe add a comment here why this is a problem
Created attachment 203252 [details] [review] check offset when retrieving table id This patch is equivalent than the previous one except I added a comment and I made the check more intuitive
commit e62978d045d57ee9fed7598c02b9017eb974ea36 Author: Julien Isorce <julien.isorce@gmail.com> Date: Mon Dec 12 14:54:00 2011 +0100 mpegtsparse: check offset when retrieving table_id on malformed packets
Created attachment 203256 [details] [review] Revert "mpegtsparse: check offset when retrieving table_id on malformed packets" This reverts commit e62978d045d57ee9fed7598c02b9017eb974ea36 Original commit is valid but not enough to avoid out of range. It supposes that GST_BUFFER_DATA (packet->buffer) is equal to packet->data which is wrong.
Created attachment 203257 [details] [review] mpegtsparse: check offset when retrieving table_id on malformed packets Should be ok now
commit f21ea162ad3047d38d6e678aded23449c48f9f21 Author: Julien Isorce <julien.isorce@gmail.com> Date: Mon Dec 12 15:52:20 2011 +0100 mpegtsparse: check offset when retrieving table_id on malformed packets Fix bug #665988 commit 0d40afa9f00df02a56be1e0081824d5916a23887 Author: Sebastian Dröge <sebastian.droege@collabora.co.uk> Date: Tue Dec 13 10:44:42 2011 +0100 Revert "mpegtsparse: check offset when retrieving table_id on malformed pack This reverts commit e62978d045d57ee9fed7598c02b9017eb974ea36.