After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 777503 - (CVE-2017-5843) mxfdemux: use after free in gst_mini_object_unref / gst_tag_list_unref / gst_mxf_demux_update_essence_tracks
(CVE-2017-5843)
mxfdemux: use after free in gst_mini_object_unref / gst_tag_list_unref / gst_...
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-bad
unspecified
Other Linux
: Normal normal
: 1.10.3
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2017-01-19 17:50 UTC by Hanno Böck
Modified: 2017-02-14 06:24 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
mxfdemux: Set stream tags to NULL after unreffing (924 bytes, patch)
2017-01-20 05:51 UTC, Sebastian Dröge (slomo)
committed Details | Review

Description Hanno Böck 2017-01-19 17:50:44 UTC
File:
https://samples.mplayerhq.hu/ffmpeg-bugs/roundup/issue591/02785736.mxf

Needs env var G_SLICE=always-malloc set to show up with asan.

asan error:
==28913==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000014d88 at pc 0x7f0975f7b2b0 bp 0x7f0968ab9280 sp 0x7f0968ab9278
READ of size 4 at 0x607000014d88 thread T2 (mxfdemux0:sink)
    #0 0x7f0975f7b2af in gst_mini_object_unref /f/gstreamer/gstreamer/gst/gstminiobject.c:432:3
    #1 0x7f0968db06c9 in gst_tag_list_unref /usr/include/gstreamer-1.0/gst/gsttaglist.h:407:3
    #2 0x7f0968db06c9 in gst_mxf_demux_update_essence_tracks /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:873
    #3 0x7f0968db06c9 in gst_mxf_demux_update_tracks /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:915
    #4 0x7f0968da563e in gst_mxf_demux_handle_klv_packet /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:2484:16
    #5 0x7f0968dc79c7 in gst_mxf_demux_pull_and_handle_klv_packet /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:2925:9
    #6 0x7f0968dc79c7 in gst_mxf_demux_loop /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:3030
    #7 0x7f0976067883 in gst_task_func /f/gstreamer/gstreamer/gst/gsttask.c:334:5
    #8 0x7f0975264b2d in g_thread_pool_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
    #9 0x7f0975264154 in g_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
    #10 0x7f0974ce2453 in start_thread (/lib64/libpthread.so.0+0x7453)
    #11 0x7f09748125dc in clone (/lib64/libc.so.6+0xe75dc)

0x607000014d88 is located 8 bytes inside of 80-byte region [0x607000014d80,0x607000014dd0)
freed by thread T2 (mxfdemux0:sink) here:
    #0 0x4cba00 in __interceptor_cfree.localalias.1 (/usr/bin/gst-discoverer-1.0+0x4cba00)
    #1 0x7f0976061ce9 in __gst_tag_list_free /f/gstreamer/gstreamer/gst/gsttaglist.c:717:3
    #2 0x7f0975f7b238 in gst_mini_object_unref /f/gstreamer/gstreamer/gst/gstminiobject.c:456:9
    #3 0x7f0968db05e1 in gst_tag_list_unref /usr/include/gstreamer-1.0/gst/gsttaglist.h:407:3
    #4 0x7f0968db05e1 in gst_mxf_demux_update_essence_tracks /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:837
    #5 0x7f0968db05e1 in gst_mxf_demux_update_tracks /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:915
    #6 0x7f0968da563e in gst_mxf_demux_handle_klv_packet /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:2484:16
    #7 0x7f0968dc79c7 in gst_mxf_demux_pull_and_handle_klv_packet /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:2925:9
    #8 0x7f0968dc79c7 in gst_mxf_demux_loop /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:3030
    #9 0x7f0976067883 in gst_task_func /f/gstreamer/gstreamer/gst/gsttask.c:334:5
    #10 0x7f0975264b2d in g_thread_pool_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
    #11 0x7f0975264154 in g_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
    #12 0x7f0974ce2453 in start_thread (/lib64/libpthread.so.0+0x7453)
    #13 0x7f09748125dc in clone (/lib64/libc.so.6+0xe75dc)

previously allocated by thread T2 (mxfdemux0:sink) here:
    #0 0x4cbbb8 in malloc (/usr/bin/gst-discoverer-1.0+0x4cbbb8)
    #1 0x7f0975242768 in g_malloc /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gmem.c:94
    #2 0x7f097525a4d2 in g_slice_alloc /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gslice.c:1025
    #3 0x7f09760565cc in gst_tag_list_new_internal /f/gstreamer/gstreamer/gst/gsttaglist.c:690:29
    #4 0x7f09760565cc in gst_tag_list_new_empty /f/gstreamer/gstreamer/gst/gsttaglist.c:748
    #5 0x7f0968dd84a9 in mxf_bwf_create_caps /f/gstreamer/gst-plugins-bad/gst/mxf/mxfaes-bwf.c:1339:13
    #6 0x7f0968dd84a9 in mxf_aes_bwf_create_caps /f/gstreamer/gst-plugins-bad/gst/mxf/mxfaes-bwf.c:1457
    #7 0x7f0968dafb82 in gst_mxf_demux_update_essence_tracks /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:826:13
    #8 0x7f0968dafb82 in gst_mxf_demux_update_tracks /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:915
    #9 0x7f0968da563e in gst_mxf_demux_handle_klv_packet /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:2484:16
    #10 0x7f0968dc79c7 in gst_mxf_demux_pull_and_handle_klv_packet /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:2925:9
    #11 0x7f0968dc79c7 in gst_mxf_demux_loop /f/gstreamer/gst-plugins-bad/gst/mxf/mxfdemux.c:3030
    #12 0x7f0976067883 in gst_task_func /f/gstreamer/gstreamer/gst/gsttask.c:334:5
    #13 0x7f0975264b2d in g_thread_pool_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
    #14 0x7f0975264154 in g_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
    #15 0x7f0974ce2453 in start_thread (/lib64/libpthread.so.0+0x7453)
    #16 0x7f09748125dc in clone (/lib64/libc.so.6+0xe75dc)

Thread T2 (mxfdemux0:sink) created by T1 (typefind:sink) here:
    #0 0x42df2d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7f09752811bf in g_system_thread_new /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Thread T1 (typefind:sink) created by T0 here:
    #0 0x42df2d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7f09752811bf in g_system_thread_new /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

SUMMARY: AddressSanitizer: heap-use-after-free /f/gstreamer/gstreamer/gst/gstminiobject.c:432:3 in gst_mini_object_unref
Comment 1 Sebastian Dröge (slomo) 2017-01-20 05:51:44 UTC
Created attachment 343858 [details] [review]
mxfdemux: Set stream tags to NULL after unreffing

Otherwise we might try to unref them a second time a little bit later.
Comment 2 Sebastian Dröge (slomo) 2017-01-20 05:51:59 UTC
Attachment 343858 [details] pushed as 08723e6 - mxfdemux: Set stream tags to NULL after unreffing