After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 777525 - (CVE-2017-5844) floating point exception in gst_riff_create_audio_caps (different than #777262)
(CVE-2017-5844)
floating point exception in gst_riff_create_audio_caps (different than #777262)
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-base
unspecified
Other Linux
: Normal normal
: 1.10.3
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2017-01-20 09:58 UTC by Hanno Böck
Modified: 2017-02-14 06:24 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
poc file (1.05 KB, video/x-ms-asf)
2017-01-20 09:58 UTC, Hanno Böck 		  Details
riff-media: Don't divide block align by zero channels (2.53 KB, patch)
2017-01-20 10:42 UTC, Sebastian Dröge (slomo) 		committed Details | Review

Description Hanno Böck 2017-01-20 09:58:43 UTC 
Created attachment 343888 [details]
poc file

This looks very similar to
https://bugzilla.gnome.org/show_bug.cgi?id=777262
but it still happens after the fix for the above bug.

Found with afl.

==19886==ERROR: AddressSanitizer: FPE on unknown address 0x7f866bc99e64 (pc 0x7f866bc99e64 bp 0x7f866b53ec20 sp 0x7f866b53ea80 T2)
    #0 0x7f866bc99e63 in gst_riff_create_audio_caps /f/gstreamer/gst-plugins-base/gst-libs/gst/riff/riff-media.c:1302:26
    #1 0x7f866befbbc6 in gst_asf_demux_add_audio_stream /f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:2681:10
    #2 0x7f866befbbc6 in gst_asf_demux_parse_stream_object /f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:3036
    #3 0x7f866beeb3fd in gst_asf_demux_process_object /f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:4414:7
    #4 0x7f866bef0226 in gst_asf_demux_process_header /f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:3638:11
    #5 0x7f866bef0226 in gst_asf_demux_process_object /f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:4421
    #6 0x7f866bedd682 in gst_asf_demux_pull_headers /f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:1229:10
    #7 0x7f866bedd682 in gst_asf_demux_loop /f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:1984
    #8 0x7f867915f883 in gst_task_func /f/gstreamer/gstreamer/gst/gsttask.c:334:5
    #9 0x7f867835cb2d in g_thread_pool_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
    #10 0x7f867835c154 in g_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
    #11 0x7f8677dda453 in start_thread (/lib64/libpthread.so.0+0x7453)
    #12 0x7f867790a5dc in clone (/lib64/libc.so.6+0xe75dc)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE /f/gstreamer/gst-plugins-base/gst-libs/gst/riff/riff-media.c:1302:26 in gst_riff_create_audio_caps
Thread T2 (asfdemux0:sink) created by T1 (typefind:sink) here:
    #0 0x42df2d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7f86783791bf in g_system_thread_new /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Thread T1 (typefind:sink) created by T0 here:
    #0 0x42df2d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7f86783791bf in g_system_thread_new /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

==19886==ABORTING
Comment 1 Sebastian Dröge (slomo) 2017-01-20 10:41:50 UTC 
commit 5d505d108800cef210f67dcfed2801ba36beac2a
Author: Sebastian Dröge <sebastian@centricular.com>
Date:   Fri Jan 20 12:41:16 2017 +0200

    riff-media: Don't divide block align by zero channels
    
    https://bugzilla.gnome.org/show_bug.cgi?id=777525
Comment 2 Sebastian Dröge (slomo) 2017-01-20 10:42:00 UTC 
Created attachment 343891 [details] [review]
riff-media: Don't divide block align by zero channels