After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 777532 - (CVE-2017-5845) avidemux: invalid memory read in gst_avi_demux_parse_ncdt
(CVE-2017-5845)
avidemux: invalid memory read in gst_avi_demux_parse_ncdt
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-good
unspecified
Other Linux
: Normal normal
: 1.10.3
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2017-01-20 12:08 UTC by Hanno Böck
Modified: 2017-02-14 06:24 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
avidemux: Stop reading a ncdt sub-tag if it goes behind the surrounding tag (954 bytes, patch)
2017-01-20 15:18 UTC, Sebastian Dröge (slomo)
committed Details | Review

Description Hanno Böck 2017-01-20 12:08:42 UTC
This may be a followup bug of the fix of
https://bugzilla.gnome.org/show_bug.cgi?id=777500

file:
https://samples.mplayerhq.hu/ffmpeg-bugs/trac/ticket3330/DSCN0902.AVI

asan trace:
==31237==ERROR: AddressSanitizer: SEGV on unknown address 0x622000023fbc (pc 0x7fb741b01274 bp 0x7fb74184b5b0 sp 0x7fb74184b420 T2)
==31237==The signal is caused by a READ memory access.
    #0 0x7fb741b01273 in __gst_fast_read16 /usr/include/gstreamer-1.0/gst/gstutils.h:119:10
    #1 0x7fb741b01273 in gst_avi_demux_parse_ncdt /f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:3910
    #2 0x7fb741aee4ae in gst_avi_demux_stream_header_pull /f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:4248:13
    #3 0x7fb741ae6796 in gst_avi_demux_loop /f/gstreamer/gst-plugins-good/gst/avi/gstavidemux.c:5691:13
    #4 0x7fb74ed81973 in gst_task_func /f/gstreamer/gstreamer/gst/gsttask.c:334:5
    #5 0x7fb74df7eb2d in g_thread_pool_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
    #6 0x7fb74df7e154 in g_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
    #7 0x7fb74d9fc453 in start_thread (/lib64/libpthread.so.0+0x7453)
    #8 0x7fb74d52c5dc in clone (/lib64/libc.so.6+0xe75dc)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /usr/include/gstreamer-1.0/gst/gstutils.h:119:10 in __gst_fast_read16
Thread T2 (avidemux0:sink) created by T1 (typefind:sink) here:
    #0 0x42df2d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7fb74df9b1bf in g_system_thread_new /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Thread T1 (typefind:sink) created by T0 here:
    #0 0x42df2d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7fb74df9b1bf in g_system_thread_new /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

==31237==ABORTING
Comment 1 Sebastian Dröge (slomo) 2017-01-20 12:42:16 UTC
Confirmed, but not sure why yet. Looking again later
Comment 2 Sebastian Dröge (slomo) 2017-01-20 15:18:42 UTC
Created attachment 343909 [details] [review]
avidemux: Stop reading a ncdt sub-tag if it goes behind the surrounding tag
Comment 3 Sebastian Dröge (slomo) 2017-01-20 15:18:55 UTC
Attachment 343909 [details] pushed as 4f47835 - avidemux: Stop reading a ncdt sub-tag if it goes behind the surrounding tag