After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 777955 - (CVE-2017-5847) asfdemux: out of bounds read in gst_asf_demux_process_ext_content_desc
(CVE-2017-5847)
asfdemux: out of bounds read in gst_asf_demux_process_ext_content_desc
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-ugly
unspecified
Other Linux
: Normal normal
: 1.10.4
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2017-01-30 21:55 UTC by Hanno Böck
Modified: 2017-02-14 06:25 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
poc file (3.26 KB, video/x-ms-asf)
2017-01-30 21:55 UTC, Hanno Böck 		Details

Description Hanno Böck 2017-01-30 21:55:22 UTC 
Created attachment 344585 [details]
poc file

The attached file causes an out of bounds heap read.

asan error:
==21528==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000036f50 at pc 0x7fc0f14f51ad bp 0x7fc0f0b3efb0 sp 0x7fc0f0b3efa8
READ of size 4 at 0x602000036f50 thread T2 (asfdemux0:sink)
    #0 0x7fc0f14f51ac in __gst_fast_read32 /usr/include/gstreamer-1.0/gst/gstutils.h:122:10
    #1 0x7fc0f14f51ac in gst_asf_demux_process_ext_content_desc /f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:3442
    #2 0x7fc0f14f51ac in gst_asf_demux_process_object /f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:4437
    #3 0x7fc0f14f0225 in gst_asf_demux_process_header /f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:3638:11
    #4 0x7fc0f14f0225 in gst_asf_demux_process_object /f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:4422
    #5 0x7fc0f14dd682 in gst_asf_demux_pull_headers /f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:1229:10
    #6 0x7fc0f14dd682 in gst_asf_demux_loop /f/gstreamer/gst-plugins-ugly/gst/asfdemux/gstasfdemux.c:1984
    #7 0x7fc0fe747983 in gst_task_func /f/gstreamer/gstreamer/gst/gsttask.c:335:5
    #8 0x7fc0fd944b2d in g_thread_pool_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
    #9 0x7fc0fd944154 in g_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
    #10 0x7fc0fd3c2453 in start_thread (/lib64/libpthread.so.0+0x7453)
    #11 0x7fc0fcef25dc in clone (/lib64/libc.so.6+0xe75dc)

0x602000036f51 is located 0 bytes to the right of 1-byte region [0x602000036f50,0x602000036f51)
allocated by thread T2 (asfdemux0:sink) here:
    #0 0x4cbbb8 in malloc (/usr/bin/gst-discoverer-1.0+0x4cbbb8)
    #1 0x7fc0fd922768 in g_malloc /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gmem.c:94

Thread T2 (asfdemux0:sink) created by T1 (typefind:sink) here:
    #0 0x42df2d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7fc0fd9611bf in g_system_thread_new /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Thread T1 (typefind:sink) created by T0 here:
    #0 0x42df2d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7fc0fd9611bf in g_system_thread_new /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170
Comment 1 Sebastian Dröge (slomo) 2017-01-31 06:04:21 UTC 
valgrind does not seem to be complaining here
Comment 2 Sebastian Dröge (slomo) 2017-01-31 06:07:29 UTC 
... but some length checks would be useful nonetheless here :)
Comment 3 Sebastian Dröge (slomo) 2017-01-31 11:51:36 UTC 
I can't reproduce it, but this should fix it.

commit d21017b52a585f145e8d62781bcc1c5fefc7ee37
Author: Sebastian Dröge <sebastian@centricular.com>
Date:   Tue Jan 31 13:50:21 2017 +0200

    asfdemux: Check that we have enough data available before parsing bool/uint extended content descriptors
    
    https://bugzilla.gnome.org/show_bug.cgi?id=777955