After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 777957 - (CVE-2017-5848) mpegdemux: Invalid memory read in gst_ps_demux_parse_psm
(CVE-2017-5848)
mpegdemux: Invalid memory read in gst_ps_demux_parse_psm
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-bad
unspecified
Other Linux
: Normal normal
: 1.10.4
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2017-01-30 22:54 UTC by Hanno Böck
Modified: 2017-02-14 06:27 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
psdemux: Rewrite PSM parsing using GstByteReader (33.13 KB, patch)
2017-02-01 03:41 UTC, Jan Schmidt 		committed Details | Review

Description Hanno Böck 2017-01-30 22:54:16 UTC 
File:
https://samples.mplayerhq.hu/ffmpeg-bugs/trac/ticket4182/alamic.mpg

asan error:
==6863==ERROR: AddressSanitizer: SEGV on unknown address 0x62d0014f31a8 (pc 0x7f44fe7c0477 bp 0x62d0014f31a8 sp 0x7f44fe79a900 T2)
==6863==The signal is caused by a READ memory access.
    #0 0x7f44fe7c0476 in __gst_fast_read_swap16 /usr/include/gstreamer-1.0/gst/gstutils.h:128:10
    #1 0x7f44fe7c0476 in gst_ps_demux_parse_psm /f/gstreamer/gst-plugins-bad/gst/mpegdemux/gstmpegdemux.c:2121
    #2 0x7f44fe7c0476 in gst_ps_demux_chain /f/gstreamer/gst-plugins-bad/gst/mpegdemux/gstmpegdemux.c:3201
    #3 0x7f44fe7bddeb in gst_ps_demux_pull_block /f/gstreamer/gst-plugins-bad/gst/mpegdemux/gstmpegdemux.c:2875:9
    #4 0x7f44fe7b5eb1 in gst_ps_demux_loop /f/gstreamer/gst-plugins-bad/gst/mpegdemux/gstmpegdemux.c:2905:11
    #5 0x7f450be3e983 in gst_task_func /f/gstreamer/gstreamer/gst/gsttask.c:335:5
    #6 0x7f450b03bb2d in g_thread_pool_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
    #7 0x7f450b03b154 in g_thread_proxy /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
    #8 0x7f450aab9453 in start_thread (/lib64/libpthread.so.0+0x7453)
    #9 0x7f450a5e95dc in clone (/lib64/libc.so.6+0xe75dc)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /usr/include/gstreamer-1.0/gst/gstutils.h:128:10 in __gst_fast_read_swap16
Thread T2 (mpegpsdemux0:si) created by T1 (typefind:sink) here:
    #0 0x42df2d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7f450b0581bf in g_system_thread_new /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Thread T1 (typefind:sink) created by T0 here:
    #0 0x42df2d in __interceptor_pthread_create (/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7f450b0581bf in g_system_thread_new /var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

==6863==ABORTING
Comment 1 Sebastian Dröge (slomo) 2017-01-31 06:04:18 UTC 
valgrind does not seem to be complaining here
Comment 2 Sebastian Dröge (slomo) 2017-01-31 06:07:32 UTC 
... but some length checks would be useful nonetheless here :)
Comment 3 Jan Schmidt 2017-02-01 03:41:36 UTC 
Created attachment 344676 [details] [review]
psdemux: Rewrite PSM parsing using GstByteReader

Avoid possible buffer overflows and ignore invalid PSM packets better
by using GstByteReader.
Comment 4 Jan Schmidt 2017-02-01 03:47:30 UTC 
I also can't find the same error, but the psm parsing code definitely isn't safe. Here's a rewrite - thanks!
Comment 5 Victor Toso 2017-02-07 11:04:29 UTC 
For those who want to cherry pick

commit 948b87bf1514de55ee96575d204140eeec3a80a8
Author: Jan Schmidt <jan@centricular.com>
Date:   Wed Feb 1 14:25:32 2017 +1100

    psdemux: Rewrite PSM parsing using GstByteReader
    
    Avoid possible buffer overflows and ignore invalid PSM packets better
    by using GstByteReader.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=777957