diff options
| author | CoprDistGit <infra@openeuler.org> | 2024-08-05 02:22:27 +0000 |
|---|---|---|
| committer | CoprDistGit <infra@openeuler.org> | 2024-08-05 02:22:27 +0000 |
| commit | fb6b1e565e19d948dada9270c9b7aa6b3c93700a (patch) | |
| tree | 3a5cb31908326677a6a60aef9562c6d447421660 /0002-mxfdemux-Check-number-of-channels-for-AES3-audio.patch | |
| parent | 29fa2f7f6cf5e2407aadc5b9446a6bdaf98e72a6 (diff) | |
automatic import of gstreamer1-plugins-bad-freeopeneuler24.03_LTS
Diffstat (limited to '0002-mxfdemux-Check-number-of-channels-for-AES3-audio.patch')
| -rw-r--r-- | 0002-mxfdemux-Check-number-of-channels-for-AES3-audio.patch | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/0002-mxfdemux-Check-number-of-channels-for-AES3-audio.patch b/0002-mxfdemux-Check-number-of-channels-for-AES3-audio.patch new file mode 100644 index 0000000..3c55bb3 --- /dev/null +++ b/0002-mxfdemux-Check-number-of-channels-for-AES3-audio.patch @@ -0,0 +1,45 @@ +From cfccf4b36197359271c95f20bfcda854f6c812cc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com> +Date: Thu, 10 Aug 2023 15:47:03 +0300 +Subject: [PATCH 2/4] mxfdemux: Check number of channels for AES3 audio + +Only up to 8 channels are allowed and using a higher number would cause +integer overflows when copying the data, and lead to out of bound +writes. + +Also check that each buffer is at least 4 bytes long to avoid another +overflow. + +Fixes ZDI-CAN-21661, CVE-2023-40475 + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2897 + +Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5362> +--- + subprojects/gst-plugins-bad/gst/mxf/mxfd10.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/subprojects/gst-plugins-bad/gst/mxf/mxfd10.c b/subprojects/gst-plugins-bad/gst/mxf/mxfd10.c +index 66c071372a..060d5a02de 100644 +--- a/subprojects/gst-plugins-bad/gst/mxf/mxfd10.c ++++ b/subprojects/gst-plugins-bad/gst/mxf/mxfd10.c +@@ -119,7 +119,7 @@ mxf_d10_sound_handle_essence_element (const MXFUL * key, GstBuffer * buffer, + gst_buffer_map (buffer, &map, GST_MAP_READ); + + /* Now transform raw AES3 into raw audio, see SMPTE 331M */ +- if ((map.size - 4) % 32 != 0) { ++ if (map.size < 4 || (map.size - 4) % 32 != 0) { + gst_buffer_unmap (buffer, &map); + GST_ERROR ("Invalid D10 sound essence buffer size"); + return GST_FLOW_ERROR; +@@ -219,6 +219,7 @@ mxf_d10_create_caps (MXFMetadataTimelineTrack * track, GstTagList ** tags, + GstAudioFormat audio_format; + + if (s->channel_count == 0 || ++ s->channel_count > 8 || + s->quantization_bits == 0 || + s->audio_sampling_rate.n == 0 || s->audio_sampling_rate.d == 0) { + GST_ERROR ("Invalid descriptor"); +-- +2.43.0 + |