diff options
author | Sebastian Dröge <sebastian@centricular.com> | 2021-03-03 11:05:14 +0200 |
---|---|---|
committer | Tim-Philipp Müller <tim@centricular.com> | 2021-03-15 13:01:20 +0000 |
commit | a991c2f21360e63ac31e0a09716f69f122ff653f (patch) | |
tree | 0b0c5ae23df463239765d4af255d99e0669bed92 | |
parent | 623870567900f6a44889cb103a50af4d24121d28 (diff) |
rmdemux: Make sure we have enough data available when parsing audio/video packets1.14
Otherwise there will be out-of-bounds reads and potential crashes.
Thanks to Natalie Silvanovich for reporting.
Fixes https://gitlab.freedesktop.org/gstreamer/gst-plugins-ugly/-/issues/37
Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-ugly/-/merge_requests/77>
-rw-r--r-- | gst/realmedia/rmdemux.c | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/gst/realmedia/rmdemux.c b/gst/realmedia/rmdemux.c index 6634c225..a78dd6e1 100644 --- a/gst/realmedia/rmdemux.c +++ b/gst/realmedia/rmdemux.c @@ -2220,6 +2220,9 @@ gst_rmdemux_parse_video_packet (GstRMDemux * rmdemux, GstRMDemuxStream * stream, gst_buffer_map (in, &map, GST_MAP_READ); + if (map.size < offset) + goto not_enough_data; + data = map.data + offset; size = map.size - offset; @@ -2286,6 +2289,9 @@ gst_rmdemux_parse_video_packet (GstRMDemux * rmdemux, GstRMDemuxStream * stream, } GST_DEBUG_OBJECT (rmdemux, "fragment size %d", fragment_size); + if (map.size < (data - map.data) + fragment_size) + goto not_enough_data; + /* get the fragment */ fragment = gst_buffer_copy_region (in, GST_BUFFER_COPY_ALL, data - map.data, @@ -2434,6 +2440,9 @@ gst_rmdemux_parse_audio_packet (GstRMDemux * rmdemux, GstRMDemuxStream * stream, GstFlowReturn ret; GstBuffer *buffer; + if (gst_buffer_get_size (in) < offset) + goto not_enough_data; + buffer = gst_buffer_copy_region (in, GST_BUFFER_COPY_MEMORY, offset, -1); if (rmdemux->first_ts != -1 && timestamp > rmdemux->first_ts) @@ -2464,9 +2473,19 @@ gst_rmdemux_parse_audio_packet (GstRMDemux * rmdemux, GstRMDemuxStream * stream, ret = gst_pad_push (stream->pad, buffer); } +done: gst_buffer_unref (in); return ret; + + /* ERRORS */ +not_enough_data: + { + GST_ELEMENT_WARNING (rmdemux, STREAM, DECODE, ("Skipping bad packet."), + (NULL)); + ret = GST_FLOW_OK; + goto done; + } } static GstFlowReturn @@ -2487,6 +2506,9 @@ gst_rmdemux_parse_packet (GstRMDemux * rmdemux, GstBuffer * in, guint16 version) data = map.data; size = map.size; + if (size < 4 + 6 + 1 + 2) + goto not_enough_data; + /* stream number */ id = RMDEMUX_GUINT16_GET (data); @@ -2522,6 +2544,9 @@ gst_rmdemux_parse_packet (GstRMDemux * rmdemux, GstBuffer * in, guint16 version) /* version 1 has an extra byte */ if (version == 1) { + if (size < 1) + goto not_enough_data; + data += 1; size -= 1; } @@ -2593,6 +2618,16 @@ unknown_stream: gst_buffer_unref (in); return GST_FLOW_OK; } + + /* ERRORS */ +not_enough_data: + { + GST_ELEMENT_WARNING (rmdemux, STREAM, DECODE, ("Skipping bad packet."), + (NULL)); + gst_buffer_unmap (in, &map); + gst_buffer_unref (in); + return GST_FLOW_OK; + } } gboolean |