mirror of
https://gitlab.freedesktop.org/gstreamer/gstreamer.git
synced 2024-12-23 00:36:51 +00:00
tagdemux: Fix crash when presented with malformed files
There's a race condition in gsttagdemux.c between typefinding and the end-of-stream event. If TYPE_FIND_MAX_SIZE is exceeded, demux->priv->collect is set to NULL and an error is returned. However, the end-of-stream event causes one last attempt at typefinding to occur. This leads to gst_tag_demux_trim_buffer() being called with the NULL demux->priv->collect buffer which it attempts to dereference, resulting in a segfault. The malicious MP3 can be created by: printf "\x49\x44\x33\x04\x00\x00\x00\x00\x00\x00%s", \ "$(dd if=/dev/urandom bs=1K count=200)" > malicious.mp3 This creates a valid ID3 header which gets us as far as typefinding. The crash can then be reproduced with the following pipeline: gst-launch-1.0 -e filesrc location=malicious.mp3 ! queue ! decodebin ! audioconvert ! vorbisenc ! oggmux ! filesink location=malicious.ogg Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/967 Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/1620>
This commit is contained in:
parent
34b54ca665
commit
3ddb4c6f0e
1 changed files with 5 additions and 3 deletions
|
@ -655,9 +655,11 @@ gst_tag_demux_chain_buffer (GstTagDemux * demux, GstBuffer * buf,
|
|||
|
||||
/* Trim the buffer and adjust offset for typefinding */
|
||||
typefind_buf = demux->priv->collect;
|
||||
gst_buffer_ref (typefind_buf);
|
||||
if (!gst_tag_demux_trim_buffer (demux, &typefind_buf, &typefind_size))
|
||||
return GST_FLOW_EOS;
|
||||
if (typefind_buf) {
|
||||
gst_buffer_ref (typefind_buf);
|
||||
if (!gst_tag_demux_trim_buffer (demux, &typefind_buf, &typefind_size))
|
||||
return GST_FLOW_EOS;
|
||||
}
|
||||
|
||||
if (typefind_buf == NULL)
|
||||
break; /* Still need more data */
|
||||
|
|
Loading…
Reference in a new issue