mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2024-12-18 22:36:33 +00:00
Code Issues 1 Projects Releases Wiki Activity

qtdemux: Make sure enough data is available before reading wave header node

Browse source 
Thanks to Antonio Morales for finding and reporting the issue.

Fixes GHSL-2024-236
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3843

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059>
This commit is contained in:
Sebastian Dröge 2024-09-26 14:17:02 +03:00 committed by GStreamer Marge Bot
parent 1d534ac209
commit c1cd838706
1 changed files with 38 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
View file

@ -13704,6 +13704,10 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
} else { } else {
guint32 datalen = QT_UINT32 (stsd_entry_data + offset + 16); guint32 datalen = QT_UINT32 (stsd_entry_data + offset + 16);
const guint8 *data = stsd_entry_data + offset + 16; const guint8 *data = stsd_entry_data + offset + 16;
if (len < datalen || len - datalen < offset + 16) {
GST_WARNING_OBJECT (qtdemux, "Not enough data for waveheadernode");
} else {
GNode *wavenode; GNode *wavenode;
GNode *waveheadernode; GNode *waveheadernode;
@ -13712,7 +13716,8 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
const guint8 *waveheader; const guint8 *waveheader;
guint32 headerlen; guint32 headerlen;
waveheadernode = qtdemux_tree_get_child_by_type (wavenode, fourcc); waveheadernode =
qtdemux_tree_get_child_by_type (wavenode, fourcc);
if (waveheadernode) { if (waveheadernode) {
waveheader = (const guint8 *) waveheadernode->data; waveheader = (const guint8 *) waveheadernode->data;
headerlen = QT_UINT32 (waveheader); headerlen = QT_UINT32 (waveheader);
@ -13733,8 +13738,8 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
gst_caps_unref (entry->caps); gst_caps_unref (entry->caps);
/* FIXME: Need to do something with the channel reorder map */ /* FIXME: Need to do something with the channel reorder map */
entry->caps = entry->caps =
gst_riff_create_audio_caps (header->format, NULL, header, gst_riff_create_audio_caps (header->format, NULL,
extra, NULL, NULL, NULL); header, extra, NULL, NULL, NULL);
if (extra) if (extra)
gst_buffer_unref (extra); gst_buffer_unref (extra);
@ -13746,6 +13751,7 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
} }
g_node_destroy (wavenode); g_node_destroy (wavenode);
} }
}
} else if (esds) { } else if (esds) {
gst_qtdemux_handle_esds (qtdemux, stream, entry, esds, gst_qtdemux_handle_esds (qtdemux, stream, entry, esds,
stream->stream_tags); stream->stream_tags);