gstreamer/subprojects/gst-plugins-good/gst/avi
Sebastian Dröge 0d9ce6c941 avidemux: Fix integer overflow resulting in heap corruption in DIB buffer inversion code
Check that width*bpp/8 doesn't overflow a guint and also that
height*stride fits into the provided buffer without overflowing.

Thanks to Adam Doupe for analyzing and reporting the issue.

CVE: CVE-2022-1921

See https://gstreamer.freedesktop.org/security/sa-2022-0001.html

Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1224

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2609>
2022-06-15 14:53:00 +00:00
..
avi-ids.h Move files from gst-plugins-good into the "subprojects/gst-plugins-good/" subdir 2021-09-24 16:13:50 -03:00
gstavi.c Move files from gst-plugins-good into the "subprojects/gst-plugins-good/" subdir 2021-09-24 16:13:50 -03:00
gstavidemux.c avidemux: Fix integer overflow resulting in heap corruption in DIB buffer inversion code 2022-06-15 14:53:00 +00:00
gstavidemux.h Move files from gst-plugins-good into the "subprojects/gst-plugins-good/" subdir 2021-09-24 16:13:50 -03:00
gstavielement.c Move files from gst-plugins-good into the "subprojects/gst-plugins-good/" subdir 2021-09-24 16:13:50 -03:00
gstavielements.h Move files from gst-plugins-good into the "subprojects/gst-plugins-good/" subdir 2021-09-24 16:13:50 -03:00
gstavimux.c Move files from gst-plugins-good into the "subprojects/gst-plugins-good/" subdir 2021-09-24 16:13:50 -03:00
gstavimux.h Move files from gst-plugins-good into the "subprojects/gst-plugins-good/" subdir 2021-09-24 16:13:50 -03:00
gstavisubtitle.c Move files from gst-plugins-good into the "subprojects/gst-plugins-good/" subdir 2021-09-24 16:13:50 -03:00
gstavisubtitle.h Move files from gst-plugins-good into the "subprojects/gst-plugins-good/" subdir 2021-09-24 16:13:50 -03:00
meson.build Move files from gst-plugins-good into the "subprojects/gst-plugins-good/" subdir 2021-09-24 16:13:50 -03:00
README Move files from gst-plugins-good into the "subprojects/gst-plugins-good/" subdir 2021-09-24 16:13:50 -03:00

The avi decoder plugins
-----------------------

The avi decoder consists of a set of gstreamer plugins:

 - demuxer (avidemux)
 - avi to gstreamer type converter (avitypes)
 - windows dlls wrappers.

the avidecoder element uses the above plugins to perform the avi
decoding. It is constructed as a custom bin which initially only has
the demuxer element in it. The demuxer has a set of padtemplates for
raw audio and video.

  (------------------------------------)
  ! avidecoder                         !
  !                                 (video/raw)...
  !     (----------)                   !
  !     ! demuxer (video/x-msvideo, auds)..
  !     !          !                   !
  !   -src         !                   !
  !  /  !         (video/x-msvideo, vids)..
 - src  !          !                   !
  !     (----------)                (audio/raw)...
  !                                    !
  (------------------------------------)

the demuxer has a set of padtemplates for the raw avi header properties.

The avi decoder will act on the new_pad signal of the demuxer element
and will attach an avitype plugin to the new pad. Caps negotiation will
convert the raw avi caps to the gstreamer caps. If the src pad of the
avitypes plugin are compatible with the avidecoder padtemplate, the 
avitype pad is ghosted to the avidecoder bin, this is the case where no
codec is needed (for raw PCM samples, for example).

When the avitypes caps are not compatible with one of the avidecoder 
templates, a static autoplugger is used the find an element to connect
the demuxers pad to the decoders padtemplate.

When no element could be found, an windec plugin is attached to the 
demuxers pad and the avitypes plugin is removed from the decoder.


example:
--------

 An avidecoder that has a video pad (decoded with windows dlls) and an
 audio pad (raw PCM).

  (----------------------------------------------------------------)
  ! avidecoder               (--------)    (------)                !
  !                          !avitypes!    !windec!       /-- (video/raw)
  !     (----------)     /-sink      src--sink   src -----         !
  !     !demuxer (video/x-msvideo,    !    !      !                !
  !     !          ! auds).. (--------)    (------)                !  
  !   -sink        !         (--------)                            !
  !  /  !        (video/x-..,!avitypes!                            !
 -sink  !          ! vids).. !        !                            !
  !     (----------)     \-sink      src -------------------- (audio/raw)
  !                          (--------)                            !
  (----------------------------------------------------------------)



TODO
----

automatically generate the padtemplates from all possible avi types
found in the registry.