Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP1:GA
gstreamer-plugins-bad.31942
gstreamer-mptssection-add-checks.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File gstreamer-mptssection-add-checks.patch of Package gstreamer-plugins-bad.31942
From d58f668ece8795bddb3316832e1848c7b7cf38ac Mon Sep 17 00:00:00 2001 From: Edward Hervey <edward@centricular.com> Date: Sat, 26 Nov 2016 10:44:43 +0100 Subject: [PATCH] mpegtssection: Add more section size checks The smallest section ever needs to be at least 3 bytes (i.e. just the short header). Non-short headers need to be at least 11 bytes long (3 for the minimum header, 5 for the non-short header, and 4 for the CRC). https://bugzilla.gnome.org/show_bug.cgi?id=775048 Backported by Mike Gorse <mgorse@suse.com> --- diff -urp gst-plugins-bad-1.2.4.orig/gst-libs/gst/mpegts/gstmpegtssection.c gst-plugins-bad-1.2.4/gst-libs/gst/mpegts/gstmpegtssection.c --- gst-plugins-bad-1.2.4.orig/gst-libs/gst/mpegts/gstmpegtssection.c 2013-09-24 08:06:21.000000000 -0500 +++ gst-plugins-bad-1.2.4/gst-libs/gst/mpegts/gstmpegtssection.c 2016-12-13 13:31:24.920016174 -0600 @@ -739,13 +739,20 @@ gst_mpegts_section_new (guint16 pid, gui { GstMpegTsSection *res = NULL; guint8 tmp; - guint16 section_length; + guint16 section_length = 0; + /* The smallest section ever is 3 bytes */ + if (G_UNLIKELY (data_size < 3)) + goto short_packet; + /* Check for length */ section_length = GST_READ_UINT16_BE (data + 1) & 0x0FFF; if (G_UNLIKELY (data_size < section_length + 3)) goto short_packet; + GST_LOG ("data_size:%" G_GSIZE_FORMAT " section_length:%u", + data_size, section_length); + res = g_slice_new0 (GstMpegTsSection); gst_mini_object_init (GST_MINI_OBJECT_CAST (res), 0, MPEG_TYPE_TS_SECTION, (GstMiniObjectCopyFunction) _gst_mpegts_section_copy, NULL, @@ -761,6 +768,13 @@ gst_mpegts_section_new (guint16 pid, gui /* section_length (already parsed) : 12 bit */ res->section_length = section_length + 3; if (!res->short_section) { + /* A long packet needs to be at least 11 bytes long + * _ 3 for the bytes above + * _ 5 for the bytes below + * _ 4 for the CRC */ + if (G_UNLIKELY (data_size < 11)) + goto bad_long_packet; + /* CRC is after section_length (-4 for the size of the CRC) */ res->crc = GST_READ_UINT32_BE (res->data + res->section_length - 4); /* Skip to after section_length */ @@ -791,4 +805,11 @@ short_packet: ", need:%d)", pid, data_size, section_length + 3); return NULL; } +bad_long_packet: + { + GST_WARNING ("PID 0x%04x long section is too short (%" G_GSIZE_FORMAT + " bytes, need at least 11)", pid, data_size); + gst_mpegts_section_unref (res); + return NULL; + } }
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor