[Bug 777469] New: qtdemux: out of bounds heap read in qtdemux_parse_samples

[GStreamer (GNOME Bugzilla)]

https://bugzilla.gnome.org/show_bug.cgi?id=777469

            Bug ID: 777469
           Summary: qtdemux: out of bounds heap read in
                    qtdemux_parse_samples
    Classification: Platform
           Product: GStreamer
           Version: unspecified
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: Normal
         Component: gst-plugins-good
          Assignee: gstreamer-bugs at lists.freedesktop.org
          Reporter: hanno at hboeck.de
        QA Contact: gstreamer-bugs at lists.freedesktop.org
     GNOME version: ---

Created attachment 343753
  --> https://bugzilla.gnome.org/attachment.cgi?id=343753&action=edit
poc file

Another afl/asan finding.

Stack trace:
==31234==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60200002bec0 at pc 0x7f97aa3afd71 bp 0x7f97a9e584c0 sp 0x7f97a9e584b8
READ of size 4 at 0x60200002bec0 thread T2 (qtdemux0:sink)
    #0 0x7f97aa3afd70 in __gst_fast_read_swap32
/usr/include/gstreamer-1.0/gst/gstutils.h:131:10
    #1 0x7f97aa3afd70 in gst_byte_reader_peek_uint32_be_unchecked
/usr/include/gstreamer-1.0/gst/base/gstbytereader.h:205
    #2 0x7f97aa3afd70 in gst_byte_reader_get_uint32_be_unchecked
/usr/include/gstreamer-1.0/gst/base/gstbytereader.h:205
    #3 0x7f97aa3afd70 in qtdemux_parse_samples
/f/gstreamer/gst-plugins-good/gst/isomp4/qtdemux.c:8507
    #4 0x7f97aa3d80db in gst_qtdemux_advance_sample
/f/gstreamer/gst-plugins-good/gst/isomp4/qtdemux.c:4928:8
    #5 0x7f97aa35cfba in gst_qtdemux_loop_state_movie
/f/gstreamer/gst-plugins-good/gst/isomp4/qtdemux.c:5759:5
    #6 0x7f97aa35cfba in gst_qtdemux_loop
/f/gstreamer/gst-plugins-good/gst/isomp4/qtdemux.c:5804
    #7 0x7f97b7bb3883 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:334:5
    #8 0x7f97b6db0b2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
    #9 0x7f97b6db0154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
    #10 0x7f97b682e453 in start_thread (/lib64/libpthread.so.0+0x7453)
    #11 0x7f97b635e5dc in clone (/lib64/libc.so.6+0xe75dc)

0x60200002bec0 is located 0 bytes to the right of 16-byte region
[0x60200002beb0,0x60200002bec0)
allocated by thread T2 (qtdemux0:sink) here:
    #0 0x4cbbb8 in malloc (/usr/bin/gst-discoverer-1.0+0x4cbbb8)
    #1 0x7f97b6d8e768 in g_malloc
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gmem.c:94
    #2 0x7f97b6da8057 in g_memdup
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gstrfuncs.c:391
    #3 0x7f97aa39c776 in qtdemux_stbl_init
/f/gstreamer/gst-plugins-good/gst/isomp4/qtdemux.c:8053:23
    #4 0x7f97aa39c776 in qtdemux_parse_trak
/f/gstreamer/gst-plugins-good/gst/isomp4/qtdemux.c:11292
    #5 0x7f97aa36bafa in qtdemux_parse_tree
/f/gstreamer/gst-plugins-good/gst/isomp4/qtdemux.c:12910:5
    #6 0x7f97aa35cc92 in gst_qtdemux_loop_state_header
/f/gstreamer/gst-plugins-good/gst/isomp4/qtdemux.c:4264:7
    #7 0x7f97aa35cc92 in gst_qtdemux_loop
/f/gstreamer/gst-plugins-good/gst/isomp4/qtdemux.c:5801
    #8 0x7f97b7bb3883 in gst_task_func
/f/gstreamer/gstreamer/gst/gsttask.c:334:5
    #9 0x7f97b6db0b2d in g_thread_pool_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthreadpool.c:307
    #10 0x7f97b6db0154 in g_thread_proxy
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread.c:784
    #11 0x7f97b682e453 in start_thread (/lib64/libpthread.so.0+0x7453)
    #12 0x7f97b635e5dc in clone (/lib64/libc.so.6+0xe75dc)

Thread T2 (qtdemux0:sink) created by T1 (typefind:sink) here:
    #0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7f97b6dcd1bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

Thread T1 (typefind:sink) created by T0 here:
    #0 0x42df2d in __interceptor_pthread_create
(/usr/bin/gst-discoverer-1.0+0x42df2d)
    #1 0x7f97b6dcd1bf in g_system_thread_new
/var/tmp/portage/dev-libs/glib-2.50.2/work/glib-2.50.2/glib/gthread-posix.c:1170

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.