summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0006-vorbis_parse-check-writes-to-GstOggStream.vorbis_mod.patch80
-rw-r--r--meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0007-oggstream-review-and-fix-per-format-min_packet_size.patch168
-rw-r--r--meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.22.12.bb2
3 files changed, 250 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0006-vorbis_parse-check-writes-to-GstOggStream.vorbis_mod.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0006-vorbis_parse-check-writes-to-GstOggStream.vorbis_mod.patch
new file mode 100644
index 0000000000..37d0b463cb
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0006-vorbis_parse-check-writes-to-GstOggStream.vorbis_mod.patch
@@ -0,0 +1,80 @@
1From 006047a23a4e4c146e40e5dab765bc6318a94744 Mon Sep 17 00:00:00 2001
2From: Mathieu Duponchelle <mathieu@centricular.com>
3Date: Wed, 2 Oct 2024 15:16:30 +0200
4Subject: [PATCH 1/2] vorbis_parse: check writes to
5 GstOggStream.vorbis_mode_sizes
6
7Thanks to Antonio Morales for finding and reporting the issue.
8
9Fixes GHSL-2024-117 Fixes gstreamer#3875
10
11Also perform out-of-bounds check for accesses to op->packet
12
13Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8038>
14
15CVE: CVE-2024-47615
16Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/006047a23a4e4c146e40e5dab765bc6318a94744]
17Signed-off-by: Peter Marko <peter.marko@siemens.com>
18---
19 ext/ogg/vorbis_parse.c | 21 +++++++++++++++++++++
20 1 file changed, 21 insertions(+)
21
22diff --git a/ext/ogg/vorbis_parse.c b/ext/ogg/vorbis_parse.c
23index 65ef463808..757c7cd82b 100644
24--- a/ext/ogg/vorbis_parse.c
25+++ b/ext/ogg/vorbis_parse.c
26@@ -165,6 +165,10 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
27 if (offset == 0) {
28 offset = 8;
29 current_pos -= 1;
30+
31+ /* have we underrun? */
32+ if (current_pos < op->packet)
33+ return -1;
34 }
35 }
36
37@@ -178,6 +182,10 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
38 if (offset == 7)
39 current_pos -= 1;
40
41+ /* have we underrun? */
42+ if (current_pos < op->packet + 5)
43+ return -1;
44+
45 if (((current_pos[-5] & ~((1 << (offset + 1)) - 1)) != 0)
46 ||
47 current_pos[-4] != 0
48@@ -199,9 +207,18 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
49 /* Give ourselves a chance to recover if we went back too far by using
50 * the size check. */
51 for (ii = 0; ii < 2; ii++) {
52+
53 if (offset > 4) {
54+ /* have we underrun? */
55+ if (current_pos < op->packet)
56+ return -1;
57+
58 size_check = (current_pos[0] >> (offset - 5)) & 0x3F;
59 } else {
60+ /* have we underrun? */
61+ if (current_pos < op->packet + 1)
62+ return -1;
63+
64 /* mask part of byte from current_pos */
65 size_check = (current_pos[0] & ((1 << (offset + 1)) - 1));
66 /* shift to appropriate position */
67@@ -233,6 +250,10 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
68
69 mode_size_ptr = pad->vorbis_mode_sizes;
70
71+ if (size > G_N_ELEMENTS (pad->vorbis_mode_sizes)) {
72+ return -1;
73+ }
74+
75 for (i = 0; i < size; i++) {
76 offset = (offset + 1) % 8;
77 if (offset == 0)
78--
792.30.2
80
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0007-oggstream-review-and-fix-per-format-min_packet_size.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0007-oggstream-review-and-fix-per-format-min_packet_size.patch
new file mode 100644
index 0000000000..b469049a94
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0007-oggstream-review-and-fix-per-format-min_packet_size.patch
@@ -0,0 +1,168 @@
1From e633ec642825466b91fc12da6629c307906fa206 Mon Sep 17 00:00:00 2001
2From: Mathieu Duponchelle <mathieu@centricular.com>
3Date: Wed, 2 Oct 2024 16:52:51 +0200
4Subject: [PATCH 2/2] oggstream: review and fix per-format min_packet_size
5
6This addresses all manually detected invalid reads in setup functions.
7
8Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8038>
9
10CVE: CVE-2024-47615
11Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/e633ec642825466b91fc12da6629c307906fa206]
12Signed-off-by: Peter Marko <peter.marko@siemens.com>
13---
14 ext/ogg/gstoggstream.c | 40 ++++++++++++----------------------------
15 1 file changed, 12 insertions(+), 28 deletions(-)
16
17diff --git a/ext/ogg/gstoggstream.c b/ext/ogg/gstoggstream.c
18index a8883304a5..ab6be238dc 100644
19--- a/ext/ogg/gstoggstream.c
20+++ b/ext/ogg/gstoggstream.c
21@@ -665,11 +665,6 @@ setup_vp8_mapper (GstOggStream * pad, ogg_packet * packet)
22 {
23 gint width, height, par_n, par_d, fps_n, fps_d;
24
25- if (packet->bytes < 26) {
26- GST_DEBUG ("Failed to parse VP8 BOS page");
27- return FALSE;
28- }
29-
30 width = GST_READ_UINT16_BE (packet->packet + 8);
31 height = GST_READ_UINT16_BE (packet->packet + 10);
32 par_n = GST_READ_UINT24_BE (packet->packet + 12);
33@@ -1221,11 +1216,6 @@ setup_fishead_mapper (GstOggStream * pad, ogg_packet * packet)
34 gint64 prestime_n, prestime_d;
35 gint64 basetime_n, basetime_d;
36
37- if (packet->bytes < 44) {
38- GST_DEBUG ("Not enough data for fishead header");
39- return FALSE;
40- }
41-
42 data = packet->packet;
43
44 data += 8; /* header */
45@@ -1256,8 +1246,8 @@ setup_fishead_mapper (GstOggStream * pad, ogg_packet * packet)
46 pad->prestime = -1;
47
48 /* Ogg Skeleton 3.3+ streams provide additional information in the header */
49- if (packet->bytes >= SKELETON_FISHEAD_3_3_MIN_SIZE && pad->skeleton_major == 3
50- && pad->skeleton_minor > 0) {
51+ if (packet->bytes - 44 >= SKELETON_FISHEAD_3_3_MIN_SIZE
52+ && pad->skeleton_major == 3 && pad->skeleton_minor > 0) {
53 gint64 firstsampletime_n, firstsampletime_d;
54 gint64 lastsampletime_n, lastsampletime_d;
55 gint64 firstsampletime, lastsampletime;
56@@ -1296,7 +1286,7 @@ setup_fishead_mapper (GstOggStream * pad, ogg_packet * packet)
57
58 GST_INFO ("skeleton fishead parsed total: %" GST_TIME_FORMAT,
59 GST_TIME_ARGS (pad->total_time));
60- } else if (packet->bytes >= SKELETON_FISHEAD_4_0_MIN_SIZE
61+ } else if (packet->bytes - 44 >= SKELETON_FISHEAD_4_0_MIN_SIZE
62 && pad->skeleton_major == 4) {
63 guint64 segment_length, content_offset;
64
65@@ -1980,9 +1970,6 @@ setup_kate_mapper (GstOggStream * pad, ogg_packet * packet)
66 guint8 *data = packet->packet;
67 const char *category;
68
69- if (packet->bytes < 64)
70- return FALSE;
71-
72 pad->granulerate_n = GST_READ_UINT32_LE (data + 24);
73 pad->granulerate_d = GST_READ_UINT32_LE (data + 28);
74 pad->granuleshift = GST_READ_UINT8 (data + 15);
75@@ -2111,9 +2098,6 @@ setup_opus_mapper (GstOggStream * pad, ogg_packet * packet)
76 {
77 GstBuffer *buffer;
78
79- if (packet->bytes < 19)
80- return FALSE;
81-
82 pad->granulerate_n = 48000;
83 pad->granulerate_d = 1;
84 pad->granuleshift = 0;
85@@ -2394,7 +2378,7 @@ const GstOggMap mappers[] = {
86 NULL
87 },
88 {
89- "\001vorbis", 7, 22,
90+ "\001vorbis", 7, 29,
91 "audio/x-vorbis",
92 setup_vorbis_mapper,
93 NULL,
94@@ -2426,7 +2410,7 @@ const GstOggMap mappers[] = {
95 NULL
96 },
97 {
98- "PCM ", 8, 0,
99+ "PCM ", 8, 28,
100 "audio/x-raw",
101 setup_pcm_mapper,
102 NULL,
103@@ -2442,7 +2426,7 @@ const GstOggMap mappers[] = {
104 NULL
105 },
106 {
107- "CMML\0\0\0\0", 8, 0,
108+ "CMML\0\0\0\0", 8, 29,
109 "text/x-cmml",
110 setup_cmml_mapper,
111 NULL,
112@@ -2458,7 +2442,7 @@ const GstOggMap mappers[] = {
113 NULL
114 },
115 {
116- "Annodex", 7, 0,
117+ "Annodex", 7, 44,
118 "application/x-annodex",
119 setup_fishead_mapper,
120 NULL,
121@@ -2537,7 +2521,7 @@ const GstOggMap mappers[] = {
122 NULL
123 },
124 {
125- "CELT ", 8, 0,
126+ "CELT ", 8, 60,
127 "audio/x-celt",
128 setup_celt_mapper,
129 NULL,
130@@ -2553,7 +2537,7 @@ const GstOggMap mappers[] = {
131 NULL
132 },
133 {
134- "\200kate\0\0\0", 8, 0,
135+ "\200kate\0\0\0", 8, 64,
136 "text/x-kate",
137 setup_kate_mapper,
138 NULL,
139@@ -2585,7 +2569,7 @@ const GstOggMap mappers[] = {
140 NULL
141 },
142 {
143- "OVP80\1\1", 7, 4,
144+ "OVP80\1\1", 7, 26,
145 "video/x-vp8",
146 setup_vp8_mapper,
147 setup_vp8_mapper_from_caps,
148@@ -2601,7 +2585,7 @@ const GstOggMap mappers[] = {
149 update_stats_vp8
150 },
151 {
152- "OpusHead", 8, 0,
153+ "OpusHead", 8, 19,
154 "audio/x-opus",
155 setup_opus_mapper,
156 NULL,
157@@ -2649,7 +2633,7 @@ const GstOggMap mappers[] = {
158 NULL
159 },
160 {
161- "\001text\0\0\0", 9, 9,
162+ "\001text\0\0\0", 9, 25,
163 "application/x-ogm-text",
164 setup_ogmtext_mapper,
165 NULL,
166--
1672.30.2
168
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.22.12.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.22.12.bb
index ffae227154..18837e676d 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.22.12.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.22.12.bb
@@ -12,6 +12,8 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-ba
12 file://0002-ssaparse-enhance-SSA-text-lines-parsing.patch \ 12 file://0002-ssaparse-enhance-SSA-text-lines-parsing.patch \
13 file://0004-vorbisdec-Set-at-most-64-channels-to-NONE-position.patch \ 13 file://0004-vorbisdec-Set-at-most-64-channels-to-NONE-position.patch \
14 file://0005-opusdec-Set-at-most-64-channels-to-NONE-position.patch \ 14 file://0005-opusdec-Set-at-most-64-channels-to-NONE-position.patch \
15 file://0006-vorbis_parse-check-writes-to-GstOggStream.vorbis_mod.patch \
16 file://0007-oggstream-review-and-fix-per-format-min_packet_size.patch \
15 " 17 "
16SRC_URI[sha256sum] = "73cfadc3a6ffe77ed974cfd6fb391c605e4531f48db21dd6b9f42b8cb69bd8c1" 18SRC_URI[sha256sum] = "73cfadc3a6ffe77ed974cfd6fb391c605e4531f48db21dd6b9f42b8cb69bd8c1"
17 19
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-07 00:33:26 +0000