From a78e43870aaa79bc9edcccb37a44a4dfaba32182 Mon Sep 17 00:00:00 2001 From: technology208 Date: Thu, 11 Apr 2024 16:50:22 +0800 Subject: [PATCH] subparse end_tag and CVE-2023-37328:skip over the end of a valid closing tag instead of only skipping < (cherry picked from commit 9cb1cb4b4ddb4482ef980315d80be3cdbd704a74) --- CVE-2023-37328.patch | 36 +++++++++++++++++++++++++++--------- gstreamer1-plugins-base.spec | 5 ++++- 2 files changed, 31 insertions(+), 10 deletions(-) diff --git a/CVE-2023-37328.patch b/CVE-2023-37328.patch index 56778e6..6309866 100644 --- a/CVE-2023-37328.patch +++ b/CVE-2023-37328.patch @@ -1,17 +1,17 @@ -From 18b887d30a81deadd600017265cb61f5d0e1bea0 Mon Sep 17 00:00:00 2001 -From: technology208 -Date: Thu, 14 Mar 2024 15:54:38 +0800 -Subject: [PATCH] Create Patch +From 803fec1d19a401af00153e0b5791bf9a14e11ca4 Mon Sep 17 00:00:00 2001 +From: technology208 +Date: Thu, 11 Apr 2024 15:33:46 +0800 +Subject: [PATCH] CreatePatch --- - gst/subparse/gstsubparse.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) + gst/subparse/gstsubparse.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/gst/subparse/gstsubparse.c b/gst/subparse/gstsubparse.c -index 4254158..e8d3eca 100644 +index 382e430..423112a 100644 --- a/gst/subparse/gstsubparse.c +++ b/gst/subparse/gstsubparse.c -@@ -814,7 +814,7 @@ subrip_fix_up_markup (gchar ** p_txt, gconstpointer allowed_tags_ptr) +@@ -815,19 +815,22 @@ subrip_fix_up_markup (gchar ** p_txt, gconstpointer allowed_tags_ptr) } if (*next_tag == '<' && *(next_tag + 1) == '/') { @@ -20,6 +20,24 @@ index 4254158..e8d3eca 100644 if (end_tag) { const gchar *last = NULL; if (num_open_tags > 0) + last = g_ptr_array_index (open_tags, num_open_tags - 1); + if (num_open_tags == 0 + || g_ascii_strncasecmp (end_tag - 1, last, strlen (last))) { +- GST_LOG ("broken input, closing tag '%s' is not open", end_tag - 1); +- memmove (next_tag, end_tag + 1, strlen (end_tag) + 1); +- next_tag -= strlen (end_tag); ++ GST_LOG ("broken input, closing tag '%s' is not open", next_tag); ++ memmove (next_tag, end_tag + 1, strlen (end_tag)); ++ cur = next_tag; ++ continue; + } else { + --num_open_tags; + g_ptr_array_remove_index (open_tags, num_open_tags); ++ cur = end_tag + 1; ++ continue; + } + } + } -- -2.33.0 +2.43.0 diff --git a/gstreamer1-plugins-base.spec b/gstreamer1-plugins-base.spec index a8727d2..bd81e35 100644 --- a/gstreamer1-plugins-base.spec +++ b/gstreamer1-plugins-base.spec @@ -3,7 +3,7 @@ Name: gstreamer1-plugins-base Version: 1.18.4 -Release: 6 +Release: 7 Summary: GStreamer streaming media framework base plugins License: LGPLv2+ URL: http://gstreamer.freedesktop.org/ @@ -270,6 +270,9 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';' %{_mandir}/man1/gst-device-monitor-*.gz %changelog +* Mon May 20 2024 technology208 - 1.18.4-7 +- optimize subparse end_tag process + * Fri Mar 15 2024 technology208 - 1.18.4-6 - fix CVE-2023-37328 -- Gitee