From 328977c413634729e0fdb193cd38f74f58632b14 Mon Sep 17 00:00:00 2001 From: zhangxianting Date: Thu, 19 Sep 2024 15:02:33 +0800 Subject: [PATCH] fix CVE-2024-4453 (cherry picked from commit def8d77b776a4e6287041e9ca7329b4dfb18e6d0) --- backport-CVE-2024-4453.patch | 60 ++++++++++++++++++++++++++++++++++++ gstreamer1-plugins-base.spec | 7 ++++- 2 files changed, 66 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2024-4453.patch diff --git a/backport-CVE-2024-4453.patch b/backport-CVE-2024-4453.patch new file mode 100644 index 0000000..afc2b38 --- /dev/null +++ b/backport-CVE-2024-4453.patch @@ -0,0 +1,60 @@ +From e68eccff103ab0e91e6d77a892f57131b33902f5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Thu, 25 Apr 2024 15:21:20 +0300 +Subject: [PATCH] exiftag: Prevent integer overflows and out of bounds reads + when handling undefined tags + +Fixes ZDI-CAN-23896 +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3483 + +Part-of: +--- + .../gst-libs/gst/tag/gstexiftag.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/gst-libs/gst/tag/gstexiftag.c b/gst-libs/gst/tag/gstexiftag.c +index 98d05c6b87..55753e570e 100644 +--- a/gst-libs/gst/tag/gstexiftag.c ++++ b/gst-libs/gst/tag/gstexiftag.c +@@ -1402,6 +1402,7 @@ parse_exif_undefined_tag (GstExifReader * reader, const GstExifTagMatch * tag, + + if (count > 4) { + GstMapInfo info; ++ gsize alloc_size; + + if (offset < reader->base_offset) { + GST_WARNING ("Offset is smaller (%u) than base offset (%u)", offset, +@@ -1423,14 +1424,28 @@ parse_exif_undefined_tag (GstExifReader * reader, const GstExifTagMatch * tag, + return; + } + ++ if (info.size - real_offset < count) { ++ GST_WARNING ("Invalid size %u for buffer of size %" G_GSIZE_FORMAT ++ ", not adding tag %s", count, info.size, tag->gst_tag); ++ gst_buffer_unmap (reader->buffer, &info); ++ return; ++ } ++ ++ if (!g_size_checked_add (&alloc_size, count, 1)) { ++ GST_WARNING ("Invalid size %u for buffer of size %" G_GSIZE_FORMAT ++ ", not adding tag %s", real_offset, info.size, tag->gst_tag); ++ gst_buffer_unmap (reader->buffer, &info); ++ return; ++ } ++ + /* +1 because it could be a string without the \0 */ +- data = malloc (sizeof (guint8) * count + 1); ++ data = malloc (alloc_size); + memcpy (data, info.data + real_offset, count); + data[count] = 0; + + gst_buffer_unmap (reader->buffer, &info); + } else { +- data = malloc (sizeof (guint8) * count + 1); ++ data = malloc (count + 1); + memcpy (data, (guint8 *) offset_as_data, count); + data[count] = 0; + } +-- +2.20.1 + diff --git a/gstreamer1-plugins-base.spec b/gstreamer1-plugins-base.spec index 1d3014b..cbebaeb 100644 --- a/gstreamer1-plugins-base.spec +++ b/gstreamer1-plugins-base.spec @@ -3,12 +3,13 @@ Name: gstreamer1-plugins-base Version: 1.24.0 -Release: 1 +Release: 2 Summary: GStreamer streaming media framework base plugins License: LGPLv2+ URL: http://gstreamer.freedesktop.org/ Source0: http://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-base-%{version}.tar.xz Patch0: 0001-missing-plugins-Remove-the-mpegaudioversion-field.patch +Patch1: backport-CVE-2024-4453.patch BuildRequires: gcc-c++ gstreamer1-devel >= %{version} gobject-introspection-devel >= 1.31.1 iso-codes-devel alsa-lib-devel BuildRequires: cdparanoia-devel libogg-devel >= 1.0 libtheora-devel >= 1.1 libvisual-devel libvorbis-devel >= 1.0 libXv-devel @@ -48,6 +49,7 @@ This package provides manual for developpers. %prep %setup -q -n gst-plugins-base-%{version} %patch0 -p1 +%patch1 -p1 %build %meson -D doc=disabled -D orc=enabled \ @@ -269,6 +271,9 @@ EOF %{_mandir}/man1/gst-device-monitor-*.gz %changelog +* Thu Sep 19 2024 zhangxianting - 1.24.0-2 +- fix CVE-2024-4453 + * Mon Mar 11 2024 liweigang - 1.24.0-1 - update to version 1.24.0 -- Gitee