From b990afeaf306972756e154d4542b2ab1170e506c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Thu, 26 Sep 2024 22:16:06 +0300 Subject: [PATCH 2/7] qtdemux: Avoid integer overflow when parsing Theora extension Thanks to Antonio Morales for finding and reporting the issue. Fixes GHSL-2024-166 Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3851 Part-of: --- subprojects/gst-plugins-good/gst/isomp4/qtdemux.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c index 5723fce466..75a5a53713 100644 --- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c +++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c @@ -8206,7 +8206,7 @@ qtdemux_parse_theora_extension (GstQTDemux * qtdemux, QtDemuxStream * stream, end -= 8; while (buf < end) { - gint size; + guint32 size; guint32 type; size = QT_UINT32 (buf); @@ -8214,7 +8214,7 @@ qtdemux_parse_theora_extension (GstQTDemux * qtdemux, QtDemuxStream * stream, GST_LOG_OBJECT (qtdemux, "%p %p", buf, end); - if (buf + size > end || size <= 0) + if (end - buf < size || size < 8) break; buf += 8; -- 2.47.0