From d06fa15d1c113edea0d6760ea19af8e8d0af0d94 Mon Sep 17 00:00:00 2001 From: James Zern Date: Fri, 7 Jun 2019 15:06:29 -0700 Subject: [PATCH 4/4] CVE-2019-2126: update libwebm to libwebm-1.0.0.27-361-g81de00c 81de00c Check there is only one settings per ContentCompression 5623013 Fixes a double free in ContentEncoding 93b2ba0 mkvparser: quiet static analysis warnings Change-Id: Ieaa562ef2f10075381bd856388e6b29f97ca2746 --- third_party/libwebm/README.libvpx | 2 +- third_party/libwebm/mkvparser/mkvparser.cc | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/third_party/libwebm/README.libvpx b/third_party/libwebm/README.libvpx index 16f17513e..714f5d0eb 100644 --- a/third_party/libwebm/README.libvpx +++ b/third_party/libwebm/README.libvpx @@ -1,5 +1,5 @@ URL: https://chromium.googlesource.com/webm/libwebm -Version: dbf1d1089756e7cb5b1a04d6752310ef35912347 +Version: 81de00c43ea3c087b48a8c20337db7531b9f7612 License: BSD License File: LICENSE.txt diff --git a/third_party/libwebm/mkvparser/mkvparser.cc b/third_party/libwebm/mkvparser/mkvparser.cc index dcb969dcf..ace65bd59 100644 --- a/third_party/libwebm/mkvparser/mkvparser.cc +++ b/third_party/libwebm/mkvparser/mkvparser.cc @@ -4230,6 +4230,7 @@ long ContentEncoding::ParseContentEncodingEntry(long long start, long long size, new (std::nothrow) ContentEncryption*[encryption_count]; if (!encryption_entries_) { delete[] compression_entries_; + compression_entries_ = NULL; return -1; } encryption_entries_end_ = encryption_entries_; @@ -4261,6 +4262,7 @@ long ContentEncoding::ParseContentEncodingEntry(long long start, long long size, delete compression; return status; } + assert(compression_count > 0); *compression_entries_end_++ = compression; } else if (id == libwebm::kMkvContentEncryption) { ContentEncryption* const encryption = @@ -4273,6 +4275,7 @@ long ContentEncoding::ParseContentEncodingEntry(long long start, long long size, delete encryption; return status; } + assert(encryption_count > 0); *encryption_entries_end_++ = encryption; } @@ -4325,6 +4328,12 @@ long ContentEncoding::ParseCompressionEntry(long long start, long long size, return status; } + // There should be only one settings element per content compression. + if (compression->settings != NULL) { + delete[] buf; + return E_FILE_FORMAT_INVALID; + } + compression->settings = buf; compression->settings_len = buflen; } -- 2.25.1