matroskademux: Fix integer overflows in zlib/bz2/etc decompression code
authorSebastian Dröge <sebastian@centricular.com>
Wed, 18 May 2022 08:24:37 +0000 (11:24 +0300)
committerGStreamer Marge Bot <gitlab-merge-bot@gstreamer-foundation.org>
Wed, 15 Jun 2022 17:50:55 +0000 (17:50 +0000)
commitad6012159acf18c6b5c0f4edf037e8c9a2dbc966
tree5fd90b7eb324890aebce42d42b9731d1f93b5cee
parentf503caad676971933dc0b52c4b313e5ef0d6dbb0
matroskademux: Fix integer overflows in zlib/bz2/etc decompression code

Various variables were of smaller types than needed and there were no
checks for any overflows when doing additions on the sizes. This is all
checked now.

In addition the size of the decompressed data is limited to 120MB now as
any larger sizes are likely pathological and we can avoid out of memory
situations in many cases like this.

Also fix a bug where the available output size on the next iteration in
the zlib/bz2 decompression code was provided too large and could
potentially lead to out of bound writes.

Thanks to Adam Doupe for analyzing and reporting the issue.

CVE: CVE-2022-1922, CVE-2022-1923, CVE-2022-1924, CVE-2022-1925

https://gstreamer.freedesktop.org/security/sa-2022-0002.html

Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2610>
subprojects/gst-plugins-good/gst/matroska/matroska-read-common.c