avidemux: Fix integer overflow resulting in heap corruption in DIB buffer inversion...
authorSebastian Dröge <sebastian@centricular.com>
Wed, 18 May 2022 09:00:48 +0000 (12:00 +0300)
committerGStreamer Marge Bot <gitlab-merge-bot@gstreamer-foundation.org>
Wed, 15 Jun 2022 16:40:48 +0000 (16:40 +0000)
commitf503caad676971933dc0b52c4b313e5ef0d6dbb0
tree717109be7c69001073a4aefeaf0a346c269869d0
parente77ed17f15d1b028bdf8e98e4cdd5975ffcc90e3
avidemux: Fix integer overflow resulting in heap corruption in DIB buffer inversion code

Check that width*bpp/8 doesn't overflow a guint and also that
height*stride fits into the provided buffer without overflowing.

Thanks to Adam Doupe for analyzing and reporting the issue.

CVE: CVE-2022-1921

See https://gstreamer.freedesktop.org/security/sa-2022-0001.html

Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1224

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2608>
subprojects/gst-plugins-good/gst/avi/gstavidemux.c