h2645parser: Catch overflows in AVC/HEVC NAL unit length calculations
authorSebastian Dröge <sebastian@centricular.com>
Tue, 23 Mar 2021 17:19:14 +0000 (19:19 +0200)
committerSebastian Dröge <slomo@coaxion.net>
Wed, 24 Mar 2021 09:22:48 +0000 (09:22 +0000)
commitffa4d84e54af6359d9a8c67fb84698a3aeccb68a
tree671d23c6e6d4aebd45b420cdeae6cf368f5021aa
parent9eb14d2d118c16bed233a3e0c07756518f545cd1
h2645parser: Catch overflows in AVC/HEVC NAL unit length calculations

Offset and size are stored as 32 bit guint and might overflow when
adding the nal_length_size, so let's avoid that.

For the size this would happen if the AVC/HEVC NAL unit size happens to
be stored in 4 bytes and is 4294967292 or higher, which is likely
corrupted data anyway.

For the offset this is something for the caller of these functions to
take care of but is unlikely to happen as it would require parsing on a
>4GB buffer.

Allowing these overflows causes all kinds of follow-up bugs in the
h2645parse elements, ranging from infinite loops and memory leaks to
potential memory corruptions.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/merge_requests/2103>
gst-libs/gst/codecparsers/gsth264parser.c
gst-libs/gst/codecparsers/gsth265parser.c
tests/check/libs/h264parser.c
tests/check/libs/h265parser.c