apply CVE patch

Change-Id: Iabbbe9caedee4713b6644e041c44b7d07111ea33

diff --git a/gst-libs/gst/mpegts/gstmpegtssection.c b/gst-libs/gst/mpegts/gstmpegtssection.c
index dc62ac3ee127c9c413cc96af71dcb97e08d64c58..cdcec36e5d984f02fb94cd802e46e54e776e33ea 100644 (file)
--- a/gst-libs/gst/mpegts/gstmpegtssection.c
+++ b/gst-libs/gst/mpegts/gstmpegtssection.c
@@ -414,7 +414,7 @@ static gpointer
 _parse_pat (GstMpegtsSection * section)
 {
   GPtrArray *pat;
-  guint16 i = 0, nb_programs;
+  guint16 i, nb_programs;
   GstMpegtsPatProgram *program;
   guint8 *data, *end;
 
@@ -430,7 +430,9 @@ _parse_pat (GstMpegtsSection * section)
       g_ptr_array_new_full (nb_programs,
       (GDestroyNotify) _mpegts_pat_program_free);
 
-  while (data < end - 4) {
+  GST_LOG ("nb_programs %u", nb_programs);
+
+  for (i = 0; i < nb_programs; i++) {
     program = g_slice_new0 (GstMpegtsPatProgram);
     program->program_number = GST_READ_UINT16_BE (data);
     data += 2;
@@ -439,8 +441,6 @@ _parse_pat (GstMpegtsSection * section)
     data += 2;
 
     g_ptr_array_index (pat, i) = program;
-
-    i++;
   }
   pat->len = nb_programs;
 
@@ -1178,13 +1178,20 @@ gst_mpegts_section_new (guint16 pid, guint8 * data, gsize data_size)
   GstMpegtsSection *res = NULL;
   guint8 tmp;
   guint8 table_id;
-  guint16 section_length;
+  guint16 section_length = 0;
+
+  /* The smallest section ever is 3 bytes */
+  if (G_UNLIKELY (data_size < 3))
+    goto short_packet;
 
   /* Check for length */
   section_length = GST_READ_UINT16_BE (data + 1) & 0x0FFF;
   if (G_UNLIKELY (data_size < section_length + 3))
     goto short_packet;
 
+  GST_LOG ("data_size:%" G_GSIZE_FORMAT " section_length:%u",
+      data_size, section_length);
+
   /* Table id is in first byte */
   table_id = *data;
 
@@ -1199,6 +1206,13 @@ gst_mpegts_section_new (guint16 pid, guint8 * data, gsize data_size)
   /* section_length (already parsed) : 12 bit */
   res->section_length = section_length + 3;
   if (!res->short_section) {
+    /* A long packet needs to be at least 11 bytes long
+     * _ 3 for the bytes above
+     * _ 5 for the bytes below
+     * _ 4 for the CRC */
+    if (G_UNLIKELY (data_size < 11))
+      goto bad_long_packet;
+
     /* CRC is after section_length (-4 for the size of the CRC) */
     res->crc = GST_READ_UINT32_BE (res->data + res->section_length - 4);
     /* Skip to after section_length */
@@ -1228,6 +1242,13 @@ short_packet:
     g_free (data);
     return NULL;
   }
+bad_long_packet:
+  {
+    GST_WARNING ("PID 0x%04x long section is too short (%" G_GSIZE_FORMAT
+        " bytes, need at least 11)", pid, data_size);
+    gst_mpegts_section_unref (res);
+    return NULL;
+  }
 }
 
 /**

diff --git a/gst/mxf/mxfdemux.c b/gst/mxf/mxfdemux.c
index 9423ae0d8b7983049edcaa5cc7560a4d4540755e..a403db3d567ba4c9a09826024b1dac767d67ae9e 100644 (file)
--- a/gst/mxf/mxfdemux.c
+++ b/gst/mxf/mxfdemux.c
@@ -820,6 +820,7 @@ gst_mxf_demux_update_essence_tracks (GstMXFDemux * demux)
         etrack->mapping_data = NULL;
         if (etrack->tags)
           gst_tag_list_unref (etrack->tags);
+        etrack->tags = NULL;
         goto next;
       } else if (!caps) {
         GST_WARNING_OBJECT (demux, "Couldn't create updated caps for stream");

diff --git a/gst/videoparsers/gsth264parse.c b/gst/videoparsers/gsth264parse.c
index 05402afc215720b05a3db77dae6b645aba16e912..c4121a13d8f5e1a3702d3c135f0a55367db82dbe 100644 (file)
--- a/gst/videoparsers/gsth264parse.c
+++ b/gst/videoparsers/gsth264parse.c
@@ -2513,6 +2513,11 @@ gst_h264_parse_set_caps (GstBaseParse * parse, GstCaps * caps)
       off = nalu.offset + nalu.size;
     }
 
+    if (off >= size) {
+      gst_buffer_unmap (codec_data, &map);
+      goto avcc_too_small;
+    }
+
     num_pps = data[off];
     off++;
 

diff --git a/gst/videoparsers/gsth265parse.c b/gst/videoparsers/gsth265parse.c
index d6496816e3a479166bf738f32d6a59c33591937c..5847ee6914a82e86fe6e35153142838d05b4b132 100644 (file)
--- a/gst/videoparsers/gsth265parse.c
+++ b/gst/videoparsers/gsth265parse.c
@@ -1979,6 +1979,7 @@ gst_h265_parse_set_caps (GstBaseParse * parse, GstCaps * caps)
       (value = gst_structure_get_value (str, "codec_data"))) {
     GstMapInfo map;
     guint8 *data;
+    guint num_nal_arrays;
 
     GST_DEBUG_OBJECT (h265parse, "have packetized h265");
     /* make note for optional split processing */
@@ -2007,8 +2008,15 @@ gst_h265_parse_set_caps (GstBaseParse * parse, GstCaps * caps)
     GST_DEBUG_OBJECT (h265parse, "nal length size %u",
         h265parse->nal_length_size);
 
+    num_nal_arrays = data[22];
     off = 23;
-    for (i = 0; i < data[22]; i++) {
+
+    for (i = 0; i < num_nal_arrays; i++) {
+      if (off + 3 >= size) {
+        gst_buffer_unmap (codec_data, &map);
+        goto hvcc_too_small;
+      }
+
       num_nals = GST_READ_UINT16_BE (data + off + 1);
       for (j = 0; j < num_nals; j++) {
         parseres = gst_h265_parser_identify_nalu_hevc (h265parse->nalparser,