From 93d79c22a82604adc5512557c1238f72f41188c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Fri, 4 Oct 2024 13:22:02 +0300 Subject: [PATCH] wavparse: Check that at least 32 bytes are available before parsing smpl chunks Thanks to Antonio Morales for finding and reporting the issue. Fixes GHSL-2024-259 Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3887 Part-of: Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/93d79c22a82604adc5512557c1238f72f41188c4] CVE: CVE-2024-47775 CVE-2024-47776 CVE-2024-47777 CVE-2024-47778 Signed-off-by: Vijay Anusuri --- subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c index 5655ee3825ca..8a04805ed427 100644 --- a/gst/wavparse/gstwavparse.c +++ b/gst/wavparse/gstwavparse.c @@ -894,6 +894,9 @@ gst_wavparse_smpl_chunk (GstWavParse * wav, const guint8 * data, guint32 size) { guint32 note_number; + if (size < 32) + return FALSE; + /* manufacturer_id = GST_READ_UINT32_LE (data); product_id = GST_READ_UINT32_LE (data + 4); -- GitLab