From 3153fda823cb91b1031dae69738c6c5d526fb6e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Thu, 26 Sep 2024 19:16:19 +0300 Subject: [PATCH 12/13] qtdemux: Check for invalid atom length when extracting Closed Caption data Thanks to Antonio Morales for finding and reporting the issue. Fixes GHSL-2024-243 Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3849 Part-of: CVE: CVE-2024-47546 Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/3153fda823cb91b1031dae69738c6c5d526fb6e1] Signed-off-by: Peter Marko --- gst/isomp4/qtdemux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c index 1de70f184f..8850d09321 100644 --- a/gst/isomp4/qtdemux.c +++ b/gst/isomp4/qtdemux.c @@ -5827,7 +5827,7 @@ extract_cc_from_data (QtDemuxStream * stream, const guint8 * data, gsize size, goto invalid_cdat; atom_length = QT_UINT32 (data); fourcc = QT_FOURCC (data + 4); - if (G_UNLIKELY (atom_length > size || atom_length == 8)) + if (G_UNLIKELY (atom_length > size || atom_length <= 8)) goto invalid_cdat; GST_DEBUG_OBJECT (stream->pad, "here"); -- 2.30.2