diff mbox series

[bug#48000,2/5] gnu: gst-libav: Fix a stack corruption bug.

Message ID abd60c78df7e73166ffddeb68727fadae85a3ff3.1619291675.git.leo@famulari.name
State Accepted
Headers show
Series [bug#48000,1/5] gnu: gst-plugins-good: Fix CVE-2021-3497 and CVE-2021-3498. | expand

Checks

Context Check Description
cbaines/submitting builds success
cbaines/comparison success View comparision
cbaines/git branch success View Git branch
cbaines/applying patch success View Laminar job
cbaines/issue success View issue

Commit Message

Leo Famulari April 24, 2021, 7:14 p.m. UTC 
* gnu/packages/patches/gst-libav-64channels-stack-corruption.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/gstreamer.scm (gst-libav)[source]: Use it.
---
 gnu/local.mk                                  |  1 +
 gnu/packages/gstreamer.scm                    |  1 +
 ...st-libav-64channels-stack-corruption.patch | 31 +++++++++++++++++++
 3 files changed, 33 insertions(+)
 create mode 100644 gnu/packages/patches/gst-libav-64channels-stack-corruption.patch
diff mbox series

Patch

diff --git a/gnu/local.mk b/gnu/local.mk
index e19daf76ca..b3e84be598 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1169,6 +1169,7 @@  dist_patch_DATA =						\
   %D%/packages/patches/grub-setup-root.patch			\
   %D%/packages/patches/grub-verifiers-Blocklist-fallout-cleanup.patch \
   %D%/packages/patches/gspell-dash-test.patch			\
+  %D%/packages/patches/gst-libav-64channels-stack-corruption.patch	\
   %D%/packages/patches/gst-plugins-good-fix-test.patch		\
   %D%/packages/patches/gst-plugins-good-CVE-2021-3497.patch	\
   %D%/packages/patches/gst-plugins-good-CVE-2021-3498.patch	\
diff --git a/gnu/packages/gstreamer.scm b/gnu/packages/gstreamer.scm
index 6a050ca297..81ac0a2f5f 100644
--- a/gnu/packages/gstreamer.scm
+++ b/gnu/packages/gstreamer.scm
@@ -851,6 +851,7 @@  think twice about shipping them.")
         (string-append
          "https://gstreamer.freedesktop.org/src/" name "/"
          name "-" version ".tar.xz"))
+       (patches (search-patches "gst-libav-64channels-stack-corruption.patch"))
        (sha256
         (base32 "0jbzams9ggk3sq9ywv4gsl9rghyn203l2582m6l5c1sz9ka9m5in"))))
     (build-system meson-build-system)
diff --git a/gnu/packages/patches/gst-libav-64channels-stack-corruption.patch b/gnu/packages/patches/gst-libav-64channels-stack-corruption.patch
new file mode 100644
index 0000000000..cc174e618d
--- /dev/null
+++ b/gnu/packages/patches/gst-libav-64channels-stack-corruption.patch
@@ -0,0 +1,31 @@ 
+Fix a stack corruption when handling files with more than 64 audio
+channels:
+
+https://gstreamer.freedesktop.org/security/sa-2021-0005.html
+
+Patch copied from upstream source repository:
+
+https://gitlab.freedesktop.org/gstreamer/gst-libav/-/commit/dcea8baa14a5fc3b796d876baaf2f238546ba2b1
+
+diff --git a/ext/libav/gstavcodecmap.c b/ext/libav/gstavcodecmap.c
+index b5be4bb7a5f2712f78383da9319754a8849e3307..be22f22cf5c7c7b22b13e44b10999adaacbcca2b 100644
+--- a/ext/libav/gstavcodecmap.c
++++ b/ext/libav/gstavcodecmap.c
+@@ -102,7 +102,7 @@ gst_ffmpeg_channel_layout_to_gst (guint64 channel_layout, gint channels,
+   guint nchannels = 0;
+   gboolean none_layout = FALSE;
+ 
+-  if (channel_layout == 0) {
++  if (channel_layout == 0 || channels > 64) {
+     nchannels = channels;
+     none_layout = TRUE;
+   } else {
+@@ -163,7 +163,7 @@ gst_ffmpeg_channel_layout_to_gst (guint64 channel_layout, gint channels,
+     } else {
+       guint i;
+ 
+-      for (i = 0; i < nchannels; i++)
++      for (i = 0; i < nchannels && i < 64; i++)
+         pos[i] = GST_AUDIO_CHANNEL_POSITION_NONE;
+     }
+   }