From da31d60c131207ddc3514ff2201dbc6bc8cdb8a0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Fri, 27 Sep 2024 09:47:50 +0300 Subject: [PATCH 23/28] qtdemux: Fix error handling when parsing cenc sample groups fails Thanks to Antonio Morales for finding and reporting the issue. Fixes GHSL-2024-238, GHSL-2024-239, GHSL-2024-240 Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3846 Part-of: --- subprojects/gst-plugins-good/gst/isomp4/qtdemux.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c index ee2131aa18..e50af4ff52 100644 --- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c +++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c @@ -11399,12 +11399,15 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak) if (stream->subtype != FOURCC_soun) { GST_ERROR_OBJECT (qtdemux, "Unexpeced stsd type 'aavd' outside 'soun' track"); + goto corrupt_file; } else { /* encrypted audio with sound sample description v0 */ GNode *enc = qtdemux_tree_get_child_by_type (stsd, fourcc); stream->protected = TRUE; - if (!qtdemux_parse_protection_aavd (qtdemux, stream, enc, &fourcc)) + if (!qtdemux_parse_protection_aavd (qtdemux, stream, enc, &fourcc)) { GST_ERROR_OBJECT (qtdemux, "Failed to parse protection scheme info"); + goto corrupt_file; + } } } @@ -11413,8 +11416,10 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak) * with the same type */ GNode *enc = qtdemux_tree_get_child_by_type (stsd, fourcc); stream->protected = TRUE; - if (!qtdemux_parse_protection_scheme_info (qtdemux, stream, enc, &fourcc)) + if (!qtdemux_parse_protection_scheme_info (qtdemux, stream, enc, &fourcc)) { GST_ERROR_OBJECT (qtdemux, "Failed to parse protection scheme info"); + goto corrupt_file; + } } if (stream->subtype == FOURCC_vide) { @@ -13503,7 +13508,6 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak) stsd_entry_data += len; remaining_stsd_len -= len; - } /* collect sample information */ -- 2.47.0