rpms/nginx
6
0
Fork 1
Code Issues Pull Requests Releases Activity

import UBI nginx-1.22.1-8.module+el9.5.0+22953+b175c265.1

Browse Source
This commit is contained in:
eabdullin 2025-03-28 10:46:42 +00:00
parent 5013421fd1
commit 752453ddc3
2 changed files with 64 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
SOURCES/0012-CVE-2024-7347-Buffer-overread-in-the-mp4-module.patch Normal file
View File

@ -0,0 +1,56 @@
From b7e3c8bcfbee27061efdd40ffb3a8479a9bcd9c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com>
Date: Fri, 21 Mar 2025 04:12:14 +0100
Subject: [PATCH] CVE-2024-7347: Buffer overread in the mp4 module
---
src/http/modules/ngx_http_mp4_module.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
index 0e93fbd..a6e3e80 100644
--- a/src/http/modules/ngx_http_mp4_module.c
+++ b/src/http/modules/ngx_http_mp4_module.c
@@ -2789,7 +2789,8 @@ static ngx_int_t
ngx_http_mp4_crop_stsc_data(ngx_http_mp4_file_t *mp4,
ngx_http_mp4_trak_t *trak, ngx_uint_t start)
{
- uint32_t start_sample, chunk, samples, id, next_chunk, n,
+ uint64_t n;
+ uint32_t start_sample, chunk, samples, id, next_chunk,
prev_samples;
ngx_buf_t *data, *buf;
ngx_uint_t entries, target_chunk, chunk_samples;
@@ -2845,12 +2846,19 @@ ngx_http_mp4_crop_stsc_data(ngx_http_mp4_file_t *mp4,
next_chunk = ngx_mp4_get_32value(entry->chunk);
+ if (next_chunk < chunk) {
+ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
+ "unordered mp4 stsc chunks in \"%s\"",
+ mp4->file.name.data);
+ return NGX_ERROR;
+ }
+
ngx_log_debug5(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
"sample:%uD, chunk:%uD, chunks:%uD, "
"samples:%uD, id:%uD",
start_sample, chunk, next_chunk - chunk, samples, id);
- n = (next_chunk - chunk) * samples;
+ n = (uint64_t) (next_chunk - chunk) * samples;
if (start_sample < n) {
goto found;
@@ -2872,7 +2880,7 @@ ngx_http_mp4_crop_stsc_data(ngx_http_mp4_file_t *mp4,
"sample:%uD, chunk:%uD, chunks:%uD, samples:%uD",
start_sample, chunk, next_chunk - chunk, samples);
- n = (next_chunk - chunk) * samples;
+ n = (uint64_t) (next_chunk - chunk) * samples;
if (start_sample > n) {
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
--
2.44.0

9
SPECS/nginx.spec
View File

@ -56,7 +56,7 @@
Name: nginx
Epoch: 1
Version: 1.22.1
Release: 8%{?dist}
Release: 8%{?dist}.1
Summary: A high performance web server and reverse proxy server
# BSD License (two clause)
@ -120,6 +120,9 @@ Patch8: 0010-defer-ENGINE_finish-calls-to-a-cleanup.patch
# upstream patch - https://issues.redhat.com/browse/RHEL-40075
Patch9: 0011-Optimized-chain-link-usage.patch
# upstream patch - https://bugzilla.redhat.com/show_bug.cgi?id=2304966
Patch10: 0012-CVE-2024-7347-Buffer-overread-in-the-mp4-module.patch
BuildRequires: make
BuildRequires: gcc
BuildRequires: gnupg2
@ -632,6 +635,10 @@ fi
%changelog
* Mon Mar 24 2025 Luboš Uhliarik <luhliari@redhat.com> - 1:1.22.1-8.1
- Resolves: RHEL-84484 - nginx:1.22/nginx: specially crafted MP4 file may
cause denial of service (CVE-2024-7347)
* Tue Jul 16 2024 Luboš Uhliarik <luhliari@redhat.com> - 1:1.22.1-8
- Resolves: RHEL-49349 - nginx worker processes memory leak