16accb6b24
- 264 license table entries with exact download URLs (224/264 resolved) - Complete sources/ directory with all BitBake recipes - Build configuration: tqma6ul-multi-mba6ulx, spaetzle (musl) - Full traceability for Softwarefreigabeantrag - GCC 13.4.0, Linux 6.6.102, U-Boot 2023.04, musl 1.2.4 - License distribution: GPL-2.0 (24), MIT (23), GPL-2.0+ (18), BSD-3 (16)
35 lines
1.5 KiB
Diff
35 lines
1.5 KiB
Diff
From 88955b1044ef38315b77ad1a509d63631a790a0f Mon Sep 17 00:00:00 2001
|
|
From: Roman Arutyunyan <arut@nginx.com>
|
|
Date: Mon, 12 Aug 2024 18:20:45 +0400
|
|
Subject: [PATCH] Mp4: rejecting unordered chunks in stsc atom.
|
|
|
|
Unordered chunks could result in trak->end_chunk smaller than trak->start_chunk
|
|
in ngx_http_mp4_crop_stsc_data(). Later in ngx_http_mp4_update_stco_atom()
|
|
this caused buffer overread while trying to calculate trak->end_offset.
|
|
|
|
CVE: CVE-2024-7347
|
|
Upstream-Status: Backport [https://github.com/nginx/nginx/commit/88955b1044ef38315b77ad1a509d63631a790a0f]
|
|
Signed-off-by: Ashish Sharma <asharma@mvista.com>
|
|
|
|
src/http/modules/ngx_http_mp4_module.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
|
|
index 1cd017c274..041ad263b5 100644
|
|
--- a/src/http/modules/ngx_http_mp4_module.c
|
|
+++ b/src/http/modules/ngx_http_mp4_module.c
|
|
@@ -3156,6 +3156,13 @@ ngx_http_mp4_crop_stsc_data(ngx_http_mp4_file_t *mp4,
|
|
|
|
next_chunk = ngx_mp4_get_32value(entry->chunk);
|
|
|
|
+ if (next_chunk < chunk) {
|
|
+ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
|
|
+ "unordered mp4 stsc chunks in \"%s\"",
|
|
+ mp4->file.name.data);
|
|
+ return NGX_ERROR;
|
|
+ }
|
|
+
|
|
ngx_log_debug5(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0,
|
|
"sample:%uD, chunk:%uD, chunks:%uD, "
|
|
"samples:%uD, id:%uD",
|