16accb6b24
- 264 license table entries with exact download URLs (224/264 resolved) - Complete sources/ directory with all BitBake recipes - Build configuration: tqma6ul-multi-mba6ulx, spaetzle (musl) - Full traceability for Softwarefreigabeantrag - GCC 13.4.0, Linux 6.6.102, U-Boot 2023.04, musl 1.2.4 - License distribution: GPL-2.0 (24), MIT (23), GPL-2.0+ (18), BSD-3 (16)
53 lines
2.4 KiB
Diff
53 lines
2.4 KiB
Diff
From 7362d01658b61184108c21278443910da68f93b4 Mon Sep 17 00:00:00 2001
|
|
From: Roman Arutyunyan <arut@nginx.com>
|
|
Date: Mon, 12 Aug 2024 18:20:43 +0400
|
|
Subject: [PATCH] Mp4: fixed buffer underread while updating stsz atom.
|
|
|
|
While cropping an stsc atom in ngx_http_mp4_crop_stsc_data(), a 32-bit integer
|
|
overflow could happen, which could result in incorrect seeking and a very large
|
|
value stored in "samples". This resulted in a large invalid value of
|
|
trak->end_chunk_samples. This value is further used to calculate the value of
|
|
trak->end_chunk_samples_size in ngx_http_mp4_update_stsz_atom(). While doing
|
|
this, a large invalid value of trak->end_chunk_samples could result in reading
|
|
memory before stsz atom start. This could potentially result in a segfault.
|
|
|
|
CVE: CVE-2024-7347
|
|
Upstream-Status: Backport [https://github.com/nginx/nginx/commit/7362d01658b61184108c21278443910da68f93b4]
|
|
Signed-off-by: Ashish Sharma <asharma@mvista.com>
|
|
|
|
src/http/modules/ngx_http_mp4_module.c | 7 ++++---
|
|
1 file changed, 4 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
|
|
index 03175dea21..1cd017c274 100644
|
|
--- a/src/http/modules/ngx_http_mp4_module.c
|
|
+++ b/src/http/modules/ngx_http_mp4_module.c
|
|
@@ -3099,7 +3099,8 @@ static ngx_int_t
|
|
ngx_http_mp4_crop_stsc_data(ngx_http_mp4_file_t *mp4,
|
|
ngx_http_mp4_trak_t *trak, ngx_uint_t start)
|
|
{
|
|
- uint32_t start_sample, chunk, samples, id, next_chunk, n,
|
|
+ uint64_t n;
|
|
+ uint32_t start_sample, chunk, samples, id, next_chunk,
|
|
prev_samples;
|
|
ngx_buf_t *data, *buf;
|
|
ngx_uint_t entries, target_chunk, chunk_samples;
|
|
@@ -3160,7 +3161,7 @@ ngx_http_mp4_crop_stsc_data(ngx_http_mp4_file_t *mp4,
|
|
"samples:%uD, id:%uD",
|
|
start_sample, chunk, next_chunk - chunk, samples, id);
|
|
|
|
- n = (next_chunk - chunk) * samples;
|
|
+ n = (uint64_t) (next_chunk - chunk) * samples;
|
|
|
|
if (start_sample < n) {
|
|
goto found;
|
|
@@ -3182,7 +3183,7 @@ ngx_http_mp4_crop_stsc_data(ngx_http_mp4_file_t *mp4,
|
|
"sample:%uD, chunk:%uD, chunks:%uD, samples:%uD",
|
|
start_sample, chunk, next_chunk - chunk, samples);
|
|
|
|
- n = (next_chunk - chunk) * samples;
|
|
+ n = (uint64_t) (next_chunk - chunk) * samples;
|
|
|
|
if (start_sample > n) {
|
|
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
|