From 276567b6a8e4b21dc978b352b5c715d6381867b1 Mon Sep 17 00:00:00 2001 From: Anuj Mittal Date: Mon, 29 Jul 2019 07:20:55 +0800 Subject: gstreamer1.0-plugins-base: fix CVE-2019-9928 Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie --- .../gstreamer1.0-plugins-base/CVE-2019-9928.patch | 33 ++++++++++++++++++++++ .../gstreamer/gstreamer1.0-plugins-base_1.14.4.bb | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2019-9928.patch diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2019-9928.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2019-9928.patch new file mode 100644 index 0000000000..0ad7245c8e --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2019-9928.patch @@ -0,0 +1,33 @@ +From f672277509705c4034bc92a141eefee4524d15aa Mon Sep 17 00:00:00 2001 +From: Tobias Ronge +Date: Thu, 14 Mar 2019 10:12:27 +0100 +Subject: [PATCH] gstrtspconnection: Security loophole making heap overflow + +The former code allowed an attacker to create a heap overflow by +sending a longer than allowed session id in a response and including a +semicolon to change the maximum length. With this change, the parser +will never go beyond 512 bytes. + +Upstream-Status: Backport +CVE: CVE-2019-9928 +Signed-off-by: Anuj Mittal +--- + gst-libs/gst/rtsp/gstrtspconnection.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gst-libs/gst/rtsp/gstrtspconnection.c b/gst-libs/gst/rtsp/gstrtspconnection.c +index a6755bedd..c0429064a 100644 +--- a/gst-libs/gst/rtsp/gstrtspconnection.c ++++ b/gst-libs/gst/rtsp/gstrtspconnection.c +@@ -2461,7 +2461,7 @@ build_next (GstRTSPBuilder * builder, GstRTSPMessage * message, + maxlen = sizeof (conn->session_id) - 1; + /* the sessionid can have attributes marked with ; + * Make sure we strip them */ +- for (i = 0; session_id[i] != '\0'; i++) { ++ for (i = 0; i < maxlen && session_id[i] != '\0'; i++) { + if (session_id[i] == ';') { + maxlen = i; + /* parse timeout */ +-- +2.21.0 + diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.14.4.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.14.4.bb index 12c9bbce9d..0d8b033f88 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.14.4.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.14.4.bb @@ -20,6 +20,7 @@ SRC_URI = " \ file://0010-gl-Add-switch-for-explicitely-enabling-disabling-GBM.patch \ file://0011-gl-Add-switches-for-explicitely-enabling-disabling-P.patch \ file://link-with-libvchostif.patch \ + file://CVE-2019-9928.patch \ " SRC_URI[md5sum] = "4dbe20c1bf44191c2b8833234df5cb2a" SRC_URI[sha256sum] = "ca6139490e48863e7706d870ff4e8ac9f417b56f3b9e4b3ce490c13b09a77461" -- cgit 1.2.3-korg