From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Wed, 2 Oct 2024 14:44:21 +0300 Subject: gdkpixbufdec: Check if initializing the video info actually succeeded Origin: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/5106dc94fb9b2d8bd0db547e2c325244b7c1f32c Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2024-47613 Otherwise a 0-byte buffer would be allocated, which gives NULL memory when mapped. Thanks to Antonio Morales for finding and reporting the issue. Fixes GHSL-2024-118 Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3876 Part-of: --- .../gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/ext/gdk_pixbuf/gstgdkpixbufdec.c +++ b/ext/gdk_pixbuf/gstgdkpixbufdec.c @@ -322,7 +322,8 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDe gst_video_info_init (&info); - gst_video_info_set_format (&info, fmt, width, height); + if (!gst_video_info_set_format (&info, fmt, width, height)) + goto format_not_supported; info.fps_n = filter->in_fps_n; info.fps_d = filter->in_fps_d; caps = gst_video_info_to_caps (&info); @@ -384,6 +385,12 @@ channels_not_supported: ("%d channels not supported", n_channels)); return GST_FLOW_ERROR; } +format_not_supported: + { + GST_ELEMENT_ERROR (filter, STREAM, DECODE, (NULL), + ("%d channels with %dx%d not supported", n_channels, width, height)); + return GST_FLOW_ERROR; + } no_buffer: { GST_DEBUG ("Failed to create outbuffer - %s", gst_flow_get_name (ret));