From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Fri, 27 Sep 2024 09:47:50 +0300 Subject: qtdemux: Fix error handling when parsing cenc sample groups fails Origin: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8e884e4e31649a9fc19095d6501a1143b074aba8 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2024-47544 Thanks to Antonio Morales for finding and reporting the issue. Fixes GHSL-2024-238, GHSL-2024-239, GHSL-2024-240 Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3846 Part-of: --- .../gst-plugins-good/gst/isomp4/qtdemux.c | 25 ++++++++++++++----- 1 file changed, 19 insertions(+), 6 deletions(-) --- a/gst/isomp4/qtdemux.c +++ b/gst/isomp4/qtdemux.c @@ -11316,12 +11316,15 @@ qtdemux_parse_trak (GstQTDemux * qtdemux if (stream->subtype != FOURCC_soun) { GST_ERROR_OBJECT (qtdemux, "Unexpeced stsd type 'aavd' outside 'soun' track"); + goto corrupt_file; } else { /* encrypted audio with sound sample description v0 */ GNode *enc = qtdemux_tree_get_child_by_type (stsd, fourcc); stream->protected = TRUE; - if (!qtdemux_parse_protection_aavd (qtdemux, stream, enc, &fourcc)) + if (!qtdemux_parse_protection_aavd (qtdemux, stream, enc, &fourcc)) { GST_ERROR_OBJECT (qtdemux, "Failed to parse protection scheme info"); + goto corrupt_file; + } } } @@ -11330,8 +11333,10 @@ qtdemux_parse_trak (GstQTDemux * qtdemux * with the same type */ GNode *enc = qtdemux_tree_get_child_by_type (stsd, fourcc); stream->protected = TRUE; - if (!qtdemux_parse_protection_scheme_info (qtdemux, stream, enc, &fourcc)) + if (!qtdemux_parse_protection_scheme_info (qtdemux, stream, enc, &fourcc)) { GST_ERROR_OBJECT (qtdemux, "Failed to parse protection scheme info"); + goto corrupt_file; + } } if (stream->subtype == FOURCC_vide) {