mirror of
https://git.yoctoproject.org/poky
synced 2026-03-17 04:39:40 +01:00
gstreamer1.0-plugins-bad: Fix CVE-2025-3887
Upstream-Status: Backport from5463f0e097&bcaab36098(From OE-Core rev: a35bdbdb4d1dd77de7b85ab19d7354be6a11e8b2) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Vijay Anusuri
committed by
Steve Sakoman
Steve Sakoman
parent
bc7377a239
commit
2b82706dc5
@@ -0,0 +1,50 @@
|
||||
From 5463f0e09768ca90aa8c58357c1f4c645db580db Mon Sep 17 00:00:00 2001
|
||||
From: Seungha Yang <seungha@centricular.com>
|
||||
Date: Sat, 15 Mar 2025 22:39:44 +0900
|
||||
Subject: [PATCH 1/2] h265parser: Fix max_dec_pic_buffering_minus1 bound check
|
||||
|
||||
Allowed max value is MaxDpbSize - 1
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8885>
|
||||
|
||||
Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/5463f0e09768ca90aa8c58357c1f4c645db580db]
|
||||
CVE: CVE-2025-3887
|
||||
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
|
||||
---
|
||||
gst-libs/gst/codecparsers/gsth265parser.c | 6 ++++--
|
||||
1 file changed, 4 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/gst-libs/gst/codecparsers/gsth265parser.c b/gst-libs/gst/codecparsers/gsth265parser.c
|
||||
index 3db1c38..d02e32d 100644
|
||||
--- a/gst-libs/gst/codecparsers/gsth265parser.c
|
||||
+++ b/gst-libs/gst/codecparsers/gsth265parser.c
|
||||
@@ -72,6 +72,8 @@
|
||||
#include <string.h>
|
||||
#include <math.h>
|
||||
|
||||
+#define MAX_DPB_SIZE 16
|
||||
+
|
||||
#ifndef GST_DISABLE_GST_DEBUG
|
||||
#define GST_CAT_DEFAULT gst_h265_debug_category_get()
|
||||
static GstDebugCategory *
|
||||
@@ -1686,7 +1688,7 @@ gst_h265_parse_vps (GstH265NalUnit * nalu, GstH265VPS * vps)
|
||||
for (i =
|
||||
(vps->sub_layer_ordering_info_present_flag ? 0 :
|
||||
vps->max_sub_layers_minus1); i <= vps->max_sub_layers_minus1; i++) {
|
||||
- READ_UE_MAX (&nr, vps->max_dec_pic_buffering_minus1[i], G_MAXUINT32 - 1);
|
||||
+ READ_UE_MAX (&nr, vps->max_dec_pic_buffering_minus1[i], MAX_DPB_SIZE - 1);
|
||||
READ_UE_MAX (&nr, vps->max_num_reorder_pics[i],
|
||||
vps->max_dec_pic_buffering_minus1[i]);
|
||||
READ_UE_MAX (&nr, vps->max_latency_increase_plus1[i], G_MAXUINT32 - 1);
|
||||
@@ -1882,7 +1884,7 @@ gst_h265_parse_sps (GstH265Parser * parser, GstH265NalUnit * nalu,
|
||||
for (i =
|
||||
(sps->sub_layer_ordering_info_present_flag ? 0 :
|
||||
sps->max_sub_layers_minus1); i <= sps->max_sub_layers_minus1; i++) {
|
||||
- READ_UE_MAX (&nr, sps->max_dec_pic_buffering_minus1[i], 16);
|
||||
+ READ_UE_MAX (&nr, sps->max_dec_pic_buffering_minus1[i], MAX_DPB_SIZE - 1);
|
||||
READ_UE_MAX (&nr, sps->max_num_reorder_pics[i],
|
||||
sps->max_dec_pic_buffering_minus1[i]);
|
||||
READ_UE_MAX (&nr, sps->max_latency_increase_plus1[i], G_MAXUINT32 - 1);
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@@ -0,0 +1,93 @@
|
||||
From bcaab3609805ea10fb3d9ac0c9d947b4c3563948 Mon Sep 17 00:00:00 2001
|
||||
From: Seungha Yang <seungha@centricular.com>
|
||||
Date: Sat, 15 Mar 2025 23:48:52 +0900
|
||||
Subject: [PATCH 2/2] h265parser: Fix num_long_term_pics bound check
|
||||
|
||||
As defined in the spec 7.4.7.1, calculates allowed maximum
|
||||
value of num_long_term_pics
|
||||
|
||||
Fixes ZDI-CAN-26596
|
||||
|
||||
Fixes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4285
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8885>
|
||||
|
||||
Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/bcaab3609805ea10fb3d9ac0c9d947b4c3563948]
|
||||
CVE: CVE-2025-3887
|
||||
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
|
||||
---
|
||||
gst-libs/gst/codecparsers/gsth265parser.c | 40 +++++++++++++++++++++--
|
||||
1 file changed, 37 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/gst-libs/gst/codecparsers/gsth265parser.c b/gst-libs/gst/codecparsers/gsth265parser.c
|
||||
index d02e32d..ad9751f 100644
|
||||
--- a/gst-libs/gst/codecparsers/gsth265parser.c
|
||||
+++ b/gst-libs/gst/codecparsers/gsth265parser.c
|
||||
@@ -2513,6 +2513,8 @@ gst_h265_parser_parse_slice_hdr (GstH265Parser * parser,
|
||||
READ_UINT8 (&nr, slice->colour_plane_id, 2);
|
||||
|
||||
if (!GST_H265_IS_NAL_TYPE_IDR (nalu->type)) {
|
||||
+ const GstH265ShortTermRefPicSet *ref_pic_sets = NULL;
|
||||
+
|
||||
READ_UINT16 (&nr, slice->pic_order_cnt_lsb,
|
||||
(sps->log2_max_pic_order_cnt_lsb_minus4 + 4));
|
||||
|
||||
@@ -2525,21 +2527,53 @@ gst_h265_parser_parse_slice_hdr (GstH265Parser * parser,
|
||||
goto error;
|
||||
|
||||
slice->short_term_ref_pic_set_size = nal_reader_get_pos (&nr) - pos;
|
||||
+
|
||||
+ ref_pic_sets = &slice->short_term_ref_pic_sets;
|
||||
} else if (sps->num_short_term_ref_pic_sets > 1) {
|
||||
const guint n = ceil_log2 (sps->num_short_term_ref_pic_sets);
|
||||
READ_UINT8 (&nr, slice->short_term_ref_pic_set_idx, n);
|
||||
CHECK_ALLOWED_MAX (slice->short_term_ref_pic_set_idx,
|
||||
sps->num_short_term_ref_pic_sets - 1);
|
||||
+ ref_pic_sets =
|
||||
+ &sps->short_term_ref_pic_set[slice->short_term_ref_pic_set_idx];
|
||||
+ } else {
|
||||
+ ref_pic_sets = &sps->short_term_ref_pic_set[0];
|
||||
}
|
||||
|
||||
if (sps->long_term_ref_pics_present_flag) {
|
||||
guint32 limit;
|
||||
+ gint max_num_long_term_pics = 0;
|
||||
+ gint TwoVersionsOfCurrDecPicFlag = 0;
|
||||
|
||||
- if (sps->num_long_term_ref_pics_sps > 0)
|
||||
+ if (sps->num_long_term_ref_pics_sps > 0) {
|
||||
READ_UE_MAX (&nr, slice->num_long_term_sps,
|
||||
sps->num_long_term_ref_pics_sps);
|
||||
-
|
||||
- READ_UE_MAX (&nr, slice->num_long_term_pics, 16);
|
||||
+ }
|
||||
+
|
||||
+ /* 7.4.3.3.3 */
|
||||
+ if (pps->pps_scc_extension_flag &&
|
||||
+ pps->pps_scc_extension_params.pps_curr_pic_ref_enabled_flag &&
|
||||
+ (sps->sample_adaptive_offset_enabled_flag ||
|
||||
+ !pps->deblocking_filter_disabled_flag ||
|
||||
+ pps->deblocking_filter_override_enabled_flag)) {
|
||||
+ TwoVersionsOfCurrDecPicFlag = 1;
|
||||
+ }
|
||||
+
|
||||
+ /* Calculated upper bound num_long_term_pics can have. 7.4.7.1 */
|
||||
+ max_num_long_term_pics =
|
||||
+ /* sps_max_dec_pic_buffering_minus1[TemporalId], allowed max is
|
||||
+ * MaxDpbSize - 1 */
|
||||
+ MAX_DPB_SIZE - 1
|
||||
+ - (gint) slice->num_long_term_sps
|
||||
+ - (gint) ref_pic_sets->NumNegativePics
|
||||
+ - (gint) ref_pic_sets->NumPositivePics -
|
||||
+ TwoVersionsOfCurrDecPicFlag;
|
||||
+ if (max_num_long_term_pics < 0) {
|
||||
+ GST_WARNING ("Invalid stream, too many reference pictures");
|
||||
+ goto error;
|
||||
+ }
|
||||
+
|
||||
+ READ_UE_MAX (&nr, slice->num_long_term_pics, max_num_long_term_pics);
|
||||
limit = slice->num_long_term_sps + slice->num_long_term_pics;
|
||||
for (i = 0; i < limit; i++) {
|
||||
if (i < slice->num_long_term_sps) {
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@@ -17,6 +17,8 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad
|
||||
file://CVE-2024-0444.patch \
|
||||
file://CVE-2023-44446.patch \
|
||||
file://CVE-2023-50186.patch \
|
||||
file://CVE-2025-3887-1.patch \
|
||||
file://CVE-2025-3887-2.patch \
|
||||
"
|
||||
SRC_URI[sha256sum] = "87251beebfd1325e5118cc67774061f6e8971761ca65a9e5957919610080d195"
|
||||
|
||||
|
||||
Reference in New Issue
Block a user