mirror of
https://git.yoctoproject.org/poky
synced 2026-05-01 15:32:12 +02:00
1e0216c6ba
Backport fixes for: * CVE-2025-47806 - Upstream-Status: Backport fromda4380c4df* CVE-2025-47808 - Upstream-Status: Backport from6b19f11751(From OE-Core rev: 974670b83970f78edcb9f7d09ba34ec3a327320a) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
51 lines
1.7 KiB
Diff
51 lines
1.7 KiB
Diff
From da4380c4df0e00f8d0bad569927bfc7ea35ec37d Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
|
Date: Thu, 8 May 2025 12:46:40 +0300
|
|
Subject: [PATCH] subparse: Make sure that subrip time string is not too long
|
|
before zero-padding
|
|
|
|
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4419
|
|
Fixes CVE-2025-47806
|
|
|
|
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9135>
|
|
|
|
CVE: CVE-2025-47806
|
|
Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/da4380c4df0e00f8d0bad569927bfc7ea35ec37d]
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
gst/subparse/gstsubparse.c | 11 ++++++++++-
|
|
1 file changed, 10 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/gst/subparse/gstsubparse.c b/gst/subparse/gstsubparse.c
|
|
index 1d8fa51..81a7f65 100644
|
|
--- a/gst/subparse/gstsubparse.c
|
|
+++ b/gst/subparse/gstsubparse.c
|
|
@@ -850,7 +850,7 @@ parse_subrip_time (const gchar * ts_string, GstClockTime * t)
|
|
g_strdelimit (s, " ", '0');
|
|
g_strdelimit (s, ".", ',');
|
|
|
|
- /* make sure we have exactly three digits after he comma */
|
|
+ /* make sure we have exactly three digits after the comma */
|
|
p = strchr (s, ',');
|
|
if (p == NULL) {
|
|
/* If there isn't a ',' the timestamp is broken */
|
|
@@ -859,6 +859,15 @@ parse_subrip_time (const gchar * ts_string, GstClockTime * t)
|
|
return FALSE;
|
|
}
|
|
|
|
+ /* Check if the comma is too far into the string to avoid
|
|
+ * stack overflow when zero-padding the sub-second part.
|
|
+ *
|
|
+ * Allow for 3 digits of hours just in case. */
|
|
+ if ((p - s) > sizeof ("hhh:mm:ss,")) {
|
|
+ GST_WARNING ("failed to parse subrip timestamp string '%s'", s);
|
|
+ return FALSE;
|
|
+ }
|
|
+
|
|
++p;
|
|
len = strlen (p);
|
|
if (len > 3) {
|
|
--
|
|
2.50.1
|
|
|