CVE-2018-13005

commit bceb03fd2be95097a7b409ea59914f332fb6bc86
Author: Aurelien David <aurelien.david@telecom-paristech.fr>
Date:   Thu Jun 28 13:34:08 2018 +0200
Description: CVE-2018-13005, CVE-2018-13006

    fixed 2 possible heap overflows (inc. #1088)

Gbp-Pq: Name CVE-2018-13005.patch

diff --git a/include/gpac/internal/isomedia_dev.h b/include/gpac/internal/isomedia_dev.h
index 11e990547509f11fb274748f61b3db74519ae96a..88112db8e12fbe036e2b801003771d9400dd8a94 100644 (file)
--- a/include/gpac/internal/isomedia_dev.h
+++ b/include/gpac/internal/isomedia_dev.h
@@ -3668,7 +3668,7 @@ GF_GenericSubtitleSample *gf_isom_parse_generic_subtitle_sample_from_data(char *
                char __ptype[5];\
                strcpy(__ptype, gf_4cc_to_str(__parent->type) );\
                GF_LOG(GF_LOG_WARNING, GF_LOG_CONTAINER, ("[iso file] extra box %s found in %s, deleting\n", gf_4cc_to_str(__abox->type), __ptype)); \
-               gf_isom_box_del(a);\
+               gf_isom_box_del(__abox);\
                return GF_OK;\
        }
 

diff --git a/src/isomedia/box_code_base.c b/src/isomedia/box_code_base.c
index a21c390791e232a3b4247e641bd1e915433238d3..873a6eeb042eb0ee2edb5171f9193af8a47b244e 100644 (file)
--- a/src/isomedia/box_code_base.c
+++ b/src/isomedia/box_code_base.c
@@ -632,7 +632,7 @@ GF_Err urn_Read(GF_Box *s, GF_BitStream *bs)
 
        //then get the break
        i = 0;
-       while ( (tmpName[i] != 0) && (i < to_read) ) {
+       while ( (i < to_read) && (tmpName[i] != 0) ) {
                i++;
        }
        //check the data is consistent

diff --git a/src/isomedia/box_dump.c b/src/isomedia/box_dump.c
index cbfaa73ac07d47b026f7d4324bc96d1a73db2f7b..247c35293205276dd943fd11aa9cf55cfda9bdc9 100644 (file)
--- a/src/isomedia/box_dump.c
+++ b/src/isomedia/box_dump.c
@@ -484,7 +484,7 @@ GF_Err hdlr_dump(GF_Box *a, FILE * trace)
 {
        GF_HandlerBox *p = (GF_HandlerBox *)a;
        gf_isom_box_dump_start(a, "HandlerBox", trace);
-       if (p->nameUTF8 && (u32) p->nameUTF8[0] == strlen(p->nameUTF8+1)) {
+       if (p->nameUTF8 && (u32) p->nameUTF8[0] == strlen(p->nameUTF8)-1) {
                fprintf(trace, "hdlrType=\"%s\" Name=\"%s\" ", gf_4cc_to_str(p->handlerType), p->nameUTF8+1);
        } else {
                fprintf(trace, "hdlrType=\"%s\" Name=\"%s\" ", gf_4cc_to_str(p->handlerType), p->nameUTF8);
@@ -4157,9 +4157,9 @@ static void oinf_entry_dump(GF_OperatingPointsInformation *ptr, FILE * trace)
                fprintf(trace, " maxPicWidth=\"%u\" maxPicHeight=\"%u\"", op->maxPicWidth, op->maxPicHeight);
                fprintf(trace, " maxChromaFormat=\"%u\" maxBitDepth=\"%u\"", op->maxChromaFormat, op->maxBitDepth);
                fprintf(trace, " frame_rate_info_flag=\"%u\" bit_rate_info_flag=\"%u\"", op->frame_rate_info_flag, op->bit_rate_info_flag);
-               if (op->frame_rate_info_flag) 
+               if (op->frame_rate_info_flag)
                        fprintf(trace, " avgFrameRate=\"%u\" constantFrameRate=\"%u\"", op->avgFrameRate, op->constantFrameRate);
-               if (op->bit_rate_info_flag) 
+               if (op->bit_rate_info_flag)
                        fprintf(trace, " maxBitRate=\"%u\" avgBitRate=\"%u\"", op->maxBitRate, op->avgBitRate);
                fprintf(trace, "/>\n");
        }
@@ -4261,14 +4261,14 @@ static void nalm_dump(FILE * trace, char *data, u32 data_size)
                fprintf(trace, "</NALUMap>\n");
                return;
        }
-       
+
        bs = gf_bs_new(data, data_size, GF_BITSTREAM_READ);
        gf_bs_read_int(bs, 6);
        large_size = gf_bs_read_int(bs, 1);
        rle = gf_bs_read_int(bs, 1);
        entry_count = gf_bs_read_int(bs, large_size ? 16 : 8);
        fprintf(trace, "<NALUMap rle=\"%d\" large_size=\"%d\">\n", rle, large_size);
-       
+
        while (entry_count) {
                u32 ID;
                fprintf(trace, "<NALUMapEntry ");
@@ -4335,7 +4335,7 @@ GF_Err sgpd_dump(GF_Box *a, FILE * trace)
                case GF_ISOM_SAMPLE_GROUP_TRIF:
                        trif_dump(trace, (char *) ((GF_DefaultSampleGroupDescriptionEntry*)entry)->data,  ((GF_DefaultSampleGroupDescriptionEntry*)entry)->length);
                        break;
-                       
+
                case GF_ISOM_SAMPLE_GROUP_NALM:
                        nalm_dump(trace, (char *) ((GF_DefaultSampleGroupDescriptionEntry*)entry)->data,  ((GF_DefaultSampleGroupDescriptionEntry*)entry)->length);
                        break;
@@ -4501,7 +4501,7 @@ GF_Err tenc_dump(GF_Box *a, FILE * trace)
                fprintf(trace, "\"  KID=\"");
        }
        dump_data_hex(trace, (char *) ptr->KID, 16);
-       if (ptr->version) 
+       if (ptr->version)
                fprintf(trace, "\" crypt_byte_block=\"%d\" skip_byte_block=\"%d", ptr->crypt_byte_block, ptr->skip_byte_block);
        fprintf(trace, "\">\n");
        gf_isom_box_dump_done("TrackEncryptionBox", a, trace);