1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
https://bugs.gentoo.org/974286
https://gstreamer.freedesktop.org/security/sa-2026-0021.html
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11247
From 83becc83eac477ecb97171f8278b0047dd7b6d5f Mon Sep 17 00:00:00 2001
From: Cameron O'Neal <tzusec@gmail.com>
Date: Wed, 1 Apr 2026 13:42:51 +0300
Subject: [PATCH 1/2] wavparse: Fix integer overflow when checking available
buffer size for reading cues
See https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5009
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11247>
--- a/gst/wavparse/gstwavparse.c
+++ b/gst/wavparse/gstwavparse.c
@@ -796,6 +796,7 @@ gst_wavparse_cue_chunk (GstWavParse * wav, const guint8 * data, guint32 size)
guint32 i, ncues;
GList *cues = NULL;
GstWavParseCue *cue;
+ guint32 expected_size;
if (wav->cues) {
GST_WARNING_OBJECT (wav, "found another cue's");
@@ -808,14 +809,15 @@ gst_wavparse_cue_chunk (GstWavParse * wav, const guint8 * data, guint32 size)
}
ncues = GST_READ_UINT32_LE (data);
+ size -= 4;
+ data += 4;
- if (size < 4 + ncues * 24) {
+ if (!g_uint_checked_mul (&expected_size, ncues, 24) || size < expected_size) {
GST_WARNING_OBJECT (wav, "broken file %d %d", size, ncues);
return FALSE;
}
/* parse data */
- data += 4;
for (i = 0; i < ncues; i++) {
cue = g_new0 (GstWavParseCue, 1);
cue->id = GST_READ_UINT32_LE (data);
--
GitLab
From 44f04fb2871a173027adcfdbafb72d31fddfec7c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Wed, 1 Apr 2026 13:44:52 +0300
Subject: [PATCH 2/2] wavparse: Use prepend+reverse instead of append when
building the cues list
append has quadratic behaviour and this can matter if there are a lot of cues.
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11247>
--- a/gst/wavparse/gstwavparse.c
+++ b/gst/wavparse/gstwavparse.c
@@ -826,11 +826,11 @@ gst_wavparse_cue_chunk (GstWavParse * wav, const guint8 * data, guint32 size)
cue->chunk_start = GST_READ_UINT32_LE (data + 12);
cue->block_start = GST_READ_UINT32_LE (data + 16);
cue->sample_offset = GST_READ_UINT32_LE (data + 20);
- cues = g_list_append (cues, cue);
+ cues = g_list_prepend (cues, cue);
data += 24;
}
- wav->cues = cues;
+ wav->cues = g_list_reverse (cues);
return TRUE;
}
--
GitLab
|
