Fix format string vulnerability in FFmpeg MP4 demuxer diagnostics - #2315
Open
GuTS805 wants to merge 2 commits into
Open
Fix format string vulnerability in FFmpeg MP4 demuxer diagnostics#2315GuTS805 wants to merge 2 commits into
GuTS805 wants to merge 2 commits into
Conversation
…ects dvbsub_parse_object_segment() previously returned 0 (success) when encountering a character-coded (coding_method == 1) DVB subtitle object, silently dropping the caption content. Now returns -1 so the caller (dvbsub_decode) correctly treats this as a failure. Fixes CCExtractor#2303
processmp4_rust() and dumpchapters_rust() passed diagnostic strings built from untrusted input (e.g. the input filename) directly as the format-string argument to mprint(), which forwards to vfprintf(). Any '%' conversion specifier in that data would be interpreted against nonexistent varargs, causing a crash (reproduced: a filename like '%s%s%s%s%s%s%s%s.mp4' segfaults inside vfprintf). Added mprint_str(), which always calls mprint() with a literal "%s" format string and the message as its argument, and routed all 16 mprint() call sites in this file through it so untrusted data can never be interpreted as a format string. Fixes CCExtractor#2312
Collaborator
CCExtractor CI platform finished running the test files on windows. Below is a summary of the test results, when compared to test for commit c328108...:
Your PR breaks these cases:
NOTE: The following tests have been failing on the master branch as well as the PR:
It seems that not all tests were passed completely. This is an indication that the output of some files is not as expected (but might be according to you). Check the result page for more info. |
Collaborator
CCExtractor CI platform finished running the test files on linux. Below is a summary of the test results, when compared to test for commit 6077cf5...:
Your PR breaks these cases:
NOTE: The following tests have been failing on the master branch as well as the PR:
It seems that not all tests were passed completely. This is an indication that the output of some files is not as expected (but might be according to you). Check the result page for more info. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[FIX]
processmp4_rust()anddumpchapters_rust()(src/rust/src/demuxer/mp4.rs) build diagnostic strings from untrusted input (e.g. the input filename) and pass them directly as the format-string argument tomprint(), which forwards tovfprintf(). Any%conversion specifier in that data is interpreted against nonexistent varargs — reproduced crash: a filename like%s%s%s%s%s%s%s%s.mp4segfaults insidevfprintf(GDB backtrace in #2312).This adds
mprint_str(), which always callsmprint()with a literal"%s"format string and the message as its argument, and routes all 16mprint()call sites in this file through it, so untrusted data can never be interpreted as a format string.Fixes #2312
Note for reviewers: I see #2314 also addresses this issue with a similar approach (a dedicated
mprint_arguments()module + unit test). Filing this since it's my own reported issue and I'd already built/verified a fix independently, but happy to defer to whichever approach maintainers prefer — feel free to close this one if #2314 is preferred.In raising this pull request, I confirm the following (please check boxes):
Reason for this PR:
Sanity check:
Repro instructions:
enable_mp4_ffmpegfeature / CMakeWITH_FFMPEG=ON.ccextractor '%s%s%s%s%s%s%s%s.mp4'vfprintf(see GDB backtrace in issue Format string vulnerability (crash, CWE-134) in FFmpeg MP4 demuxer — filename passed directly as mprint() format string #2312).