Security fixes #27
Security fixes #27
Conversation
The calculation `hdrSize - dataSize` can underflow the 64-bit unsigned int dataSize type, which can lead to incorrect results. We throw an exception to stop the code from going any further. Addresses https://nvd.nist.gov/vuln/detail/CVE-2018-14325
and calculating the number of bytes needed to hold the list overflows Addresses https://nvd.nist.gov/vuln/detail/CVE-2018-14326 and https://nvd.nist.gov/vuln/detail/CVE-2018-14446
If the atom type has an embedded nul character "\x00", the loop can terminate early and return true (match) when it should return false (no match). This function should only return true if we have reached the loop termination conditions on s2. For example: // These test cases passed before and after this change AssertIsTrue( MP4NameFirstMatches( "sdtp", "sdtp" ) ); // Exact match AssertIsTrue( MP4NameFirstMatches( "trak", "trak[1]" ) ); // Matches up to [ AssertIsTrue( MP4NameFirstMatches( "sdtp", "sdtp." ) ); // Matches up to . AssertIsFalse( MP4NameFirstMatches( "\x00dtp", "sdtp." ) ); // Nul character at s[0] // These test cases failed before this change, and pass after this change AssertIsFalse( MP4NameFirstMatches( "s\x00tp", "sdtp." ) ); // Nul character at s[1] AssertIsFalse( MP4NameFirstMatches( "sd\x00p", "sdtp." ) ); // Nul character at s[2] AssertIsFalse( MP4NameFirstMatches( "sdt\x00", "sdtp." ) ); // Nul character at s[3] Addresses https://nvd.nist.gov/vuln/detail/CVE-2018-14403
If an exception occurs (because of a crafted MP4) before the value is reassigned, then a double free can occur. By setting the pointer to NULL after the first free, we prevent the double free in this case. Addresses: https://nvd.nist.gov/vuln/detail/CVE-2018-14054
daveorourke
force-pushed
the
securityFixes
branch
from
901c79b to
1695b60
Compare
|
👍 from me. |
This PR updates the mac prebuilt to pull in the security fixes applied in #27.
|
Hello , I try maintain libmp4v2 on github [1] for Fedora packaging and in bugzilla we have lots of bugs security reports [2] . [1] |
@sergiomb2 we have been made aware of a new, maintained fork of mp4v2 which you will likely find useful for your Fedora packages: https://github.com/enzo1982/mp4v2 and https://mp4v2.org/ |
5 participants
This PR addresses #20 and the following CVEs:
https://nvd.nist.gov/vuln/detail/CVE-2018-14446
https://nvd.nist.gov/vuln/detail/CVE-2018-14403
https://nvd.nist.gov/vuln/detail/CVE-2018-14379
https://nvd.nist.gov/vuln/detail/CVE-2018-14326
https://nvd.nist.gov/vuln/detail/CVE-2018-14325
https://nvd.nist.gov/vuln/detail/CVE-2018-14054