From ef4a048fdc8d2b88be96a022ca3abbc86c74ddde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= Date: Sat, 2 Nov 2019 06:31:08 +0000 Subject: [PATCH] Fix https://nvd.nist.gov/vuln/detail/CVE-2018-14446 https://nvd.nist.gov/vuln/detail/CVE-2018-14403 https://nvd.nist.gov/vuln/detail/CVE-2018-14379 https://nvd.nist.gov/vuln/detail/CVE-2018-14326 https://nvd.nist.gov/vuln/detail/CVE-2018-14325 https://nvd.nist.gov/vuln/detail/CVE-2018-14054 based on https://github.com/TechSmith/mp4v2/pull/27 and https://github.com/sergiomb2/libmp4v2/ Update spec --- 0001-Fix-make-dist.patch | 4 +- ...an-man3-BTW-like-in-libmp4v2-1.5.0.1.patch | 6 +- 0003-Fix-out-of-tree-builds-182.patch | 6 +- 0004-Fix-GCC7-build.patch | 4 +- 0005-Fix-clang-compilation.patch | 39 ++++++++++++ ...-bounds-memory-access-in-MP4v2-2.0.0.patch | 28 +++++++++ ...Fix-v2-Type-confusion-in-MP4v2-2.0.0.patch | 33 +++++++++++ ...er-after-free-to-prevent-double-free.patch | 35 +++++++++++ ...er-underflow-overflow-in-MP4v2-2.0.0.patch | 59 +++++++++++++++++++ libmp4v2.spec | 28 ++++++--- 10 files changed, 224 insertions(+), 18 deletions(-) create mode 100644 0005-Fix-clang-compilation.patch create mode 100644 0007-Fix-Out-of-bounds-memory-access-in-MP4v2-2.0.0.patch create mode 100644 0008-Fix-v2-Type-confusion-in-MP4v2-2.0.0.patch create mode 100644 0009-Null-out-pointer-after-free-to-prevent-double-free.patch create mode 100644 0010-Fix-v2-Integer-underflow-overflow-in-MP4v2-2.0.0.patch diff --git a/0001-Fix-make-dist.patch b/0001-Fix-make-dist.patch index 1558313..2929dda 100644 --- a/0001-Fix-make-dist.patch +++ b/0001-Fix-make-dist.patch @@ -1,7 +1,7 @@ From 60e346211e53257d2fd0b39d4b89ce60c9053409 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= Date: Wed, 7 Oct 2015 03:59:59 +0100 -Subject: [PATCH 1/4] Fix make dist. +Subject: [PATCH 01/10] Fix make dist. Makes fail because make doc fails . for more information please see : @@ -276,5 +276,5 @@ index 9087853..e3b27dd 100644 +@COMMANDinstall{} @end example -- -2.7.4 +2.21.0 diff --git a/0002-Install-man-man3-BTW-like-in-libmp4v2-1.5.0.1.patch b/0002-Install-man-man3-BTW-like-in-libmp4v2-1.5.0.1.patch index 1d43b5b..4a72ad7 100644 --- a/0002-Install-man-man3-BTW-like-in-libmp4v2-1.5.0.1.patch +++ b/0002-Install-man-man3-BTW-like-in-libmp4v2-1.5.0.1.patch @@ -1,12 +1,12 @@ From fc65e21b1fe12cb3d51a8bc8152efbebedabbd6f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= Date: Wed, 7 Oct 2015 04:25:20 +0100 -Subject: [PATCH 2/4] Install man/man3/, BTW like in libmp4v2-1.5.0.1 +Subject: [PATCH 02/10] Install man/man3/, BTW like in libmp4v2-1.5.0.1 And fix 30 annoying warnings "target x given more than once in the same rule" --- - GNUmakefile.am | 73 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ + GNUmakefile.am | 73 ++++++++++++++++++++++++++++++++++++++++++++++ doc/GNUmakefile.mk | 2 +- 2 files changed, 74 insertions(+), 1 deletion(-) @@ -108,5 +108,5 @@ index dadb234..1e6188e 100644 DOC.texi.includes = \ doc/texi/base/project.texi \ -- -2.7.4 +2.21.0 diff --git a/0003-Fix-out-of-tree-builds-182.patch b/0003-Fix-out-of-tree-builds-182.patch index a78b373..e666b93 100644 --- a/0003-Fix-out-of-tree-builds-182.patch +++ b/0003-Fix-out-of-tree-builds-182.patch @@ -1,12 +1,12 @@ From d7de4350e9fb40c296798f2d0b5197aa760dd417 Mon Sep 17 00:00:00 2001 From: Sam Thursfield Date: Mon, 6 Feb 2017 06:23:19 +0100 -Subject: [PATCH 3/4] Fix out-of-tree builds (#182) +Subject: [PATCH 03/10] Fix out-of-tree builds (#182) Building with srcdir!=builddir was failing with a "no rule to create doc/MP4.3" error. --- - GNUmakefile.am | 144 ++++++++++++++++++++++++++++----------------------------- + GNUmakefile.am | 144 ++++++++++++++++++++++++------------------------- 1 file changed, 72 insertions(+), 72 deletions(-) diff --git a/GNUmakefile.am b/GNUmakefile.am @@ -165,5 +165,5 @@ index ea45d75..4b30ee6 100644 endif -- -2.7.4 +2.21.0 diff --git a/0004-Fix-GCC7-build.patch b/0004-Fix-GCC7-build.patch index dec02f9..9057243 100644 --- a/0004-Fix-GCC7-build.patch +++ b/0004-Fix-GCC7-build.patch @@ -1,7 +1,7 @@ From 855e9674232808ff3be7191b697dfb56917db21f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= Date: Wed, 8 Feb 2017 00:56:32 +0000 -Subject: [PATCH 4/4] Fix GCC7 build +Subject: [PATCH 04/10] Fix GCC7 build if (*pSlash != '\0') { @@ -26,5 +26,5 @@ index e07309d..1eb01f5 100644 *ppEncodingParams = (char *)MP4Calloc(length + 1); strncpy(*ppEncodingParams, pSlash, length); -- -2.7.4 +2.21.0 diff --git a/0005-Fix-clang-compilation.patch b/0005-Fix-clang-compilation.patch new file mode 100644 index 0000000..588c298 --- /dev/null +++ b/0005-Fix-clang-compilation.patch @@ -0,0 +1,39 @@ +From edc4f0ad8f37bb8aeae4e3ea34766dc6cdbb2f15 Mon Sep 17 00:00:00 2001 +From: David Carlos Manuelda +Date: Tue, 7 Aug 2018 05:42:28 +0200 +Subject: [PATCH 05/10] Fix clang compilation + +--- + src/mp4.cpp | 2 +- + src/mp4util.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/mp4.cpp b/src/mp4.cpp +index 1016f79..d576103 100644 +--- a/src/mp4.cpp ++++ b/src/mp4.cpp +@@ -896,7 +896,7 @@ MP4FileHandle MP4ReadProvider( const char* fileName, const MP4FileProvider* file + } + + catch (...) { +- return MP4_INVALID_TRACK_ID; ++ return (mp4v2_ismacrypParams *)MP4_INVALID_TRACK_ID; + } + } + +diff --git a/src/mp4util.h b/src/mp4util.h +index 1fbbd81..b33bb44 100644 +--- a/src/mp4util.h ++++ b/src/mp4util.h +@@ -33,7 +33,7 @@ namespace mp4v2 { namespace impl { + #ifndef ASSERT + # define ASSERT(expr) \ + if (!(expr)) { \ +- throw new Exception("assert failure: "LIBMPV42_STRINGIFY((expr)), __FILE__, __LINE__, __FUNCTION__ ); \ ++ throw new Exception("assert failure: " LIBMPV42_STRINGIFY((expr)), __FILE__, __LINE__, __FUNCTION__ ); \ + } + #endif + +-- +2.21.0 + diff --git a/0007-Fix-Out-of-bounds-memory-access-in-MP4v2-2.0.0.patch b/0007-Fix-Out-of-bounds-memory-access-in-MP4v2-2.0.0.patch new file mode 100644 index 0000000..d1fd1fd --- /dev/null +++ b/0007-Fix-Out-of-bounds-memory-access-in-MP4v2-2.0.0.patch @@ -0,0 +1,28 @@ +From a94a3372c6ef66a2276cc6cd92f7ec07a9c8bb6b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= +Date: Wed, 17 Oct 2018 16:13:06 +0100 +Subject: [PATCH 07/10] Fix Out-of-bounds memory access in MP4v2 2.0.0 + +The bug can be fixed by more checks when doing type comparison. +Reference: https://www.openwall.com/lists/oss-security/2018/07/18/3 + +Addresses https://nvd.nist.gov/vuln/detail/CVE-2018-14403 +--- + src/mp4util.cpp | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/mp4util.cpp b/src/mp4util.cpp +index 47bd74e..696dab4 100644 +--- a/src/mp4util.cpp ++++ b/src/mp4util.cpp +@@ -46,6 +46,7 @@ bool MP4NameFirstMatches(const char* s1, const char* s2) + s1++; + s2++; + } ++ if(*s2 != '[' && *s2 != '.' && *s2 != '\0') return false; + return true; + } + +-- +2.21.0 + diff --git a/0008-Fix-v2-Type-confusion-in-MP4v2-2.0.0.patch b/0008-Fix-v2-Type-confusion-in-MP4v2-2.0.0.patch new file mode 100644 index 0000000..a521552 --- /dev/null +++ b/0008-Fix-v2-Type-confusion-in-MP4v2-2.0.0.patch @@ -0,0 +1,33 @@ +From bb920de948c85e3db4a52292ac7250a50e3bfc86 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= +Date: Sat, 2 Nov 2019 04:19:27 +0000 +Subject: [PATCH 08/10] Fix v2 Type confusion in MP4v2 2.0.0 + +The bug is caused by the wrong assumption that the child of an `ilst` +can never be an `ilst`. So we could fix it by simply adding an ASSERT. + +Reference: https://www.openwall.com/lists/oss-security/2018/07/17/1 +Addresses: https://nvd.nist.gov/vuln/detail/CVE-2018-14379 +--- + src/mp4atom.cpp | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/mp4atom.cpp b/src/mp4atom.cpp +index 520cbc8..7a0a53f 100644 +--- a/src/mp4atom.cpp ++++ b/src/mp4atom.cpp +@@ -778,8 +778,10 @@ MP4Atom::factory( MP4File &file, MP4Atom* parent, const char* type ) + const char* const ptype = parent->GetType(); + + if( descendsFrom( parent, "ilst" )) { +- if( ATOMID( ptype ) == ATOMID( "ilst" )) ++ if( ATOMID( ptype ) == ATOMID( "ilst" )) { ++ ASSERT(ATOMID( type ) != ATOMID( "ilst" )); + return new MP4ItemAtom( file, type ); ++ } + + if( ATOMID( type ) == ATOMID( "data" )) + return new MP4DataAtom(file); +-- +2.21.0 + diff --git a/0009-Null-out-pointer-after-free-to-prevent-double-free.patch b/0009-Null-out-pointer-after-free-to-prevent-double-free.patch new file mode 100644 index 0000000..6309b5d --- /dev/null +++ b/0009-Null-out-pointer-after-free-to-prevent-double-free.patch @@ -0,0 +1,35 @@ +From 3410bc66fb91f46325ab1d008b6a421dd8240949 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= +Date: Sat, 2 Nov 2019 04:21:17 +0000 +Subject: [PATCH 09/10] Null out pointer after free to prevent double free + +If an exception occurs (because of a crafted MP4) before the value is reassigned, then a double free can occur. By setting the pointer to NULL after the first free, we prevent the double free in this case. +Addresses: https://nvd.nist.gov/vuln/detail/CVE-2018-14054 + +copied form https://github.com/TechSmith/mp4v2/commit/f09cceeee5bd7f783fd31f10e8b3c440ccf4c743 +From: Dave O'Rourke +Date: Wed, 20 Mar 2019 08:57:29 -0400 +--- + src/mp4property.cpp | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/src/mp4property.cpp b/src/mp4property.cpp +index 9a5b1e3..1b8e1d2 100644 +--- a/src/mp4property.cpp ++++ b/src/mp4property.cpp +@@ -391,8 +391,10 @@ void MP4StringProperty::Read( MP4File& file, uint32_t index ) + char*& value = m_values[i]; + + // Generally a default atom setting, e.g. see atom_avc1.cpp, "JVT/AVC Coding"; we'll leak this string if +- // we don't free. Note that MP4Free checks for null. +- MP4Free(value); ++ // we don't free. Note that this code checks for null before calling free and sets the pointer to null ++ // after freeing it, to prevent a double free in case an exception occurs before the value is reassigned. ++ MP4Free( value ); ++ value = NULL; + + if( m_useCountedFormat ) { + value = file.ReadCountedString( (m_useUnicode ? 2 : 1), m_useExpandedCount, m_fixedLength ); +-- +2.21.0 + diff --git a/0010-Fix-v2-Integer-underflow-overflow-in-MP4v2-2.0.0.patch b/0010-Fix-v2-Integer-underflow-overflow-in-MP4v2-2.0.0.patch new file mode 100644 index 0000000..3c9a769 --- /dev/null +++ b/0010-Fix-v2-Integer-underflow-overflow-in-MP4v2-2.0.0.patch @@ -0,0 +1,59 @@ +From f5f814801ecd312a1418e2226dadfea72badec49 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= +Date: Sat, 2 Nov 2019 04:37:15 +0000 +Subject: [PATCH 10/10] Fix v2 Integer underflow/overflow in MP4v2 2.0.0 + +Reference: https://www.openwall.com/lists/oss-security/2018/07/16/1 + +For the overflow, we could check the result of the integer multiplication: + +Addresses https://nvd.nist.gov/vuln/detail/CVE-2018-14326 and https://nvd.nist.gov/vuln/detail/CVE-2018-14446 + +For the underflow, we could check if `dataSize >= hdrSize` satisfies: +Throw exception when invalid atom size would cause integer underflow +The calculation `hdrSize - dataSize` can underflow the 64-bit unsigned int dataSize type, which can lead to incorrect results. We throw an exception to stop the code from going any further. + +Addresses https://nvd.nist.gov/vuln/detail/CVE-2018-14325 +Based on https://github.com/TechSmith/mp4v2/commit/e475013c6ef78093055a02b0d035eda0f9f01451 +--- + src/mp4array.h | 5 ++++- + src/mp4atom.cpp | 6 ++++++ + 2 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/src/mp4array.h b/src/mp4array.h +index c49d59b..340d74d 100644 +--- a/src/mp4array.h ++++ b/src/mp4array.h +@@ -102,8 +102,11 @@ protected: + void Resize(MP4ArrayIndex newSize) { \ + m_numElements = newSize; \ + m_maxNumElements = newSize; \ ++ uint32_t mul = newSize * sizeof(type); \ ++ if(mul / newSize != sizeof(type)) \ ++ throw new Exception("multiplication overflow", __FILE__, __LINE__, __FUNCTION__);\ + m_elements = (type*)MP4Realloc(m_elements, \ +- m_maxNumElements * sizeof(type)); \ ++ mul); \ + } \ + \ + type& operator[](MP4ArrayIndex index) { \ +diff --git a/src/mp4atom.cpp b/src/mp4atom.cpp +index 7a0a53f..f5d5dc0 100644 +--- a/src/mp4atom.cpp ++++ b/src/mp4atom.cpp +@@ -143,6 +143,12 @@ MP4Atom* MP4Atom::ReadAtom(MP4File& file, MP4Atom* pParentAtom) + dataSize = file.GetSize() - pos; + } + ++ if(dataSize < hdrSize) { ++ ostringstream oss; ++ oss << "Invalid atom size in '" << type << "' atom, dataSize = " << dataSize << " cannot be less than hdrSize = " << static_cast( hdrSize ); ++ log.errorf( "%s: \"%s\": %s", __FUNCTION__, file.GetFilename().c_str(), oss.str().c_str() ); ++ throw new Exception( oss.str().c_str(), __FILE__, __LINE__, __FUNCTION__ ); ++ } + dataSize -= hdrSize; + + log.verbose1f("\"%s\": type = \"%s\" data-size = %" PRIu64 " (0x%" PRIx64 ") hdr %u", +-- +2.21.0 + diff --git a/libmp4v2.spec b/libmp4v2.spec index ba86644..e645291 100644 --- a/libmp4v2.spec +++ b/libmp4v2.spec @@ -4,7 +4,7 @@ Summary: Library for working with files using the mp4 container format Name: libmp4v2 Version: 2.1.0 -Release: 0.17%{gver}%{?dist} +Release: 0.18%{gver}%{?dist} License: MPLv1.1 URL: http://code.google.com/p/mp4v2 # mp4v2-trunk-r507.tar.bz2 made with ./make-svn-snapshot.sh @@ -16,6 +16,11 @@ Patch1: 0001-Fix-make-dist.patch Patch2: 0002-Install-man-man3-BTW-like-in-libmp4v2-1.5.0.1.patch Patch3: 0003-Fix-out-of-tree-builds-182.patch Patch4: 0004-Fix-GCC7-build.patch +Patch5: 0005-Fix-clang-compilation.patch +Patch7: 0007-Fix-Out-of-bounds-memory-access-in-MP4v2-2.0.0.patch +Patch8: 0008-Fix-v2-Type-confusion-in-MP4v2-2.0.0.patch +Patch9: 0009-Null-out-pointer-after-free-to-prevent-double-free.patch +Patch10:0010-Fix-v2-Integer-underflow-overflow-in-MP4v2-2.0.0.patch BuildRequires: gcc-c++ BuildRequires: autoconf automake gettext-devel libtool texinfo svn @@ -38,23 +43,19 @@ using the libmp4v2 library. %prep -%setup -q -n mp4v2-trunk -%patch1 -p1 -b .doc -%patch2 -p1 -b .doc2 -%patch3 -p1 -b .doc3 -%patch4 -p1 -b .gcc7 +%autosetup -p1 -n mp4v2-trunk %build autoreconf --force --install --verbose %configure --disable-static -%{__make} %{?_smp_mflags} +%make_build %{__make} txt export LANG=en_US.utf8 %{__make} api %install -%{__make} install DESTDIR=%{buildroot} +%make_install find %{buildroot} -name '*.la' -delete %ldconfig_scriptlets @@ -75,6 +76,17 @@ find %{buildroot} -name '*.la' -delete %changelog +* Sat Nov 02 2019 Sérgio Basto - 2.1.0-0.18.trunkREV507 +- Fix https://nvd.nist.gov/vuln/detail/CVE-2018-14446 + https://nvd.nist.gov/vuln/detail/CVE-2018-14403 + https://nvd.nist.gov/vuln/detail/CVE-2018-14379 + https://nvd.nist.gov/vuln/detail/CVE-2018-14326 + https://nvd.nist.gov/vuln/detail/CVE-2018-14325 + https://nvd.nist.gov/vuln/detail/CVE-2018-14054 + based on https://github.com/TechSmith/mp4v2/pull/27 + and https://github.com/sergiomb2/libmp4v2/ +- Update spec + * Thu Jul 25 2019 Fedora Release Engineering - 2.1.0-0.17.trunkREV507 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild