Backport of: From d0949baf3dadea6021d54abef6802fed5a06af75 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Thu, 1 Dec 2016 13:32:22 +0200 Subject: [PATCH] qtdemux: Fix out of bounds read in tag parsing code We can't simply assume that the length of the tag value as given inside the stream is correct but should also check against the amount of data we have actually available. https://bugzilla.gnome.org/show_bug.cgi?id=775451 --- gst/isomp4/qtdemux.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Index: gst-plugins-good0.10-0.10.31/gst/isomp4/qtdemux.c =================================================================== --- gst-plugins-good0.10-0.10.31.orig/gst/isomp4/qtdemux.c 2017-03-23 10:53:50.101755883 -0400 +++ gst-plugins-good0.10-0.10.31/gst/isomp4/qtdemux.c 2017-03-23 10:53:50.093755784 -0400 @@ -7916,7 +7916,7 @@ } else { len = QT_UINT32 (node->data); type = QT_UINT32 ((guint8 *) node->data + 4); - if ((type >> 24) == 0xa9) { + if ((type >> 24) == 0xa9 && len > 8 + 4) { /* Type starts with the (C) symbol, so the next 32 bits are * the language code, which we ignore */ offset = 12;