generic-library/ebml
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

EbmlMaster: propagate upper level element after infinite sized one correctly

Browse Source 
When the parser encountered a deeply nested element with an infinite
size then a following element of an upper level was not propagated
correctly. Instead the element with the infinite size was added into the
EBML element tree a second time resulting in memory access after freeing
it and multiple attempts to free the same memory address during
destruction.

Fixes the issue reported as Cisco TALOS-CAN-0037.
This commit is contained in:
Moritz Bunkus 2015-10-20 14:53:44 +02:00
parent 24e5cd7c66
commit 88409e2a94
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog
View File

@ -1,5 +1,13 @@
2015-10-20 Moritz Bunkus <moritz@bunkus.org>
* EbmlMaster::Read(): When the parser encountered a deeply nested
element with an infinite size then a following element of an upper
level was not propagated correctly. Instead the element with the
infinite size was added into the EBML element tree a second time
resulting in memory access after freeing it and multiple attempts
to free the same memory address during destruction. Fixes the
issue reported as Cisco TALOS-CAN-0037.
* EbmlElement::ReadCodedSizeValue(): Fixed an invalid memory
access. When reading a EBML variable length integer value a read
access beyond the end of the available buffer was possible if

8
src/EbmlMaster.cpp
View File

@ -454,6 +454,14 @@ void EbmlMaster::Read(EbmlStream & inDataStream, const EbmlSemanticContext & sCo
} else {
if (DeleteElement)
delete ElementLevelA;
if (UpperEltFound) {
--UpperEltFound;
if (UpperEltFound > 0 || MaxSizeToRead <= 0)
goto processCrc;
ElementLevelA = FoundElt;
}
break;
}
}