1194481 - OpenH264: stack-buffer-overflow [@CReadConfig::ReadLine]

Status: RESOLVED FIXED

(Core :: Audio/Video: GMP, defect)

Description

[Tyson Smith [:tsmith]]

This is in h264enc which the code for is included in openh264. This is NOT in the plugin code itself.

Fixing this issue will aid testing.

Comment 1

[Tyson Smith [:tsmith]]

Attachment: call_stack.txt

Comment 2

[Tyson Smith [:tsmith]]

Attachment: test_case.cfg

Comment 3

[Tyson Smith [:tsmith]]

Attachment: dummy.yuv

Comment 4

[Tyson Smith [:tsmith]]

To reproduce run the following command:
./h264enc test_case.cfg -bf /dev/null -org dummy.yuv

Comment 5

[sijchen]

this is fixed with PR https://github.com/cisco/openh264/pull/2072/files

Comment 6

[Tyson Smith [:tsmith]]

(In reply to sijchen from comment #5)
> this is fixed with PR https://github.com/cisco/openh264/pull/2072/files

I just looked at the diff:
-        if (nTagNum >= kiValSize)
+        if (nTagNum >= kiValSize-1)

Why not?
-        if (nTagNum >= kiValSize)
+        if (nTagNum > kiValSize)

Comment 7

[sijchen]

??
the current logic is.
when nTagNum== kiValSize-1, we want it to be true and go to break.

Comment 8

[Tyson Smith [:tsmith]]

(In reply to sijchen from comment #7)
> ??
> the current logic is.
> when nTagNum== kiValSize-1, we want it to be true and go to break.

Doh! Code is hard :) Ignore me.

Comment 9

[Tyson Smith [:tsmith]]

Verified fixed.