Backport of: From 8e884e4e31649a9fc19095d6501a1143b074aba8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Fri, 27 Sep 2024 09:47:50 +0300 Subject: [PATCH] qtdemux: Fix error handling when parsing cenc sample groups fails Thanks to Antonio Morales for finding and reporting the issue. Fixes GHSL-2024-238, GHSL-2024-239, GHSL-2024-240 Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3846 Part-of: --- .../gst-plugins-good/gst/isomp4/qtdemux.c | 25 ++++++++++++++----- 1 file changed, 19 insertions(+), 6 deletions(-) --- a/gst/isomp4/qtdemux.c +++ b/gst/isomp4/qtdemux.c @@ -11090,12 +11090,15 @@ qtdemux_parse_trak (GstQTDemux * qtdemux if (stream->subtype != FOURCC_soun) { GST_ERROR_OBJECT (qtdemux, "Unexpeced stsd type 'aavd' outside 'soun' track"); + goto corrupt_file; } else { /* encrypted audio with sound sample description v0 */ GNode *enc = qtdemux_tree_get_child_by_type (stsd, fourcc); stream->protected = TRUE; - if (!qtdemux_parse_protection_aavd (qtdemux, stream, enc, &fourcc)) + if (!qtdemux_parse_protection_aavd (qtdemux, stream, enc, &fourcc)) { GST_ERROR_OBJECT (qtdemux, "Failed to parse protection scheme info"); + goto corrupt_file; + } } } @@ -11104,8 +11107,10 @@ qtdemux_parse_trak (GstQTDemux * qtdemux * with the same type */ GNode *enc = qtdemux_tree_get_child_by_type (stsd, fourcc); stream->protected = TRUE; - if (!qtdemux_parse_protection_scheme_info (qtdemux, stream, enc, &fourcc)) + if (!qtdemux_parse_protection_scheme_info (qtdemux, stream, enc, &fourcc)) { GST_ERROR_OBJECT (qtdemux, "Failed to parse protection scheme info"); + goto corrupt_file; + } } if (stream->subtype == FOURCC_vide) {