REDHAT-BUG-2541471: Low severity GStreamer libgstcodecparsers vulnerability
GStreamer's H.266 (VVC) codec parser library (libgstcodecparsers) contains an out-of-bounds write vulnerability in gsth266parserparsedci() in gsth266parser.c (line 4812). CHECKALLOWEDMAX(dci->numptlsminus1, 15) allows value 15, but GstH266DCI.profiletierlevel[] has only 15 elements (indices 0..14). When dcinumptlsminus1 is 15, the loop writes past the structure via gsth266parseprofiletierlevel(). H.266 spec defines valid range 0..14; 15 is reserved. Fix: change bound to 14. Introduced in GStreamer 1.26. No in-tree element calls this API. Upstream report awaiting triage, no public patch. Reporter: Bruno Fournier. Tested on 1.29.2 (4cb910d) with ASan. PSIRT: PSIRTSUPT-24646.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the CHECK_ALLOWED_MAX bound for dci->num_ptls_minus1 from 15 to 14.
GStreamer's libgstcodecparsers H.266 parser CHECK_ALLOWED_MAX(dci->num_ptls_minus1, ...) bound in gst_h266_parser_parse_dci() = 14
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
No in-tree GStreamer element calls the affected API. Exposure is therefore limited to applications or external components that invoke gst_h266_parser_parse_dci(), particularly when they parse attacker-controlled H.266 bitstreams.
What input is required to trigger the out-of-bounds write?
An H.266 DCI structure must contain dci_num_ptls_minus1 set to 15. This value is reserved by the H.266 specification; valid values are 0 through 14.
What can be done before a patch is available?
Reject DCI inputs whose dci_num_ptls_minus1 value is 15 before they reach the parser, or avoid processing untrusted H.266 DCI data through this API. The stated code correction is to enforce a maximum value of 14; no public patch is available.
Which versions are known to contain the issue?
The issue was introduced in GStreamer 1.26. It was tested on version 1.29.2 (commit 4cb910d) using ASan.