REDHAT-BUG-2555538: Buffer Overflow
A flaw was found in the GStreamer ASF demuxer (gst-plugins-ugly). The Simple Index object parser reads an attacker-controlled entry count from the media and allocates an index table of that size with gnew0 without first clamping the count to the bytes remaining in the object. A crafted ASF, WMV, or WMA file can therefore request a very large heap allocation (on the order of tens of gigabytes of address space). When the allocation cannot be satisfied, or under memory limits, the application can abort or be terminated, resulting in denial of service. The parse loop stops when payload is exhausted, and GLib allocation helpers do not return an undersized buffer; this is not a heap buffer overflow.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Applications using the GStreamer ASF demuxer are exposed when they process attacker-supplied or otherwise untrusted ASF, WMV, or WMA media files. The impact is most likely where the process has memory limits or cannot satisfy the requested allocation.
What does an attacker need to trigger the problem?
An attacker needs to provide a crafted ASF-family media file whose Simple Index object contains a very large entry count. Parsing that object can request an index-table allocation on the order of tens of gigabytes of address space.
Is the reported impact a heap buffer overflow?
No. The parser stops when the available payload is exhausted, and the allocation helper does not return an undersized buffer; the described outcome is application abort or termination due to an unsatisfied allocation, causing denial of service.