Welcome! Log In Create A New Profile

Advanced

[nginx] Mp4: fixed possible pointer overflow on 32-bit platforms.

Maxim Dounin
December 04, 2018 08:40AM
details: https://hg.nginx.org/nginx/rev/2dad54c2b8ed
branches: stable-1.14
changeset: 7422:2dad54c2b8ed
user: Maxim Dounin <mdounin@mdounin.ru>
date: Wed Nov 21 20:23:16 2018 +0300
description:
Mp4: fixed possible pointer overflow on 32-bit platforms.

On 32-bit platforms mp4->buffer_pos might overflow when a large
enough (close to 4 gigabytes) atom is being skipped, resulting in
incorrect memory addesses being read further in the code. In most
cases this results in harmless errors being logged, though may also
result in a segmentation fault if hitting unmapped pages.

To address this, ngx_mp4_atom_next() now only increments mp4->buffer_pos
up to mp4->buffer_end. This ensures that overflow cannot happen.

diffstat:

src/http/modules/ngx_http_mp4_module.c | 9 ++++++++-
1 files changed, 8 insertions(+), 1 deletions(-)

diffs (19 lines):

diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
--- a/src/http/modules/ngx_http_mp4_module.c
+++ b/src/http/modules/ngx_http_mp4_module.c
@@ -169,7 +169,14 @@ typedef struct {


#define ngx_mp4_atom_next(mp4, n) \
- mp4->buffer_pos += (size_t) n; \
+ \
+ if (n > (size_t) (mp4->buffer_end - mp4->buffer_pos)) { \
+ mp4->buffer_pos = mp4->buffer_end; \
+ \
+ } else { \
+ mp4->buffer_pos += (size_t) n; \
+ } \
+ \
mp4->offset += n


_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
Subject Author Views Posted

[nginx] Mp4: fixed possible pointer overflow on 32-bit platforms.

Maxim Dounin 43 December 04, 2018 08:40AM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 71
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready