CaROS/poky
3
1
Fork 0
mirror of https://git.yoctoproject.org/git/poky synced 2026-01-04 16:10:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

gstreamer1.0-rtsp-server: fix CVE-2024-44331

Browse Source 
Incorrect Access Control in GStreamer RTSP server 1.25.0 in gst-rtsp-server/rtsp-media.c
allows remote attackers to cause a denial of service via a series of specially crafted
hexstream requests.

(From OE-Core rev: 3e7b7697ec32b0fa2808efcff4a6bd544261b3fe)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Archana Polampalli 2025-02-07 15:41:13 +00:00 committed by Steve Sakoman
parent f40fb67618
commit 1430219d5e
2 changed files with 47 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server/CVE-2024-44331.patch Normal file
View File

@ -0,0 +1,44 @@
From aa3e97d67c05d4648ea58c7ff7675e24a81ca72b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 24 Oct 2024 20:12:55 +0300
Subject: [PATCH] rtsp-server: Remove pointless assertions that can happen if
client provides invalid rates
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3731
Fixes CVE-2024-44331
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/7739>
CVE: CVE-2024-44331
Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/aa3e97d67c05d4648ea58c7ff7675e24a81ca72b]
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
---
gst/rtsp-server/rtsp-media.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/gst/rtsp-server/rtsp-media.c b/gst/rtsp-server/rtsp-media.c
index 8c62b0d..cbdc9f9 100644
--- a/gst/rtsp-server/rtsp-media.c
+++ b/gst/rtsp-server/rtsp-media.c
@@ -2755,15 +2755,13 @@ gst_rtsp_media_get_rates (GstRTSPMedia * media, gdouble * rate,
first_stream = FALSE;
} else {
if (save_rate != *rate || save_applied_rate != *applied_rate) {
- /* diffrent rate or applied_rate, weird */
- g_assert (FALSE);
+ /* different rate or applied_rate, weird */
result = FALSE;
break;
}
}
} else {
- /* complete stream withot rate and applied_rate, weird */
- g_assert (FALSE);
+ /* complete stream without rate and applied_rate, weird */
result = FALSE;
break;
}
--
2.40.0

4
meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.22.12.bb
View File

@ -8,7 +8,9 @@ DEPENDS = "gstreamer1.0 gstreamer1.0-plugins-base"
PNREAL = "gst-rtsp-server"
SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz"
SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz \
file://CVE-2024-44331.patch \
"
SRC_URI[sha256sum] = "bf6c7871e7cf3528e4ec87ddc2f2949691cd269f98e536482ae744c1405cf451"