REDHAT-BUG-2487615: Buffer Overflow
GStreamer WavPack decoder heap buffer overflow via integer overflow. In gstwavpackdechandleframe() (gstwavpackdec.c), the allocation gmalloc(4 wph.blocksamples dec->channels) uses unchecked 32-bit arithmetic. With blocksamples=0x20000001 and stereo, the multiplication wraps to 8 bytes; WavpackUnpackSamples() then writes ~4 GiB past the allocation. Affects 64-bit RHEL (arithmetic is 32-bit before sizet promotion). Fix pending in GStreamer 1.28.4. Reported via PSIRTSUPT-8879 by Seung Min Shin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GStreamerto a version that resolves this vulnerability.Fixed in 1.28.4 - Compensating control
If you cannot upgrade immediately, restrict or disable use of the WavPack (WavPack decoder) stream type so gst_wavpack_dec_handle_frame() cannot be reached.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2487615?
The severity of REDHAT-BUG-2487615 is classified as high with a score of 7.
What type of vulnerability is related to REDHAT-BUG-2487615?
REDHAT-BUG-2487615 is associated with a heap buffer overflow due to an integer overflow.
How does the vulnerability REDHAT-BUG-2487615 occur in the GStreamer WavPack decoder?
The vulnerability occurs in the gst_wavpack_dec_handle_frame() function where unchecked 32-bit arithmetic leads to incorrect memory allocation.
What are the potential impacts of the REDHAT-BUG-2487615 vulnerability?
The potential impacts include memory corruption that could lead to application crashes or execution of arbitrary code.
How can I mitigate the risks of REDHAT-BUG-2487615 in my applications?
To mitigate REDHAT-BUG-2487615, ensure you update to the latest version of GStreamer or apply the necessary patches that address the vulnerability.