Bug#1149047: libmms0: Infinite loops and heap OOB read when parsing malformed ASF headers, possible CVE

[Adrian Pfeffer]

Control: tags -1 + patch

Hi,
the proposed patch is attached.

Best regards,Adrian Pfeffer
--- a/src/mms-common-funcs.h
+++ b/src/mms-common-funcs.h
@@ -145,7 +145,7 @@
     guid = get_guid(this->asf_header, i);
     length = LE_64(this->asf_header + i + 16);
 
-    if ((i + length) > this->asf_header_len) return;
+    if (length < 24 || length > this->asf_header_len - i) return;
 
     switch (guid) {
 
@@ -177,7 +177,7 @@
           uint16_t stream_id;
           int j, stream_index, bitrate;
 
-          for(j = 0; j < streams; j++) {
+          for(j = 0; j < streams && (i + 24 + 2 + j*6 + 6) <= this->asf_header_len; j++) {
             stream_id = LE_16(this->asf_header + i + 24 + 2 + j * 6);
             bitrate   = LE_32(this->asf_header + i + 24 + 4 + j * 6);
             lprintf("stream id %d, bitrate %d\n", stream_id, bitrate);
@@ -220,6 +220,9 @@
             if ((j + l) > length)
               break;
 
+            if (l < 24)
+              break;
+
             if (guid == GUID_ASF_EXTENDED_STREAM_PROPERTIES &&
                 (24 + 64) <= l) {
                   int stream_no = LE_16(this->asf_header + i + j + 24 + 48);