From d4bab55077c6a77bd80cb12a8b0d28020ef412a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 24 Sep 2024 09:50:34 +0300
Subject: [PATCH] qtdemux: Skip zero-sized boxes instead of stopping to look at
 further boxes

A zero-sized box is not really a problem and can be skipped to look at any
possibly following ones.

BMD ATEM devices specifically write a zero-sized bmdc box in the sample
description, followed by the avcC box in case of h264. Previously the avcC box
would simply not be read at all and the file would be unplayable.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/7564>

Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d4bab55077c6a77bd80cb12a8b0d28020ef412a9]
CVE: CVE-2024-47537 CVE-2024-47539 CVE-2024-47543 CVE-2024-47544
CVE-2024-47545 CVE-2024-47546 CVE-2024-47596 CVE-2024-47597
CVE-2024-47598 #Dependency Patch
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
 .../gst-plugins-good/gst/isomp4/qtdemux.c     | 54 ++++++++++++-------
 1 file changed, 36 insertions(+), 18 deletions(-)

diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
index 32df6eeb85c1..5e5c21758058 100644
--- a/gst/isomp4/qtdemux.c
+++ b/gst/isomp4/qtdemux.c
@@ -12226,9 +12226,12 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
               else
                 size = len - 0x8;
 
-              if (size < 1)
-                /* No real data, so break out */
-                break;
+              /* No real data, so skip */
+              if (size < 1) {
+                len -= 8;
+                avc_data += 8;
+                continue;
+              }
 
               switch (QT_FOURCC (avc_data + 0x4)) {
                 case FOURCC_avcC:
@@ -12343,9 +12346,12 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
               else
                 size = len - 0x8;
 
-              if (size < 1)
-                /* No real data, so break out */
-                break;
+              /* No real data, so skip */
+              if (size < 1) {
+                len -= 8;
+                hevc_data += 8;
+                continue;
+              }
 
               switch (QT_FOURCC (hevc_data + 0x4)) {
                 case FOURCC_hvcC:
@@ -12767,9 +12773,12 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
               else
                 size = len - 8;
 
-              if (size < 1)
-                /* No real data, so break out */
-                break;
+              /* No real data, so skip */
+              if (size < 1) {
+                len -= 8;
+                vc1_data += 8;
+                continue;
+              }
 
               switch (QT_FOURCC (vc1_data + 0x4)) {
                 case GST_MAKE_FOURCC ('d', 'v', 'c', '1'):
@@ -12809,9 +12818,12 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
               else
                 size = len - 0x8;
 
-              if (size < 1)
-                /* No real data, so break out */
-                break;
+              /* No real data, so skip */
+              if (size < 1) {
+                len -= 8;
+                av1_data += 8;
+                continue;
+              }
 
               switch (QT_FOURCC (av1_data + 0x4)) {
                 case FOURCC_av1C:
@@ -12919,9 +12931,12 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
               else
                 size = len - 0x8;
 
-              if (size < 1)
-                /* No real data, so break out */
-                break;
+              /* No real data, so skip */
+              if (size < 1) {
+                len -= 8;
+                vpcc_data += 8;
+                continue;
+              }
 
               switch (QT_FOURCC (vpcc_data + 0x4)) {
                 case FOURCC_vpcC:
@@ -13421,9 +13436,12 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
             else
               size = len - 8;
 
-            if (size < 1)
-              /* No real data, so break out */
-              break;
+            /* No real data, so skip */
+            if (size < 1) {
+              len -= 8;
+              wfex_data += 8;
+              continue;
+            }
 
             switch (QT_FOURCC (wfex_data + 4)) {
               case GST_MAKE_FOURCC ('w', 'f', 'e', 'x'):
-- 
GitLab

