[DoS] GStreamer hangs when given this malformed file

[Sergey "Shnatsel" Davidoff <unprivileged account>]

Anything based on GStreamer hangs when given the attached video file for playback. Tested on gst-play-1.0, shotwell-video-thumbnailer, Audience and Totem.

Depending on the application this can be accompanied by huge memory usage or significant CPU usage. According to debug output from gst-play-1.0, GStreamer goes into an infinite loop. This can cause denial of service in applications that do not enforce resource limits and operation timeouts - which, admittedly, can be hard to do for video.

The bug was found by American Fuzzy Lop after fuzzing shotwell-video-thumbnailer for 5 minutes.

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: libgstreamer1.0-0 1.2.4-0ubuntu1
ProcVersionSignature: Ubuntu 3.13.0-43.72-generic 3.13.11.11
Uname: Linux 3.13.0-43-generic x86_64
ApportVersion: 2.14.1-0ubuntu3.6
Architecture: amd64
CurrentDesktop: Unity
Date: Sat Dec 20 23:51:03 2014
InstallationDate: Installed on 2014-12-19 (0 days ago)
InstallationMedia: Ubuntu 14.04.1 LTS "Trusty Tahr" - Release amd64 (20140722.2)
SourcePackage: gstreamer1.0
UpgradeStatus: No upgrade log present (probably fresh install)

[Sergey "Shnatsel" Davidoff (shnatsel)]

This was fixed by Sebastian Droge with these commits:
http://cgit.freedesktop.org/gstreamer/gstreamer/commit/plugins/elements/gstmultiqueue.c?id=afcc93254b929e9938d9b7f5578fc533f7d6ae3e
http://cgit.freedesktop.org/gstreamer/gstreamer/commit/plugins/elements/gstmultiqueue.c?id=3032a369a7c42e77ecda7b4b08287865c52e3e64
earlier this year in August.

He has also applied the same fix to the queue and queue2 elements:
http://cgit.freedesktop.org/gstreamer/gstreamer/commit/plugins/elements/gstqueue.c?id=6a261b1fc28e4446f136131c686ff3530ba86ee5
http://cgit.freedesktop.org/gstreamer/gstreamer/log/plugins/elements/gstqueue2.c

It's all fixed since the 1.4.1 release, but not in any 1.2 release.

These patches should probably be backported.

[Sergey "Shnatsel" Davidoff (shnatsel)]

Upstream does not consider this a security vulnerability. Disclosing and unmarking private.