https://gstreamer.freedesktop.org/security/sa-2024-0003.html reports:
Security Advisory 2024-0003 (JVN#02030803, JPCERT#92912620, CVE-2024-40897)
Summary Orc compiler stack-based buffer overflow
Date 2024-07-19 12:30
Affected Versions orc < 0.4.39
IDs GStreamer-SA-2024-0003
JVN#02030803 / JPCERT#92912620
CVE-2024-40897
Details
-------
Stack-based buffer overflow in the Orc compiler when formatting error
messages for certain input files.
Impact
------
It is possible for a malicious third party to trigger a buffer overflow and
effect code execution with the same privileges as the orc compiler is called
with by feeding it with malformed orc source files.
This only affects developers and CI environments using orcc, not users of
liborc.
Solution
--------
The Orc 0.4.39 release address the issue. People using older branches of
Orc should apply the patches and recompile.
Patches: https://gitlab.freedesktop.org/gstreamer/orc/-/merge_requests/191.patch
The commit message on the fix states:
vasprintf() is a GNU/BSD extension and would allocate as much memory as required
on the heap, similar to g_strdup_printf(). It's ridiculous that such a function
is still not provided as part of standard C.
Note that asprintf() and vasprintf() are part of the POSIX.1-2024 standard
which was officially published last month, so these are no longer
system-specific extensions:
https://pubs.opengroup.org/onlinepubs/9799919799/functions/asprintf.html
https://pubs.opengroup.org/onlinepubs/9799919799/functions/vasprintf.html
though they are not yet part of the C standard itself.
--
-Alan Coopersmith- [email protected]
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
