Ticket #601 (closed defect: fixed)

Opened 3 years ago

Last modified 3 years ago

Reproducable libebml crash

Reported by: astrange Owned by: astrange
Priority: normal Milestone: 1.2.3
Component: matroska Version: 1.2.2
Severity: normal Keywords:
Cc:

Description

The attached file is not an mkv file. Opening it crashes Perian 1.2.2.

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   org.perian.Perian             	0x15b77e53 libebml::EbmlMaster::FindFirstElt(libebml::EbmlCallbacks const&, bool) + 53
1   org.perian.Perian             	0x15b58c2b MatroskaImport::OpenFile() + 271
2   org.perian.Perian             	0x15b48584 MatroskaImport::ValidateDataRef(char**, unsigned long, unsigned char*) + 36
3   ...ple.CoreServices.CarbonCore	0x99319ef7 callComponentStorage_4444 + 42
4   ...ple.CoreServices.CarbonCore	0x9930edcc CallComponentFunctionCommonWithStorage(char**, ComponentParameters*, long (*)(), unsigned long) + 54
5   org.perian.Perian             	0x15b48778 MatroskaImportComponentDispatch + 115
6   ...ple.CoreServices.CarbonCore	0x993075e1 CallComponent + 192
7   ...ple.CoreServices.CarbonCore	0x9930751f CallComponentDispatch + 29
8   com.apple.QuickTime           	0x91deef4c MovieImportValidateDataRef + 55
9   com.apple.QuickTime           	0x91bc7986 getNewMovieFromFileUsingImporters + 2518
10  com.apple.QuickTime           	0x91bc6d6d NewMovieFromFilePriv + 1875
11  com.apple.QuickTime           	0x91b977a0 NewMovieFromDataRefPriv_priv + 5792
12  com.apple.QuickTime           	0x91b958c3 NewMovieFromProperties_priv + 6213
13  com.apple.QTKit               	0x9075c2e6 -[QTMovie_QuickTime initWithAttributes:error:forParent:] + 5974
14  com.apple.QTKit               	0x90713798 -[QTMovie initWithAttributes:error:] + 1012
15  com.apple.QTKit               	0x907481b3 +[QTMovie movieWithAttributes:error:] + 74
16  com.apple.quicktimeplayer     	0x000060ad -[QTPMovieDocument readFromFile:ofType:error:] + 233
17  com.apple.quicktimeplayer     	0x00005f55 -[QTPMovieDocument initWithContentsOfFile:ofType:isHotPicks:error:] + 105
18  com.apple.quicktimeplayer     	0x00012782 -[QTPMovieDocument initWithContentsOfURL:ofType:error:] + 129
19  com.apple.AppKit              	0x97fc7801 -[NSDocumentController makeDocumentWithContentsOfURL:ofType:error:] + 383
20  com.apple.AppKit              	0x97fc75b9 -[NSDocumentController openDocumentWithContentsOfURL:display:error:] + 886
21  com.apple.quicktimeplayer     	0x00012476 -[QTPApplicationDelegate openFiles:openInNewPlayer:] + 382
22  com.apple.quicktimeplayer     	0x000122f1 -[QTPApplicationDelegate application:openFiles:] + 110
23  com.apple.AppKit              	0x97fc5825 -[NSApplication(NSAppleEventHandling) _handleAEOpenDocumentsForURLs:] + 559
24  com.apple.AppKit              	0x97f02fe0 -[NSApplication(NSAppleEventHandling) _handleCoreEvent:withReplyEvent:] + 236
25  com.apple.Foundation          	0x95b18298 -[NSAppleEventManager dispatchRawAppleEvent:withRawReply:handlerRefCon:] + 511
26  com.apple.Foundation          	0x95b1805c _NSAppleEventManagerGenericHandler + 228
27  com.apple.AE                  	0x95e43f5c aeDispatchAppleEvent(AEDesc const*, AEDesc*, unsigned long, unsigned char*) + 166
28  com.apple.AE                  	0x95e43e5b dispatchEventAndSendReply(AEDesc const*, AEDesc*) + 43
29  com.apple.AE                  	0x95e43d65 aeProcessAppleEvent + 197
30  com.apple.HIToolbox           	0x9447a197 AEProcessAppleEvent + 50
31  com.apple.AppKit              	0x97d7c7d2 _DPSNextEvent + 1420
32  com.apple.AppKit              	0x97d7bdd6 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 156
33  com.apple.quicktimeplayer     	0x00003a1c -[QTPApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 71
34  com.apple.AppKit              	0x97d3e1f3 -[NSApplication run] + 821
35  com.apple.AppKit              	0x97d36289 NSApplicationMain + 574
36  com.apple.quicktimeplayer     	0x00002495 start + 53

Attachments

crash.mkv Download (1000.0 KB) - added by astrange 3 years ago.

Change History

comment:1 Changed 3 years ago by astrange

  • Owner set to astrange
  • Status changed from new to assigned
  • Version changed from Select Version to 1.2.2
  • Component changed from Perian-Main to matroska
  • Milestone set to Next Fix

Changed 3 years ago by astrange

comment:2 Changed 3 years ago by tick

  • Milestone changed from Next Fix to 1.2.3

comment:3 Changed 3 years ago by astrange

EbmlHead *head = static_cast<EbmlHead *>(el_l0);

This case is unsafe. It doesn't check what element type el_l0 is.

comment:4 Changed 3 years ago by astrange

  • Status changed from assigned to closed
  • Resolution set to fixed

(In [1441]) MKV: Fix casting EbmlElement?* to EbmlHead?* without checking the actual element type

Rumor suggests that this is the most frequent crash in Perian.

Fixes #601

Note: See TracTickets for help on using tickets.