Bugzilla Bug 215006

Secunia:
k`sOSe has discovered a vulnerability in MPlayer, which potentially can be
exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an integer overflow error in the
"sdpplin_parse()" function in stream/realrtsp/sdpplin.c. This can be exploited
to overwrite arbitrary memory regions via an overly large "StreamCount" SDP
parameter.

Successful exploitation may allow execution of arbitrary code.


Original Advisory: http://milw0rm.com/exploits/5307

patch:
http://lists.mplayerhq.hu/pipermail/mplayer-dev-eng/2008-March/056938.html

BTW package media-video/realplayer-10.0.9 crashes too after ~ 70 sec

(In reply to comment #1)
> patch:
> http://lists.mplayerhq.hu/pipermail/mplayer-dev-eng/2008-March/056938.html
> 

For the record, there is currently an updated mplayer in the tree, but please
don't consider it a candidate for stabling yet since there's other MPlayer bugs
I'd like to see get fixed first.

IOW, please to wait a bit more. :)

Latest revision in tree:
=media-video/mplayer-1.0_rc2_p26450
candidate for stable

Arches, please test and mark stable:
=media-video/mplayer-1.0_rc2_p26450
Target keywords : "alpha amd64 hppa ia64 ppc ppc64 release sparc x86"

somehow this version tries to build i386 code on ppc64:

i386/mmx.h:24:2: warning: #warning Everything in this header is deprecated, use
plain asm()! New code using this header will be rejected.
i386/fdct_mmx.c: In function 'ff_fdct_mmx':
i386/fdct_mmx.c:527: warning: dereferencing type-punned pointer will break
strict-aliasing rules
i386/fdct_mmx.c: In function 'ff_fdct_mmx2':
i386/fdct_mmx.c:545: warning: dereferencing type-punned pointer will break
strict-aliasing rules
i386/fdct_mmx.c: In function 'ff_fdct_sse2':
i386/fdct_mmx.c:563: warning: dereferencing type-punned pointer will break
strict-aliasing rules
{standard input}: Assembler messages:
{standard input}:28: Error: Unrecognized opcode: `movdqa'
{standard input}:29: Error: Unrecognized opcode: `movdqa'
[...]

I might have time to look into this tomorrow.

Same for HPPA:

[ebuild     U ] media-video/mplayer-1.0_rc2_p26450 [1.0_rc2_p25993] USE="X a52
aac aalib alsa amrnb amrwb arts bidi bl cddb cdparanoia cpudetection
custom-cflags dga directfb dts dv dvd enca encode esd fbcon ftp ggi gif gtk
iconv ipv6 jack jpeg libcaca live lzo mad mp3 musepack nas opengl oss png
pulseaudio rtc samba sdl speex tga theora truetype unicode v4l v4l2 vidix
vorbis xanim xscreensaver xv xvid xvmc (-3dnow) (-3dnowext) (-altivec) -bindist
-cdio -debug -doc -dvb -joystick -ladspa (-lirc) -md5sum (-mmx) (-mmxext) -mp2
-nemesi (-openal) -pnm -quicktime -radio -rar (-real) -srt (-sse) (-sse2)
(-ssse3) (-svga) -teletext -tivo (-win32codecs) (-x264) -xinerama -zoran
(-livecd%)" VIDEO_CARDS="(-mga) (-s3virge) (-tdfx) (-vesa)" 0 kB [1]

(In reply to comment #5)
> Arches, please test and mark stable:
> =media-video/mplayer-1.0_rc2_p26450

Yah, that one is buggy so ignore the stable request for now.

Just to update eveyrone, I'm waiting on upstream to finish making some changes,
and then we'll get another candidate tested and in the tree.

any update here?

mplayer-1.0_rc2_p26753 should be a stable candidate, I need arches to test out.

I have heard of reports of problems with PPC boxes, but I can't test / describe
/ fix the problem myself, so any help would be much appreciated in that area. 
I suspect it's just a tiny bug with either the configure script or the
Makefile.

Arches please test and mark stable. Target keywords are:

mplayer-1.0_rc2_p26753.ebuild:KEYWORDS="alpha amd64 hppa ia64 ppc ppc64 sparc
x86 ~x86-fbsd

Stable for HPPA.

Well, I have to get around this before doing anything with sparc:
=================================================================
make -C libswscale
make[1]: Entering directory
`/var/tmp/portage/media-video/mplayer-1.0_rc2_p26753/work/mplayer-1.0_rc2_p26753/libswscale'
yuv2rgb_vis.c:1: *** missing separator.  Stop.
make[1]: Leaving directory
`/var/tmp/portage/media-video/mplayer-1.0_rc2_p26753/work/mplayer-1.0_rc2_p26753/libswscale'
make: *** [libswscale/libswscale.a] Error 2
make: *** Waiting for unfinished jobs....
===========================================
This failure is reproducible on my system and fails as well if I force
MAKEOPTS='-j1'

media-video/mplayer-1.0_rc2_p26753  USE="X a52 aac alsa arts cpudetection dga
directfb dts dvd encode ftp gif gtk iconv ipv6 jpeg live mad mmx mp2 mp3 opengl
png quicktime real samba sdl sse sse2 theora truetype unicode vorbis x264
xscreensaver xv xvid -3dnow -3dnowext -aalib (-altivec) -amrnb -amrwb -bidi
-bindist -bl -cddb -cdio -cdparanoia -custom-cflags -debug -doc -dv -dvb -enca
-esd -fbcon -ggi -jack -joystick -ladspa -libcaca -lirc -lzo -md5sum -mmxext
-musepack -nas -nemesi -openal -oss -pnm -pulseaudio -radio -rar -rtc -speex
-srt -ssse3 (-svga) -teletext -tga -v4l -v4l2 (-vidix) (-win32codecs) -xanim
-xinerama -xvmc -zoran" VIDEO_CARDS="-mga -s3virge -tdfx -vesa"

1. Emerges on AMD64. 
2. No collisions etc. 
3. Works. Have played a real player stream and a X264 video. 

Portage 2.1.4.4 (default-linux/amd64/2007.0/desktop, gcc-4.1.2, glibc-2.6.1-r0,
2.6.24-gentoo-r2 x86_64)
=================================================================
System uname: 2.6.24-gentoo-r2 x86_64 Intel(R) Core(TM)2 CPU 6600 @ 2.40GHz
Timestamp of tree: Fri, 16 May 2008 13:45:01 +0000
distcc 2.18.3 x86_64-pc-linux-gnu (protocols 1 and 2) (default port 3632)
[enabled]
ccache version 2.4 [enabled]
app-shells/bash:     3.2_p33
dev-java/java-config: 1.3.7, 2.1.6
dev-lang/python:     2.4.4-r9
dev-python/pycrypto: 2.0.1-r6
dev-util/ccache:     2.4-r7
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.1
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.23-r3
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=nocona -Os -msse3 -pipe -fomit-frame-pointer"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/config /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf
/etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/
/etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/splash /etc/terminfo
/etc/udev/rules.d"
CXXFLAGS="-march=nocona -Os -msse3 -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="ccache collision-protect distcc distlocks metadata-transfer
multilib-strict parallel-fetch sandbox sfperms strict test unmerge-orphans
userfetch"
GENTOO_MIRRORS="http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/
http://trumpetti.atm.tut.fi/gentoo/
http://ftp.snt.utwente.nl/pub/os/linux/gentoo
http://ds.thn.htu.se/linux/gentoo"
LC_ALL="en_DK.utf8"
MAKEOPTS="-j6"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --stats --timeout=180 --exclude=/distfiles
--exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="X a52 aac acl acpi aiglx alsa amd64 apache2 arts atk berkdb cairo cdr cli
cracklib crypt cups dbus dga directfb dri dts dvd dvdr dvdread eds emboss
encode evo fam fbcn ffmpeg firefox fortran ftp gd gdbm gif gphoto2 gpm
gstreamer gtk hal iconv icq ieee1394 ipv6 isdnlog java jpeg kde kerberos live
lm_sensors mad midi mikmod mjpeg mmx mozilla mp2 mp3 mpeg mplayer msn mudflap
ncurses nls nptl nptlonly ogg oggvorbis opengl openmp pam pcre pda pdf perl png
ppds pppd python qt qt3 qt3support qt4 quicktime readline reflection samba sdl
session spell spl sse sse2 sse3 ssl svg tcpd threads tiff truetype unicode
vorbis x264 xcomposite xml xorg xscreensaver xv xvid zlib" ALSA_CARDS="ali5451
als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938
es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx
via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop
empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi
null plug rate route share shm softvol" APACHE2_MODULES="actions alias
auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm
authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache
dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache
filter headers include info log_config logio mem_cache mime mime_magic
negotiation rewrite setenvif speling status unique_id userdir usertrack
vhost_alias" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux"
LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses
text" USERLAND="GNU" VIDEO_CARDS="radeon"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LDFLAGS,
LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

amd64/x86 stable, thanks Jonas.

Here's what's happening on sparc:  There is a sparc-only assembly routine,
libswscale/yuv2rgb_vis.c and clearly the Makefile in libswscale must be
architecture-specific.  And for sparc, it is wrong --- it contains this little
bit of code:
============================================
OBJS-$(ARCH_BFIN)          +=  swscale_bfin.o yuv2rgb_bfin.o
OBJS-$(CONFIG_GPL)         +=  yuv2rgb.o
OBJS-$(CONFIG_MLIB)        +=  yuv2rgb_mlib.c
OBJS-$(HAVE_ALTIVEC)       +=  yuv2rgb_altivec.o
OBJS-$(HAVE_VIS)           +=  yuv2rgb_vis.c             <<<<< WRONG!
==============================================

If I correct that, the make gest a bit further and gives this:
==============================================
sparc-unknown-linux-gnu-gcc -MM -DHAVE_AV_CONFIG_H -D_FILE_OFFSET_BITS=64
-D_LARGEFILE_SOURCE -D_ISOC9X_SOURCE -I.. -I.. -Wdisabled-optimization
-Wno-pointer-sign -Wdeclaration-after-statement -I. -Wall -Wno-switch
-Wpointer-arith -Wredundant-decls -O4  -mcpu=ultrasparc -pipe -ffast-math
-fomit-frame-pointer -D_REENTRANT -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
-D_LARGEFILE64_SOURCE -DHAVE_CONFIG_H -I/usr/X11R6/include -I/usr/include/SDL 
-D_REENTRANT  -I/usr/include/freetype2 -I/usr/include/gtk-2.0
-I/usr/lib/gtk-2.0/include -I/usr/include/atk-1.0 -I/usr/include/cairo
-I/usr/include/pango-1.0 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include
-I/usr/include/freetype2 -I/usr/include/libpng12    yuv2rgb_vis.c | sed
"s,[0-9a-z._-]*: \(/libswscale/\)*\([a-z0-9]*/\)[^/]* ,\2&," > yuv2rgb_vis.d
sparc-unknown-linux-gnu-gcc -DHAVE_AV_CONFIG_H -D_FILE_OFFSET_BITS=64
-D_LARGEFILE_SOURCE -D_ISOC9X_SOURCE -I.. -I.. -Wdisabled-optimization
-Wno-pointer-sign -Wdeclaration-after-statement -I. -Wall -Wno-switch
-Wpointer-arith -Wredundant-decls -O4  -mcpu=ultrasparc -pipe -ffast-math
-fomit-frame-pointer -D_REENTRANT -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
-D_LARGEFILE64_SOURCE -DHAVE_CONFIG_H -I/usr/X11R6/include -I/usr/include/SDL 
-D_REENTRANT  -I/usr/include/freetype2 -I/usr/include/gtk-2.0
-I/usr/lib/gtk-2.0/include -I/usr/include/atk-1.0 -I/usr/include/cairo
-I/usr/include/pango-1.0 -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include
-I/usr/include/freetype2 -I/usr/include/libpng12     -c -o yuv2rgb_vis.o
yuv2rgb_vis.c
yuv2rgb_vis.c:82: error: expected ‘)’ before ‘*’ token
yuv2rgb_vis.c:133: error: expected ‘)’ before ‘*’ token
yuv2rgb_vis.c:184: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or
‘__attribute__’ before ‘yuv2rgb_init_vis’
make: *** [yuv2rgb_vis.o] Error 1
========================================

That's because yuv2rgb_vis.c is messed up, too.  It's missing an include file,
so:
=======================================
#include "swscale.h"
#include "swscale_internal.h"        <<<< MISSING --- I added it by hand
=======================================

When I put that include for swscale_internal.h into yuv2rgb_vis.c, it can build
at least

So, for sparc, in libswscale/ both the Makefile and the assembler helper are
wrong.

Stabilized 1.0_rc2_p26753 on alpha.

Created an attachment (id=153461) [details]
Patch for correcting sparc build failure (Comments 13, 16)

This patch fixes the problems noted on sparc in Comment #13 and described in
Comment #16.  If I put it in
media-video/files/libswscale-sparc-1.0_rc2_p26753.patch
and apply it in src_unpack, for example, like this:
==========================
--- mplayer-1.0_rc2_p26753.ebuild-      2008-05-17 19:59:47.000000000 +0000
+++ mplayer-1.0_rc2_p26753.ebuild       2008-05-17 19:46:39.000000000 +0000
@@ -198,6 +198,11 @@

        # Fix polish spelling errors
        [[ -n ${LINGUAS} ]] && sed -e 's:Zarządano:Zażądano:' -i
help/help_mp-pl.h
+
+       # Fix libswscale-sparc-1.0_rc2_p26753
+       einfo "Fix sparc-specific problems in libscale"
+       cd "${S}"
+       epatch "${FILESDIR}/libswscale-sparc-${PVR}.patch"
 }
=============================================
 then mplayer-1.0_rc2_p26753 builds without error on sparc.  I cannot test it
before Monday the 19th, however.

I had thought that mplayer must build the Makefile on the fly, but it comes
with that Makefile and yuv2rgb_vis.c already setup and incorrect.

Tested =media-video/mplayer-1.0_rc2_p26753 USE="X a52 aac aalib alsa
custom-cflags dga doc dts dv dvd encode ftp gif gtk ipv6 jpeg lzo mad mp2 mp3
musepack openal opengl png pnm quicktime samba sdl speex theora truetype
unicode vidix vorbis x264 xanim xinerama xv xvid (-3dnow) (-3dnowext)
(-altivec) -amrnb -amrwb -arts -bidi -bindist -bl -cddb -cdio -cdparanoia
-cpudetection -debug (-directfb) (-dvb) -enca -esd -fbcon -ggi -iconv -jack
-joystick -ladspa -libcaca (-lirc) -live -md5sum (-mmx) (-mmxext) -nas -nemesi
-oss -pulseaudio -radio (-rar) (-real) -rtc -srt (-sse) (-sse2) (-ssse3)
(-svga) -teletext -tga -v4l (-v4l2) (-win32codecs) -xscreensaver (-xvmc)
(-zoran)" on sparc.

After appling the patch from comment 18 it compiles fine and I'm able to play
xvid movies, mp3 files/streams and dvds.

# emerge --info
Portage 2.1.4.4 (default-linux/sparc/sparc64/2007.0, gcc-4.1.2, glibc-2.6.1-r0,
2.6.24-gentoo-r8 sparc64)
=================================================================
System uname: 2.6.24-gentoo-r8 sparc64 sun4u
Timestamp of tree: Sun, 18 May 2008 16:06:01 +0000
app-shells/bash:     3.2_p33
dev-lang/python:     2.4.4-r9
dev-python/pycrypto: 2.0.1-r6
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.1
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.24
ACCEPT_KEYWORDS="sparc"
CBUILD="sparc-unknown-linux-gnu"
CFLAGS="-mcpu=ultrasparc3 -mtune=ultrasparc3 -mvis -Wa,-Av8plusa -O2 -pipe
-ggdb"
CHOST="sparc-unknown-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/fonts/fonts.conf /etc/gconf
/etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-mcpu=ultrasparc3 -mtune=ultrasparc3 -mvis -Wa,-Av8plusa -O2 -pipe
-ggdb"
DISTDIR="/tmp/distfiles"
FEATURES="collision-protect distlocks installsources metadata-transfer
parallel-fetch sandbox splitdebug strict test unmerge-orphans userfetch
userpriv usersandbox"
GENTOO_MIRRORS="http://distfiles.gentoo.org
http://distro.ibiblio.org/pub/linux/distributions/gentoo"
LANG="de_DE.UTF-8"
LDFLAGS="-Wl,-O1"
LINGUAS="de en"
MAKEOPTS="-j17"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --stats --timeout=180 --exclude=/distfiles
--exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/layman/sunrise
/usr/portage/local/layman/gnash-cvs /usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="64bit 7zip X a52 aac aalib ace agg alsa artworkextra audacious
blender-game bluetooth bzip2 c++ caps clock-screen cups curl custom-cflags cvs
cxx dbus devhelp dga disk-partition divx doc dri dts dv dvd dvdread eds encode
evo exif fastcgi fat festival ffmpeg flac ftp fuse gd gif gimp gimpprint glade
gmedia gnome gnome-print gnomecanvas gpm grammar gtk hal hpn ieee1394 imap ipv6
ithreads javascript jpeg jpeg2k key-screen libsexy lyrics lzo mad mbrola
memcache midi mikmod mjpeg mng mouse mp2 mp3 mpeg mpeg2 mplayer musepack
musicbrainz nautilus ncurses network network-cron networking nls nptl nptlonly
nsplugin offensive ogg openal opengl openmp opera pam parallel pcre pdf png pnm
ppds qt3support quicktime raw realmedia regex ruby samba sasl sdl sdl-image
search-screen slang smartcard smp sms sound soundex source sourceview sparc
speex spell sqlite3 ssl stream subversion svg symlink taglib tagwriting theora
threads tiff timidity tools truetype tta unicode usb userlocales utils vcd
vidix vim vim-syntax vim-with-x vorbis wma wmf wmp wordexp x264 xanim xcb xfce
xine xinerama xorg xulrunner xv xvid zlib" ALSA_CARDS="CS4231"
ALSA_PCM_PLUGINS="adpcm alaw copy dshare dsnoop extplug file hooks ladspa
lfloat linear meter mulaw multi null rate route share shm asym dmix empty
iec958 ioplug plug softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse"
KERNEL="linux" LINGUAS="de en" USERLAND="GNU" VIDEO_CARDS="mach64 fbdev mga"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL,
PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

Friedrich, thanks for testing.  I'll finish this off tomorrow when I'm a bit
closer to the sparc system I run this on.

I'll also say that on sparc, =media-video/mplayer-1.0_rc2_p26753 seems fine
with the Patch #153461 and ebuild change from Comment 18.  Otherwise, of
course, it won't even build.

=media-video/mplayer-1.0_rc2_p26753-r1 (yes, -r1) stable on ppc64

Sparc stable for mplayer-1.0_rc2_p26753-r1.  Now builds fine and works as
expected.

ppc stable

GLSA request filed.

ia64 stable

GLSA 200805-22

And you forgot to CC release, but in any case this bug is fixed in release
snapshot too :P