Bugzilla Bug 122029

AFI Security Research has discovered two vulnerabilities in mplayer, which can
be exploited by malicious people to cause a DoS (Denial of Service) and
potentially compromise a user's system.

 Integer overflow errors exist in the "new_demux_packet()" function in
"libmpdemux/demuxer.h" and the "demux_asf_read_packet()" function in
"libmpdemux/demux_asf.c" when allocating memory to copy data from an ".asf"
file. This can be exploited to cause heap-based buffer overflows via a
specially crafted ".asf" file with an overly large value in the packet length
field. 

 The vulnerabilities have been confirmed in version 1.0pre7try2. Other versions
may also be affected.

Solution:
Do not open untrusted ".asf" files.

Waiting for upstream patch...

Please avoid saying ".asf", it sounds like you mean the extension, but what
matters here is that it is ASF file format - nobody cares about the extension.
And maybe this:
http://www1.mplayerhq.hu/cgi-bin/cvsweb.cgi/main/libmpdemux/demuxer.h.diff?r1=1.87&r2=1.88
already fixes it.

Should be bundled with bug 115760

This would be the current version of that patch:
http://www1.mplayerhq.hu/cgi-bin/cvsweb.cgi/main/libmpdemux/demuxer.h.diff?r1=1.87&r2=1.90&f=u
Just to make clear: I did _not_ check demux_asf.c for (further) problems.

*

Stable handling on bug 115760

Common GLSA with bug 115760

GLSA 200603-03

(Spam administratively removed, by robbat2@gentoo.org, at Tue Jan 15 00:37:28
UTC 2008)

(Spam administratively removed, by robbat2@gentoo.org, at Tue Jan 15 00:37:28
UTC 2008)