CVE-2023-1654 (published 2023-03-27T16:15Z)

Denial of Service in GitHub repository gpac/gpac prior to 2.4.0.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-400
cwe_name: Uncontrolled Resource Consumption
description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
extended_description: 
            Limited resources include memory, file system storage, database connection pool entries, and CPU. If an attacker can trigger the allocation of these limited resources, but the number or size of the resources is not controlled, then the attacker could cause a denial of service that consumes all available resources. This would prevent valid users from accessing the product, and it could potentially have an impact on the surrounding environment. For example, a memory exhaustion attack against an application could slow down the application as well as its host operating system.
            There are at least three distinct scenarios which can commonly lead to resource exhaustion:
               
                  Lack of throttling for the number of allocated resources
                  Losing all references to a resource before reaching the shutdown stage
                  Not closing/returning a resource after processing
               
            Resource exhaustion problems are often result due to an incorrect implementation of the following situations:
               
                  Error conditions and other exceptional circumstances.
                  Confusion over which part of the program is responsible for releasing the resource.
               
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2023-03-27 11:58:57+02:00
msg: fixed #2429
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: filter_pid.c
change_type: ModificationType.MODIFY
diff: @@ -62,13 +62,17 @@ void gf_filter_pid_inst_del(GF_FilterPidInst *pidinst)
 	gf_list_del(pidinst->pck_reassembly);
 	if (pidinst->props) {
 		assert(pidinst->props->reference_count);
-		if (safe_int_dec(&pidinst->props->reference_count) == 0) {
-			//see \ref gf_filter_pid_merge_properties_internal for mutex
-			gf_mx_p(pidinst->pid->filter->tasks_mx);
-			gf_list_del_item(pidinst->pid->properties, pidinst->props);
-			gf_mx_v(pidinst->pid->filter->tasks_mx);
-			gf_props_del(pidinst->props);
+		gf_mx_p(pidinst->pid->filter->tasks_mx);
+		//not in parent pid, may happen when reattaching a pid inst to a different pid
+		//in this case do NOT delete the props
+		if (gf_list_find(pidinst->pid->properties, pidinst->props)>=0) {
+			if (safe_int_dec(&pidinst->props->reference_count) == 0) {
+				//see \ref gf_filter_pid_merge_properties_internal for mutex
+				gf_list_del_item(pidinst->pid->properties, pidinst->props);
+				gf_props_del(pidinst->props);
+			}
 		}
+		gf_mx_v(pidinst->pid->filter->tasks_mx);
 	}
 	gf_free(pidinst);
 }
@@ -1044,8 +1048,15 @@ static GF_Err gf_filter_pid_configure(GF_Filter *filter, GF_FilterPid *pid, GF_P
 						if (!target->detached_pid_inst) {
 							target->detached_pid_inst = gf_list_new();
 						}
-						//detach props but don't delete them
+						//detach props
 						if (filter->swap_pidinst_dst->props) {
+							GF_FilterPidInst *swap_pidi = filter->swap_pidinst_dst;
+							if (safe_int_dec(&swap_pidi->props->reference_count)==0) {
+								gf_mx_p(swap_pidi->pid->filter->tasks_mx);
+								gf_list_del_item(swap_pidi->pid->properties, pidinst->props);
+								gf_mx_v(swap_pidi->pid->filter->tasks_mx);
+								gf_props_del(pidinst->props);
+							}
 							filter->swap_pidinst_dst->props = NULL;
 						}
 						filter->swap_pidinst_dst->pid = NULL;
@@ -1308,7 +1319,7 @@ void gf_filter_pid_detach_task(GF_FSTask *task)
 	//first connection of this PID to this filter
 	if (!pidinst) {
 		GF_LOG(GF_LOG_ERROR, GF_LOG_FILTER, ("Trying to detach PID %s not present in filter %s inputs\n",  pid->name, filter->name));
-		//assert(!new_chain_input->swap_pidinst_dst);
+		//when swaping encoder, we may have swap_pidinst_dst not NULL so only check swap_pidinst_src
 		assert(!new_chain_input->swap_pidinst_src);
 		new_chain_input->swap_needs_init = GF_FALSE;
 		return;
@@ -5943,7 +5954,7 @@ static GF_Err gf_filter_pid_merge_properties_internal(GF_FilterPid *dst_pid, GF_
 		}
 		src_props = pidi->props;
 	}
-	//move to rela pid
+	//move to real pid
 	src_pid = src_pid->pid;
 	//this is a copy props on output pid
 	if (!src_props) {

programming_language: C