GStreamer Security Advisory 2024-0003: Orc compiler stack-based buffer overflow

[Alan Coopersmith <alan.coopersmith () oracle com>]

https://gstreamer.freedesktop.org/security/sa-2024-0003.html reports:

> Security Advisory 2024-0003 (JVN#02030803, JPCERT#92912620, CVE-2024-40897)
>
> Summary                 Orc compiler stack-based buffer overflow
> Date                    2024-07-19 12:30
> Affected Versions       orc < 0.4.39
> IDs                     GStreamer-SA-2024-0003
>                         JVN#02030803 / JPCERT#92912620
>                         CVE-2024-40897
>                         
> Details
> -------
> Stack-based buffer overflow in the Orc compiler when formatting error
> messages for certain input files.
>
> Impact
> ------
> It is possible for a malicious third party to trigger a buffer overflow and
> effect code execution with the same privileges as the orc compiler is called
> with by feeding it with malformed orc source files.
>
> This only affects developers and CI environments using orcc, not users of
> liborc.
>
> Solution
> --------
> The Orc 0.4.39 release address the issue. People using older branches of
> Orc should apply the patches and recompile.
>
> Patches: https://gitlab.freedesktop.org/gstreamer/orc/-/merge_requests/191.patch

The commit message on the fix states:

> vasprintf() is a GNU/BSD extension and would allocate as much memory as required
> on the heap, similar to g_strdup_printf(). It's ridiculous that such a function
> is still not provided as part of standard C.

Note that asprintf() and vasprintf() are part of the POSIX.1-2024 standard
which was officially published last month, so these are no longer
system-specific extensions:

https://pubs.opengroup.org/onlinepubs/9799919799/functions/asprintf.html
https://pubs.opengroup.org/onlinepubs/9799919799/functions/vasprintf.html

though they are not yet part of the C standard itself.

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris