Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 24 Nov 2008 16:23:17 +0100
From: Matthias Hopf <>
Subject: Re: xine-lib and ocert-2008-008

On Nov 22, 08 17:49:40 +0100, Thomas Viehmann wrote:
> I am not quite sure whether I can agree with Will Drewry's analysis[1]
> accompanying ocert advisory 2008-008[1]. Looking at item 1A, which Will
> says is fixed in 1.1.5, attached .mov seems to fit the case description
> and will still corrupt the memory when viewed e.g. in gxine. xine-lib
> with the attached patch seems to be more successful in preventing the
> attach (note that the file is more tuned to be small than to be a valid
> .mov, but the same works by including the bad meta in an otherwise good
> file). Note that xine_xmalloc is specifically designed to allocate
> memory when passed size 0. Upstream seems to move away from it, but...
> As Will notices, demux-qt.c has loads of unfixed problems.
> If anyone cares to go over the xine-lib issues (primarily the unfixed
> ones from Will's section 3), I'd much appreciate a CC. In order to make
> the analysis and verification more, I would also be interested in the
> test cases mentioned in the advisory.

I have fixed all of them (at least I believe so, but I have to verify
your test case), and we're waiting for new ocert numbers. Given that
this takes so long, and the issues are public anyway, I will probably
upstream the fixes soon. If you would verify them it would be awesome.


Matthias Hopf <>      __        __   __
Maxfeldstr. 5 / 90409 Nuernberg   (_   | |  (_   |__
Phone +49-911-74053-715           __)  |_|  __)  |__  R & D

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.