Out-of-bounds read in tag parsing
The attached file causes an out-of-bounds read when played with gstreamer. This bug probably doesn't have serious security consequences, but filing it as a confidential issue just in case. A stack trace is below.
==3263091==ERROR: AddressSanitizer: SEGV on unknown address 0x629000080000 (pc 0x7f51cfd1918c bp 0x7f51c6e338cc sp 0x7f51c6e33860 T6)
==3263091==The signal is caused by a READ memory access.
#0 0x7f51cfd1918c in id3v2_ununsync_data /usr/local/google/home/natashenka/gst-build/build/../subprojects/gst-plugins-base/gst-libs/gst/tag/id3v2.c:161:11
#1 0x7f51cfd1b177 in id3v2_parse_frame /usr/local/google/home/natashenka/gst-build/build/../subprojects/gst-plugins-base/gst-libs/gst/tag/id3v2frames.c:137:17
#2 0x7f51cfd19b16 in id3v2_frames_to_tag_list /usr/local/google/home/natashenka/gst-build/build/../subprojects/gst-plugins-base/gst-libs/gst/tag/id3v2.c:598:11
#3 0x7f51cfd19b16 in gst_tag_list_from_id3v2_tag /usr/local/google/home/natashenka/gst-build/build/../subprojects/gst-plugins-base/gst-libs/gst/tag/id3v2.c:261:3
#4 0x7f51c8a2a65a in gst_id3demux_parse_tag /usr/local/google/home/natashenka/gst-build/build/../subprojects/gst-plugins-good/gst/id3demux/gstid3demux.c:181:13
#5 0x7f51cfd13354 in gst_tag_demux_pull_start_tag /usr/local/google/home/natashenka/gst-build/build/../subprojects/gst-plugins-base/gst-libs/gst/tag/gsttagdemux.c:1266:17
#6 0x7f51cfd13354 in gst_tag_demux_element_find /usr/local/google/home/natashenka/gst-build/build/../subprojects/gst-plugins-base/gst-libs/gst/tag/gsttagdemux.c:1328:9
#7 0x7f51cfd14464 in gst_tag_demux_element_loop /usr/local/google/home/natashenka/gst-build/build/../subprojects/gst-plugins-base/gst-libs/gst/tag/gsttagdemux.c:1452:13
#8 0x7f51cfc5edfe in gst_task_func /usr/local/google/home/natashenka/gst-build/build/../subprojects/gstreamer/gst/gsttask.c:384:5
#9 0x7f51cd19b973 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x7b973)
#10 0x7f51cd19b08c (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x7b08c)
#11 0x7f51cd07fea6 in start_thread nptl/pthread_create.c:477:8
#12 0x7f51ccdbbdee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /usr/local/google/home/natashenka/gst-build/build/../subprojects/gst-plugins-base/gst-libs/gst/tag/id3v2.c:161:11 in id3v2_ununsync_data
Thread T6 (id3demux0:sink) created by T4 (typefind:sink) here:
#0 0x4c0e0a in pthread_create (/usr/local/google/home/natashenka/Downloads/video/video+0x4c0e0a)
#1 0x7f51cd1c2fc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xa2fc0)
Thread T4 (typefind:sink) created by T0 here:
#0 0x4c0e0a in pthread_create (/usr/local/google/home/natashenka/Downloads/video/video+0x4c0e0a)
#1 0x7f51cd1c2fc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xa2fc0)