=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

xine security announcement
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

Announcement-ID: XSA-2004-5

Summary:
A heap overflow has been found in the DVD subpicture decoder of xine-lib. T=
his=20
can be used for a remote heap overflow exploit, which can, on some systems,=
=20
lead to or help in executing malicious code with the permissions of the use=
r=20
running a xine-lib based media application.

Description:
When a xine-lib based media application is playing content including DVD=20
subpictures, the subtitle decoder converts the DVD subpictures, which are=20
essentially run-length encoded bitmaps, into xine-lib's own internal=20
subpicture format. The result of this conversion is written to a dynamicall=
y=20
allocated memory block on the heap. This memory block can overrun with=20
certain subpictures:
DVD subpictures are stored in two fields. The first containing the odd=20
numbered lines, the second containing the even numbered lines. Offsets in t=
he=20
subpicture header indicate the beginning of each field in the RLE data. Whe=
n=20
these two fields are now stored in an overlapping manor, so that the=20
beginning of the second field reuses RLE data from the end of the first, th=
e=20
resulting xine overlay will use up more space than previously allocated,=20
because the allocation did not take this possibility into account.
Since DVD subpictures do not only occur on DVDs, but may also be used in=20
standalone MPEG files, an attacker can craft a malicious MPEG file containi=
ng=20
such a subpicture with overlapping fields. This can be used to overflow the=
=20
heap buffer, which can, with certain implementations of heap management, le=
ad=20
to attacker chosen data written to the stack. By placing such a MPEG file o=
n=20
the internet and tricking users to view it using network streaming, this is=
=20
remotely exploitable.

Severity:
This is very difficult to exploit, because multiple indirections are involv=
ed:=20
=46irstly, the DVD subpicture data is expanded to xine-lib's internal=20
subpicture format before it is written to the heap. Secondly, the heap=20
overlow needs to alter heap management information in a way so that a retur=
n=20
adress on the stack is modified. Thirdly, this adress must lead to some=20
malicious code to be executed, which needs to be injected somehow.
Although the involved xine plugin is part of the standard xine installation,
we consider this problem to be only moderately severe, because of the=20
difficulty in exploiting it.

Affected versions:
All 0.5 releases starting with and including 0.5.2.
All 0.9 releases.
All 1-alpha releases.
All 1-beta releases.
All 1-rc releases up to and including 1-rc5.

Unaffected versions:
All releases older than 0.5.2.
1-rc6 or newer.

Solution:
The enclosed patch which has been applied to xine-lib CVS fixes the problem
but should only be used by distributors who do not want to upgrade.
Otherwise, we strongly advise everyone to upgrade to the 1-rc6 release of
xine-lib.
As a temporary workaround, you may delete the file "xineplug_decode_spu.so"=
=20
from the xine-lib plugin directory, losing the ability to decode DVD=20
subpictures with xine-lib.

Patch:
http://cvs.sourceforge.net/viewcvs.p...udec/spu.c?r1=
=3D1.77&r2=3D1.78&diff_format=3Du

=46or further information and in case of questions, please contact the xine
team. Our website is http://xinehq.de/
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQFBPLy1jhx3hMVnyYsRAngbAJ0Vy0F9wde/qafkBiB58xI4hb+tfwCgi7Fn
5qKEG8iA7EG/f2Cm03YMtzU=3D
=3Dwto9
=2D----END PGP SIGNATURE-----