Hi,

The following vulnerabilities were published for oggvideotools.

CVE-2020-21722[0]:
| Buffer Overflow vulnerability in oggvideotools 0.9.1 allows remote
| attackers to run arbitrary code via opening of crafted ogg file.

https://sourceforge.net/p/oggvideotools/bugs/11/

CVE-2020-21723[1]:
| A Segmentation Fault issue discovered
| StreamSerializer::extractStreams function in streamSerializer.cpp in
| oggvideotools 0.9.1 allows remote attackers to cause a denial of
| service (crash) via opening of crafted ogg file.

https://sourceforge.net/p/oggvideotools/bugs/10

CVE-2020-21724[2]:
| Buffer Overflow vulnerability in ExtractorInformation function in
| streamExtractor.cpp in oggvideotools 0.9.1 allows remaote attackers
| to run arbitrary code via opening of crafted ogg file.

https://sourceforge.net/p/oggvideotools/bugs/9

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-21722
https://www.cve.org/CVERecord?id=CVE-2020-21722
[1] https://security-tracker.debian.org/tracker/CVE-2020-21723
https://www.cve.org/CVERecord?id=CVE-2020-21723
[2] https://security-tracker.debian.org/tracker/CVE-2020-21724
https://www.cve.org/CVERecord?id=CVE-2020-21724

Please adjust the affected versions in the BTS as needed.

[Moritz Mühlenhoff]

I believe the following patch fixes this issue:

--- oggvideotools-0.9.1.orig/src/main/streamSerializer.cpp
+++ oggvideotools-0.9.1/src/main/streamSerializer.cpp
@@ -158,6 +158,14 @@ bool StreamSerializer::extractStreams()

         OggPacket         oggPacket;
         StreamEntry&      entry         = streamList[serialID];
+
+	/* Reject Ogg files where serialID to not point to valid
+	   stream (CVE-2020-21723,
+	   <URL: https://sourceforge.net/p/oggvideotools/bugs/10/ >). */
+	if (! entry.streamDecoder) {
+            break;
+	}
+
         OggStreamDecoder& streamDecoder = *(entry.streamDecoder);

         streamDecoder << oggPage;

It is already commited to the Debian salsa git repository.

[Moritz Mühlenhoff]
crash point in getStreamConfig().  Unfortunately there is no way to
return an error from getStreamConfig(), so I believe the error should
be detected in StreamSerializer::open(), possibly in extractStreams(),
but I was unable to figure out how to properly do this in the time I
had available to look at the issue.

Index: oggvideotools-salsa/src/main/streamSerializer.cpp
===================================================================
--- oggvideotools-salsa.orig/src/main/streamSerializer.cpp      2024-09-08 07:50:48.030275614 +0200
+++ oggvideotools-salsa/src/main/streamSerializer.cpp   2024-09-08 08:29:04.726304778 +0200
@@ -19,6 +19,7 @@
  *
  */

+#include <assert.h>
 #include <iostream>

 #include "streamSerializer.h"
@@ -215,6 +220,10 @@

   for (; it != streamList.end(); ++it) {
     StreamEntry& entry = it->second;
+    printf("No %d size %d\n",
+          entry.streamConfig.streamNo,
+          streamList.size());
+    assert(entry.streamConfig.streamNo < streamList.size());
     packetList[entry.streamConfig.streamNo] = entry.streamConfig;
   }


Note, the output for the problematic oggLength_SEGV_heap-overflow file
fetched from the upstream issue is "No 1 size 1".  As far as I
understand it, the stream number should have been 0.