GStreamer Out-of-Bounds Read Vulnerability in WAV Parser

A vulnerability allowing an out-of-bounds read has been identified in the GStreamer WAV parser, specifically in the 'gst_wavparse_adtl_chunk()' function. This issue arises from an incomplete fix for a previous vulnerability (CVE-2024-47778). The applied patch introduced a size validation check, but failed to consider the 'GST_ROUND_UP_2(lsize)' used in the offset calculation. As a result, when 'lsize' is an odd number, the parser reads more bytes than validated, leading to an out-of-bounds read. This vulnerability affects GStreamer versions prior to 1.28.1.

Impact

Exploitation of this vulnerability can cause application crashes when processing certain WAV files, due to the out-of-bounds read.

Remediation

Users can upgrade to GStreamer version 1.28.1 or later to address this vulnerability. Instructions for applying the patch and recompiling are available in the GStreamer 1.28.1 release notes.