CR: ASM security vulnerability in rarender.dll

Reported by an outside group, this bug can be triggered by playing back 
content with invalid ASM rule numbers in the packets.

Per Rishi Matthew's comments on Steve Blanding's fix for a different ASM 
rulebook exploit, will checkin to HEAD, 347_atlas, 348_atlas, 349_atlas, 
210_cays, 150_cay.

Please let me know if this looks OK for checkin.
Thanks,
Tad Yeager

Index: rarender.cpp
===================================================================
RCS file: /cvsroot/datatype/rm/audio/renderer/rarender.cpp,v
retrieving revision 1.48.2.11.30.1
diff -u -2 -0 -r1.48.2.11.30.1 rarender.cpp
--- rarender.cpp	19 Oct 2007 03:02:47 -0000	1.48.2.11.30.1
+++ rarender.cpp	17 Sep 2009 19:30:55 -0000
@@ -3550,50 +3550,54 @@
     if(pPacket->IsLost())
     {
 	if (m_bStreamSwitchable)
 	{
 	    for (int i = 0; i < m_uNumOfSubStreams; i++)
 	    {
 		m_pRaFormats[i]->LossOccured();
 	    }
 	}
 	else
 	{
 	    m_pRaFormats[uStreamForThisPacket]->OnPacket(pPacket, lTimeOffset,
 		m_pRuleToFlagMap->rule_to_flag_map);
 	}
 
 	DEBUG_OUT(m_pErrorMessages, DOL_REALAUDIO_EXTENDED, (s, "p\tLost\t?\t?"));
 	DEBUG_OUTF(ONPACKET_FILE, (s, "p\tLost\t?\t?\n"));
     }
     else
     {
+        /* Packets can have invalid ASM Rule numbers, a security vulnerability */
+        UINT16 uASMRuleNumber = pPacket->GetASMRuleNumber();
+        HXBOOL bValidASMRuleNumber = (uASMRuleNumber < m_uNumOfRules);
+
 	DEBUG_OUT(m_pErrorMessages, DOL_REALAUDIO_EXTENDED, (s, "p\t%u\t%lu\t%u",
-	    (m_bStreamSwitchable)?(m_pRuleMap[pPacket->GetASMRuleNumber()]):(0), pPacket->GetTime(),
+	    (m_bStreamSwitchable && bValidASMRuleNumber)?(m_pRuleMap[pPacket->GetASMRuleNumber()]):(0), pPacket->GetTime(),
 	    pPacket->GetASMRuleNumber()));
 	DEBUG_OUTF(ONPACKET_FILE, (s, "p\t%u\t%lu\t%u\t%u\n",
-	    (m_bStreamSwitchable)?(m_pRuleMap[pPacket->GetASMRuleNumber()]):(0), pPacket->GetTime(),
+	    (m_bStreamSwitchable && bValidASMRuleNumber)?(m_pRuleMap[pPacket->GetASMRuleNumber()]):(0), pPacket->GetTime(),
 	    pPacket->GetASMRuleNumber(), pPacket->GetASMFlags()));
 
 	UINT32 ulCurrentPacketTime = pPacket->GetTime();
 
-	if (m_bStreamSwitchable)
+	if (m_bStreamSwitchable && bValidASMRuleNumber)
 	{
 	    uStreamForThisPacket = m_pRuleMap[pPacket->GetASMRuleNumber()];
 	}
 
 	/*
 	 * if this packet is late, we don't want to add it to the format so we don't
 	 * think we are switching to a stream with packets that are late.
 	 * late packets could happen if the "time out" for the last packets
 	 * of the from stream happened and we considered the rest of them
 	 * lost.  If that is why this packet is late, nothing we can do but
 	 * throw it away.  If a packet is late for some other reason
 	 * it's either bad content or something else messed up with the
 	 * stream and we could be harsh and stop the stream but I'd rather
 	 * think we should drop the packet and continue.
 	 */
 	if (NO_TIME_SET == m_pRaFormats[uStreamForThisPacket]->m_ulLastPacketTime ||
 	    IsTimeGreaterOrEqual(ulCurrentPacketTime, m_pRaFormats[uStreamForThisPacket]->m_ulLastPacketTime))
 	{
 	    if (!m_bDelayOffsetSet)
 	    {

_______________________________________________
Helix-client-dev mailing list
[email protected]
http://lists.helixcommunity.org/mailman/listinfo/helix-client-dev