Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[wvdecrypter] Fix memory heap corruption #1346

Merged
merged 2 commits into from
Aug 2, 2023

Conversation

CastagnaIT
Copy link
Collaborator

@CastagnaIT CastagnaIT commented Jul 31, 2023

Description

After PR #1310 when you play a Widevine encrypted content on a debug build kodi crash with a memory heap corruption
immagine

the reason seem to be on changed code that looks bad and unsafe,
the code take the mem pointer from data_out and store to packet_out, this to manually copy data by using memcpy seem to avoid use the bento4 object method AppendData

the size of buffer internally of the data_out object is assumed to be big enough to contains written data, but if not so?
weird thing can happens also because at the end is called data_out.SetDataSize to update the wrong object data size,
from what i understand SetDataSize not only update the container data size but can also reallocate the object buffer,
if this happens the reallocation copy the buffer data but based on initial data size and not on what we have written with memcpy, that could exceed the size...

I do not know if I have explained myself correctly anyway dont crash anymore

maybe in the past has been done so to try limit SetDataSize uses in the
while (packet_in < packet_in_e) loop, at least with h264 i get at max 4 loops only not big things

a test confermation would be appreciated

How has this been tested?

played n€tflix on windows, debug build
played n€tflix on android, but release build

Screenshots (if appropriate):

Types of change

  • Bug fix (non-breaking change which fixes an issue)
  • Clean up (non-breaking change which removes non-working, unmaintained functionality)
  • Improvement (non-breaking change which improves existing functionality)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that will cause existing functionality to change)
  • Cosmetic change (non-breaking change that doesn't touch code)
  • None of the above (please explain below)

Checklist:

  • I have read the Contributing document
  • My code follows the Code Guidelines of this project
  • My change requires a change to the Wiki documentation
  • I have updated the documentation accordingly

@CastagnaIT CastagnaIT added Type: Fix non-breaking change which fixes an issue Backport: Needed v21 Omega labels Jul 31, 2023
@CastagnaIT CastagnaIT requested a review from glennguy July 31, 2023 16:37
@glennguy
Copy link
Contributor

glennguy commented Aug 1, 2023

Hi
I don't have an opportunity tonight to test it... but I think it needs to be tested on Windows with a non-secure path sample stream e.g the bitmoving parkour one - if you get a chance before I do:

#KODIPROP:inputstreamaddon=inputstream.adaptive
#KODIPROP:inputstream=inputstream.adaptive
#KODIPROP:inputstream.adaptive.manifest_type=mpd
#KODIPROP:inputstream.adaptive.license_type=com.widevine.alpha
#KODIPROP:inputstream.adaptive.license_key=https://cwip-shaka-proxy.appspot.com/no_auth|Content-Type=|R{SSM}|
https://bitmovin-a.akamaihd.net/content/art-of-motion_drm/mpds/11331.mpd

I was testing on this in the WIP PR and had crashing..,. maybe I messed up though and it's running secure path when it doesn't need to?

@CastagnaIT
Copy link
Collaborator Author

thanks just tested, played without crashes
https://paste.kodi.tv/ofomicepan.kodi
but i would like a confermation on a system different of mine

@glennguy
Copy link
Contributor

glennguy commented Aug 2, 2023

My bad here - I have secure path currently hardcoded in my branch. Playback fine here with the changes, thanks heaps for finding this so quickly!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Backport: Done Type: Fix non-breaking change which fixes an issue v21 Omega
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants