!Regression! xine-lib based applications refuse to load some shoutcast streams.

Bug #50734 reported by Sandis Neilands
2
Affects Status Importance Assigned to Milestone
xine-lib (Ubuntu)
Fix Released
Undecided
burnseysr

Bug Description

Hello!

After upgrading from libxine-main1_1.1.1+ubuntu2-7 to libxine-main1_1.1.1+ubuntu2-7.1 (dapper drake) i've noticed that some of the shoutcast streams aren't working any more. This is regression - they were working with 1.1.1+ubuntu2-7 version. I'm using i386 version of kubuntu 6.06.

To reproduce
0. Check if you have libxine-extracodecs installed, if not, install it.
1. Open amarok.
2. Click on "Playlists" tab -> Radio Streams -> Cool Streams.
3. Double click on radio paradise -> double click on any of the 1048's.

I've picked radio paradise as an example, but if you'll try each and every stream, you'll notice, that some of the others doesn't work too.

Expected result
The stream loads and music start playing.

Actual result
Error message appears at the bottom of the player. It says "Access was denied for the URL: http://64.236.34.4:80/stream/1048
xine parameters: http://64.236.34.4:80/stream/1048".

When I tried to open the same playlist with kaffeine-xine, two messages appeared.

1st (xine message) - "Permission to this source was denied. (http://64.236.34.4:80/stream/1048)".

2nd (xine error) - "No plugin found to handle this resource (http://64.236.34.196:80/stream/1048)". In the details section - "
xine: cannot find input plugin for MRL [http://64.236.34.196:80/stream/1048]
xine: input plugin cannot open MRL [http://64.236.34.196:80/stream/1048]
input_http: buffer exhausted after 104 bytes.
xine: found input plugin : http input plugin
xine: cannot find input plugin for MRL [http://64.236.34.97:80/stream/1048]
xine: input plugin cannot open MRL [http://64.236.34.97:80/stream/1048]
input_http: http status not 2xx: >404 Resource Not Found<
xine: found input plugin : http input plugin
xine: cannot find input plugin for MRL [http://64.236.34.67:80/stream/1048]
xine: input plugin cannot open MRL [http://64.236.34.67:80/stream/1048]
input_http: buffer exhausted after 103 bytes.
xine: found input plugin : http input plugin
xine: cannot find input plugin for MRL [http://64.236.34.4:80/stream/1048]
xine: input plugin cannot open MRL [http://64.236.34.4:80/stream/1048]
input_http: buffer exhausted after 102 bytes.
xine: found input plugin : http input plugin
"

I've looked into xine-lib_1.1.1+ubuntu2-7.1,diff and I suspect that the bug is in the following lines.
"
--- xine-lib-1.1.1+ubuntu2.orig/src/input/input_http.c
+++ xine-lib-1.1.1+ubuntu2/src/input/input_http.c
@@ -895,6 +895,12 @@
  len = 0;
     } else
       len ++;
+ if ( len >= buflen ) {
+ _x_message(this->stream, XINE_MSG_PERMISSION_ERROR, this->mrl, NULL);
+ xine_log (this->stream->xine, XINE_LOG_MSG,
+ _("input_http: buffer exhausted after %d bytes."), buflen);
+ return 0;
+ }
   }

   lprintf ("end of headers\n");
"
Help?

CVE References

Revision history for this message
Adam Woodworth (mirkwood07) wrote :

What is the status of this bug? Why is this low urgency?

I am experiencing the exact same problem on Dapper Drake with the Radio Paradise stream (haven't tried others). Club 977 works fine.

Radio Paradise streams work fine in XMMS.

Revision history for this message
Andres Mejia (amejia1) wrote :

I also had the same problem. I recompiled xine from source and I no longer had this problem.

Revision history for this message
Lukáš Zapletal (lzap) wrote :

Which library to recompile? Could you please paste the compile commands here? Thanks

Revision history for this message
Reinhard Tartler (siretart) wrote :

I'm preparing the new upstream version of xine, this bug is likely to be fixed with it.

until then, look at my bzr branches to build the packages

Revision history for this message
Lukáš Zapletal (lzap) wrote :

Will the version be in Dapper Drake?

Revision history for this message
Andres Mejia (amejia1) wrote :

./configure --prefix=/usr --x-libraries=/usr/lib
make
sudo make install

Revision history for this message
Jérémie Corbier (jcorbier) wrote :

xine-lib (1.1.1+ubuntu2-7.2) dapper-security; urgency=low

  * SECURITY UPDATE: Arbitrary code execution with crafted streams.
  * src/input/mms[h].c: Fix multiple buffer overflows in embedded libmms,
    thanks to patch from Matthias Hopf.
  * src/input/input_http.c: Fixed previous security patch (s/buflen/BUFSIZE).

Changed in xine-lib:
status: Unconfirmed → Fix Released
burnseysr (burnseysr)
Changed in xine-lib:
assignee: nobody → burnseysr
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.