mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-01-01 13:58:06 +00:00
gst-ffmpeg: fix CVE issues
Backport patches to fix following CVE issues: * CVE-2011-4352 * CVE-2014-7933 * CVE-2014-8542 * CVE-2014-8543 * CVE-2014-8544 * CVE-2014-8545 * CVE-2014-8546 * CVE-2014-8547 * CVE-2014-9318 * CVE-2014-9603 Patch for CVE-2014-9603 in upstream is applied for version 2.x. Becuase source code changes, just partly backport part of the commit which is applicable to version 0.10.13. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
This commit is contained in:
Kang Kai
Martin Jansa
parent
fa01c2614a
commit
c7807315c1
|
|
@ -0,0 +1,64 @@
|
|||
From 8b94df0f2047e9728cb872adc9e64557b7a5152f Mon Sep 17 00:00:00 2001
|
||||
From: Reinhard Tartler <siretart@tauware.de>
|
||||
Date: Sun, 4 Dec 2011 10:10:33 +0100
|
||||
Subject: [PATCH] vp3dec: Check coefficient index in vp3_dequant()
|
||||
|
||||
Based on a patch by Michael Niedermayer <michaelni@gmx.at>
|
||||
|
||||
Fixes NGS00145, CVE-2011-4352
|
||||
|
||||
Found-by: Phillip Langlois
|
||||
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
|
||||
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
http://git.videolan.org/?p=ffmpeg.git;a=commit;h=8b94df0f2047e9728cb872adc9e64557b7a5152f
|
||||
|
||||
Signed-off-by: Kai Kang <kai.kang@windriver.com>
|
||||
---
|
||||
libavcodec/vp3.c | 14 ++++++++++++--
|
||||
1 file changed, 12 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
|
||||
index 51ab048..f44d084 100644
|
||||
--- a/gst-libs/ext/libav/libavcodec/vp3.c
|
||||
+++ b/gst-libs/ext/libav/libavcodec/vp3.c
|
||||
@@ -1363,6 +1363,10 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
|
||||
case 1: // zero run
|
||||
s->dct_tokens[plane][i]++;
|
||||
i += (token >> 2) & 0x7f;
|
||||
+ if (i > 63) {
|
||||
+ av_log(s->avctx, AV_LOG_ERROR, "Coefficient index overflow\n");
|
||||
+ return i;
|
||||
+ }
|
||||
block[perm[i]] = (token >> 9) * dequantizer[perm[i]];
|
||||
i++;
|
||||
break;
|
||||
@@ -1566,7 +1570,10 @@ static void render_slice(Vp3DecodeContext *s, int slice)
|
||||
/* invert DCT and place (or add) in final output */
|
||||
|
||||
if (s->all_fragments[i].coding_method == MODE_INTRA) {
|
||||
- vp3_dequant(s, s->all_fragments + i, plane, 0, block);
|
||||
+ int index;
|
||||
+ index = vp3_dequant(s, s->all_fragments + i, plane, 0, block);
|
||||
+ if (index > 63)
|
||||
+ continue;
|
||||
if(s->avctx->idct_algo!=FF_IDCT_VP3)
|
||||
block[0] += 128<<3;
|
||||
s->dsp.idct_put(
|
||||
@@ -1574,7 +1581,10 @@ static void render_slice(Vp3DecodeContext *s, int slice)
|
||||
stride,
|
||||
block);
|
||||
} else {
|
||||
- if (vp3_dequant(s, s->all_fragments + i, plane, 1, block)) {
|
||||
+ int index = vp3_dequant(s, s->all_fragments + i, plane, 1, block);
|
||||
+ if (index > 63)
|
||||
+ continue;
|
||||
+ if (index > 0) {
|
||||
s->dsp.idct_add(
|
||||
output_plane + first_pixel,
|
||||
stride,
|
||||
--
|
||||
2.1.1
|
||||
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
From 2266b8bc3370856d874334ba62b337ce4f1eb255 Mon Sep 17 00:00:00 2001
|
||||
From: Kai Kang <kai.kang@windriver.com>
|
||||
Date: Wed, 13 May 2015 16:46:06 +0800
|
||||
Subject: [PATCH 2/2] gst-ffmpeg: fix CVE-2014-7933
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
http://git.videolan.org/?p=ffmpeg.git;a=commit;h=33301f00
|
||||
|
||||
Signed-off-by: Kai Kang <kai.kang@windriver.com>
|
||||
---
|
||||
gst-libs/ext/libav/libavformat/matroskadec.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/gst-libs/ext/libav/libavformat/matroskadec.c b/gst-libs/ext/libav/libavformat/matroskadec.c
|
||||
index 59dce4f..e5f5fc1 100644
|
||||
--- a/gst-libs/ext/libav/libavformat/matroskadec.c
|
||||
+++ b/gst-libs/ext/libav/libavformat/matroskadec.c
|
||||
@@ -1916,7 +1916,7 @@ static int matroska_read_seek(AVFormatContext *s, int stream_index,
|
||||
int64_t timestamp, int flags)
|
||||
{
|
||||
MatroskaDemuxContext *matroska = s->priv_data;
|
||||
- MatroskaTrack *tracks = matroska->tracks.elem;
|
||||
+ MatroskaTrack *tracks = NULL;
|
||||
AVStream *st = s->streams[stream_index];
|
||||
int i, index, index_sub, index_min;
|
||||
|
||||
@@ -1939,6 +1939,7 @@ static int matroska_read_seek(AVFormatContext *s, int stream_index,
|
||||
return 0;
|
||||
|
||||
index_min = index;
|
||||
+ tracks = matroska->tracks.elem;
|
||||
for (i=0; i < matroska->tracks.nb_elem; i++) {
|
||||
tracks[i].audio.pkt_cnt = 0;
|
||||
tracks[i].audio.sub_packet_cnt = 0;
|
||||
--
|
||||
1.9.1
|
||||
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
From 105654e376a736d243aef4a1d121abebce912e6b Mon Sep 17 00:00:00 2001
|
||||
From: Michael Niedermayer <michaelni@gmx.at>
|
||||
Date: Fri, 3 Oct 2014 04:30:58 +0200
|
||||
Subject: [PATCH] avcodec/utils: Add case for jv to
|
||||
avcodec_align_dimensions2()
|
||||
|
||||
(Upstream commit 105654e376a736d243aef4a1d121abebce912e6b)
|
||||
|
||||
Fixes out of array accesses
|
||||
Fixes: asan_heap-oob_12304aa_8_asan_heap-oob_4da4f3_300_intro.jv
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
|
||||
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
|
||||
Signed-off-by: Yue Tao <yue.tao@windriver.com>
|
||||
---
|
||||
libavcodec/utils.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/libavcodec/utils.c b/libavcodec/utils.c
|
||||
index d4f5532..c2c5579 100644
|
||||
--- a/gst-libs/ext/libav/libavcodec/utils.c
|
||||
+++ b/gst-libs/ext/libav/libavcodec/utils.c
|
||||
@@ -173,6 +173,10 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height, int l
|
||||
w_align=4;
|
||||
h_align=4;
|
||||
}
|
||||
+ if (s->codec_id == CODEC_ID_JV){
|
||||
+ w_align = 8;
|
||||
+ h_align = 8;
|
||||
+ }
|
||||
break;
|
||||
case PIX_FMT_BGR24:
|
||||
if((s->codec_id == CODEC_ID_MSZH) || (s->codec_id == CODEC_ID_ZLIB)){
|
||||
--
|
||||
1.7.9.5
|
||||
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
From 8b0e96e1f21b761ca15dbb470cd619a1ebf86c3e Mon Sep 17 00:00:00 2001
|
||||
From: Michael Niedermayer <michaelni@gmx.at>
|
||||
Date: Fri, 3 Oct 2014 14:45:04 +0200
|
||||
Subject: [PATCH] avcodec/mmvideo: Bounds check 2nd line of HHV Intra blocks
|
||||
|
||||
(Upstream commit 8b0e96e1f21b761ca15dbb470cd619a1ebf86c3e)
|
||||
|
||||
Fixes out of array access
|
||||
Fixes: asan_heap-oob_4da4f3_8_asan_heap-oob_4da4f3_419_scene1a.mm
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
|
||||
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
|
||||
Signed-off-by: Yue Tao <yue.tao@windriver.com>
|
||||
---
|
||||
libavcodec/mmvideo.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libavcodec/mmvideo.c b/libavcodec/mmvideo.c
|
||||
index 026d463..9ff6393 100644
|
||||
--- a/gst-libs/ext/libav/libavcodec/mmvideo.c
|
||||
+++ b/gst-libs/ext/libav/libavcodec/mmvideo.c
|
||||
@@ -104,7 +104,7 @@ static void mm_decode_intra(MmContext * s, int half_horiz, int half_vert, const
|
||||
|
||||
if (color) {
|
||||
memset(s->frame.data[0] + y*s->frame.linesize[0] + x, color, run_length);
|
||||
- if (half_vert)
|
||||
+ if (half_vert && y + half_vert < s->avctx->height)
|
||||
memset(s->frame.data[0] + (y+1)*s->frame.linesize[0] + x, color, run_length);
|
||||
}
|
||||
x+= run_length;
|
||||
--
|
||||
1.7.9.5
|
||||
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
From e1c0cfaa419aa5d320540d5a1b3f8fd9b82ab7e5 Mon Sep 17 00:00:00 2001
|
||||
From: Michael Niedermayer <michaelni@gmx.at>
|
||||
Date: Fri, 3 Oct 2014 16:08:32 +0200
|
||||
Subject: [PATCH] avcodec/tiff: more completely check bpp/bppcount
|
||||
|
||||
(Upstream commit e1c0cfaa419aa5d320540d5a1b3f8fd9b82ab7e5)
|
||||
|
||||
Fixes pixel format selection
|
||||
Fixes out of array accesses
|
||||
Fixes: asan_heap-oob_1766029_6_asan_heap-oob_20aa045_332_cov_1823216757_m2-d1d366d7965db766c19a66c7a2ccbb6b.tif
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
|
||||
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
|
||||
Signed-off-by: Yue Tao <yue.tao@windriver.com>
|
||||
---
|
||||
libavcodec/tiff.c | 13 ++++++++++---
|
||||
1 file changed, 10 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c
|
||||
index 6e2096f..0870e31 100644
|
||||
--- a/gst-libs/ext/libav/libavcodec/tiff.c
|
||||
+++ b/gst-libs/ext/libav/libavcodec/tiff.c
|
||||
@@ -324,11 +324,11 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
|
||||
s->height = value;
|
||||
break;
|
||||
case TIFF_BPP:
|
||||
- s->bppcount = count;
|
||||
- if(count > 4){
|
||||
- av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count);
|
||||
+ if(count > 4U){
|
||||
+ av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", value, count);
|
||||
return -1;
|
||||
}
|
||||
+ s->bppcount = count;
|
||||
if(count == 1) s->bpp = value;
|
||||
else{
|
||||
switch(type){
|
||||
@@ -344,6 +344,13 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t *
|
||||
s->bpp = -1;
|
||||
}
|
||||
}
|
||||
+ if (s->bpp > 64U) {
|
||||
+ av_log(s->avctx, AV_LOG_ERROR,
|
||||
+ "This format is not supported (bpp=%d, %d components)\n",
|
||||
+ s->bpp, count);
|
||||
+ s->bpp = 0;
|
||||
+ return AVERROR_INVALIDDATA;
|
||||
+ }
|
||||
break;
|
||||
case TIFF_SAMPLES_PER_PIXEL:
|
||||
if (count != 1) {
|
||||
--
|
||||
1.7.9.5
|
||||
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
From 3e2b745020c2dbf0201fe7df3dad9e7e0b2e1bb6 Mon Sep 17 00:00:00 2001
|
||||
From: Michael Niedermayer <michaelni@gmx.at>
|
||||
Date: Fri, 3 Oct 2014 17:35:58 +0200
|
||||
Subject: [PATCH] avcodec/pngdec: Check bits per pixel before setting
|
||||
monoblack pixel format
|
||||
|
||||
(Upstream commit 3e2b745020c2dbf0201fe7df3dad9e7e0b2e1bb6)
|
||||
|
||||
Fixes out of array accesses
|
||||
Fixes: asan_heap-oob_14dbfcf_4_asan_heap-oob_1ce5767_179_add_method_small.png
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
|
||||
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
|
||||
Signed-off-by: Yue Tao <yue.tao@windriver.com>
|
||||
---
|
||||
libavcodec/pngdec.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
|
||||
index da91aab..f3603b3 100644
|
||||
--- a/gst-libs/ext/libav/libavcodec/pngdec.c
|
||||
+++ b/gst-libs/ext/libav/libavcodec/pngdec.c
|
||||
@@ -481,7 +481,7 @@ static int decode_frame(AVCodecContext *avctx,
|
||||
} else if (s->bit_depth == 16 &&
|
||||
s->color_type == PNG_COLOR_TYPE_RGB) {
|
||||
avctx->pix_fmt = PIX_FMT_RGB48BE;
|
||||
- } else if (s->bit_depth == 1 &&
|
||||
+ } else if (s->bit_depth == 1 && s->bits_per_pixel == 1 &&
|
||||
s->color_type == PNG_COLOR_TYPE_GRAY) {
|
||||
avctx->pix_fmt = PIX_FMT_MONOBLACK;
|
||||
} else if (s->color_type == PNG_COLOR_TYPE_PALETTE) {
|
||||
--
|
||||
1.7.9.5
|
||||
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
From e7e5114c506957f40aafd794e06de1a7e341e9d5 Mon Sep 17 00:00:00 2001
|
||||
From: Michael Niedermayer <michaelni@gmx.at>
|
||||
Date: Fri, 3 Oct 2014 19:33:01 +0200
|
||||
Subject: [PATCH] avcodec/cinepak: fix integer underflow
|
||||
|
||||
(Upstream commit e7e5114c506957f40aafd794e06de1a7e341e9d5)
|
||||
|
||||
Fixes out of array access
|
||||
Fixes: asan_heap-oob_4da0ba_6_asan_heap-oob_4da0ba_241_cvid_crash.avi
|
||||
|
||||
Upstream-status: Backport
|
||||
|
||||
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
|
||||
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
|
||||
Signed-off-by: Yue Tao <yue.tao@windriver.com>
|
||||
---
|
||||
libavcodec/cinepak.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libavcodec/cinepak.c b/libavcodec/cinepak.c
|
||||
index 4746289..f651c48 100644
|
||||
--- a/gst-libs/ext/libav/libavcodec/cinepak.c
|
||||
+++ b/gst-libs/ext/libav/libavcodec/cinepak.c
|
||||
@@ -125,7 +125,7 @@ static int cinepak_decode_vectors (CinepakContext *s, cvid_strip *strip,
|
||||
const uint8_t *eod = (data + size);
|
||||
uint32_t flag, mask;
|
||||
cvid_codebook *codebook;
|
||||
- unsigned int x, y;
|
||||
+ int x, y;
|
||||
uint32_t iy[4];
|
||||
uint32_t iu[2];
|
||||
uint32_t iv[2];
|
||||
--
|
||||
1.7.9.5
|
||||
|
||||
|
|
@ -0,0 +1,59 @@
|
|||
From 8f1457864be8fb9653643519dea1c6492f1dde57 Mon Sep 17 00:00:00 2001
|
||||
From: Michael Niedermayer <michaelni@gmx.at>
|
||||
Date: Fri, 3 Oct 2014 20:15:52 +0200
|
||||
Subject: [PATCH] avcodec/gifdec: factorize interleave end handling out
|
||||
|
||||
(Upstream commit 8f1457864be8fb9653643519dea1c6492f1dde57)
|
||||
|
||||
also change it to a loop
|
||||
Fixes out of array access
|
||||
Fixes: asan_heap-oob_ca5410_8_asan_heap-oob_ca5410_97_ID_LSD_Size_Less_Then_Data_Inter_3.gif
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
|
||||
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
|
||||
Signed-off-by: Yue Tao <yue.tao@windriver.com>
|
||||
---
|
||||
libavcodec/gifdec.c | 15 +++++----------
|
||||
1 file changed, 5 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/libavcodec/gifdec.c b/libavcodec/gifdec.c
|
||||
index dee48f5..90de38b 100644
|
||||
--- a/gst-libs/ext/libav/libavcodec/gifdec.c
|
||||
+++ b/gst-libs/ext/libav/libavcodec/gifdec.c
|
||||
@@ -271,26 +271,21 @@ static int gif_read_image(GifState *s, AVFrame *frame)
|
||||
case 1:
|
||||
y1 += 8;
|
||||
ptr += linesize * 8;
|
||||
- if (y1 >= height) {
|
||||
- y1 = pass ? 2 : 4;
|
||||
- ptr = ptr1 + linesize * y1;
|
||||
- pass++;
|
||||
- }
|
||||
break;
|
||||
case 2:
|
||||
y1 += 4;
|
||||
ptr += linesize * 4;
|
||||
- if (y1 >= height) {
|
||||
- y1 = 1;
|
||||
- ptr = ptr1 + linesize;
|
||||
- pass++;
|
||||
- }
|
||||
break;
|
||||
case 3:
|
||||
y1 += 2;
|
||||
ptr += linesize * 2;
|
||||
break;
|
||||
}
|
||||
+ while (y1 >= height) {
|
||||
+ y1 = 4 >> pass;
|
||||
+ ptr = ptr1 + linesize * y1;
|
||||
+ pass++;
|
||||
+ }
|
||||
} else {
|
||||
ptr += linesize;
|
||||
}
|
||||
--
|
||||
1.7.9.5
|
||||
|
||||
|
|
@ -0,0 +1,37 @@
|
|||
From 0d3a3b9f8907625b361420d48fe05716859620ff Mon Sep 17 00:00:00 2001
|
||||
From: Michael Niedermayer <michaelni@gmx.at>
|
||||
Date: Wed, 26 Nov 2014 18:56:39 +0100
|
||||
Subject: [PATCH] avcodec/rawdec: Check the return code of
|
||||
avpicture_get_size()
|
||||
|
||||
(Upstream commit 1d3a3b9f8907625b361420d48fe05716859620ff)
|
||||
|
||||
Fixes out of array access
|
||||
Fixes: asan_heap-oob_22388d0_3435_cov_3297128910_small_roll5_FlashCine1.cine
|
||||
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
|
||||
Signed-off-by: Yue Tao <yue.tao@windriver.com>
|
||||
---
|
||||
libavcodec/rawdec.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c
|
||||
index 28792a1..647dfa9 100644
|
||||
--- a/gst-libs/ext/libav/libavcodec/rawdec.c
|
||||
+++ b/gst-libs/ext/libav/libavcodec/rawdec.c
|
||||
@@ -87,6 +87,9 @@ static av_cold int raw_init_decoder(AVCodecContext *avctx)
|
||||
|
||||
ff_set_systematic_pal2(context->palette, avctx->pix_fmt);
|
||||
context->length = avpicture_get_size(avctx->pix_fmt, avctx->width, avctx->height);
|
||||
+ if (context->length < 0)
|
||||
+ return context->length;
|
||||
+
|
||||
if((avctx->bits_per_coded_sample == 4 || avctx->bits_per_coded_sample == 2) &&
|
||||
avctx->pix_fmt==PIX_FMT_PAL8 &&
|
||||
(!avctx->codec_tag || avctx->codec_tag == MKTAG('r','a','w',' '))){
|
||||
--
|
||||
1.7.9.5
|
||||
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
From dc68faf8339a885bc55fabe5b01f1de4f8f3782c Mon Sep 17 00:00:00 2001
|
||||
From: Kai Kang <kai.kang@windriver.com>
|
||||
Date: Wed, 13 May 2015 16:30:53 +0800
|
||||
Subject: [PATCH 1/2] gst-ffmpeg: fix CVE-2014-9603
|
||||
|
||||
Upstream-Status: Backport
|
||||
|
||||
Upstream is version 2.x and vmdav.c is splitted into 2 files vmdaudio.c
|
||||
and vmdvideo.c. Becuase source code changes, just partly backport commit which
|
||||
is applicable to version 0.10.13 to fix CVE-2014-9603.
|
||||
|
||||
http://git.videolan.org/?p=ffmpeg.git;a=commit;h=3030fb7e0d41836f8add6399e9a7c7b740b48bfd
|
||||
|
||||
Signed-off-by: Kai Kang <kai.kang@windriver.com>
|
||||
---
|
||||
gst-libs/ext/libav/libavcodec/vmdav.c | 7 +++++--
|
||||
1 file changed, 5 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/gst-libs/ext/libav/libavcodec/vmdav.c b/gst-libs/ext/libav/libavcodec/vmdav.c
|
||||
index d258252..ba88ad8 100644
|
||||
--- a/gst-libs/ext/libav/libavcodec/vmdav.c
|
||||
+++ b/gst-libs/ext/libav/libavcodec/vmdav.c
|
||||
@@ -294,10 +294,13 @@ static void vmd_decode(VmdVideoContext *s)
|
||||
len = *pb++;
|
||||
if (len & 0x80) {
|
||||
len = (len & 0x7F) + 1;
|
||||
- if (*pb++ == 0xFF)
|
||||
+ if (*pb++ == 0xFF) {
|
||||
len = rle_unpack(pb, &dp[ofs], len, frame_width - ofs);
|
||||
- else
|
||||
+ } else {
|
||||
+ if (ofs + len > frame_width)
|
||||
+ return;
|
||||
memcpy(&dp[ofs], pb, len);
|
||||
+ }
|
||||
pb += len;
|
||||
ofs += len;
|
||||
} else {
|
||||
--
|
||||
1.9.1
|
||||
|
||||
|
|
@ -57,6 +57,16 @@ SRC_URI = "http://gstreamer.freedesktop.org/src/${BPN}/${BPN}-${PV}.tar.bz2 \
|
|||
file://0001-avcodec-smc-fix-off-by-1-error.patch \
|
||||
file://0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch \
|
||||
file://libav-9.patch \
|
||||
file://gst-ffmpeg-fix-CVE-2011-4352.patch \
|
||||
file://gst-ffmpeg-fix-CVE-2014-7933.patch \
|
||||
file://gst-ffmpeg-fix-CVE-2014-8542.patch \
|
||||
file://gst-ffmpeg-fix-CVE-2014-8543.patch \
|
||||
file://gst-ffmpeg-fix-CVE-2014-8544.patch \
|
||||
file://gst-ffmpeg-fix-CVE-2014-8545.patch \
|
||||
file://gst-ffmpeg-fix-CVE-2014-8546.patch \
|
||||
file://gst-ffmpeg-fix-CVE-2014-8547.patch \
|
||||
file://gst-ffmpeg-fix-CVE-2014-9318.patch \
|
||||
file://gst-ffmpeg-fix-CVE-2014-9603.patch \
|
||||
"
|
||||
|
||||
SRC_URI[md5sum] = "7f5beacaf1312db2db30a026b36888c4"
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user