diff options
author | Yue Tao <Yue.Tao@windriver.com> | 2014-04-27 15:10:15 +0800 |
---|---|---|
committer | Saul Wold <sgw@linux.intel.com> | 2014-05-21 08:23:10 -0700 |
commit | cc6e2ee53c49206aa3377c512c3bd1de2e14a7b7 (patch) | |
tree | eb15e4056a36e7a4aa1c0e73c126ea1580602442 /meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13 | |
parent | 29dcc2c8e834cf43e415eedefb8fce9667b3aa40 (diff) | |
download | openembedded-core-cc6e2ee53c49206aa3377c512c3bd1de2e14a7b7.tar.gz openembedded-core-cc6e2ee53c49206aa3377c512c3bd1de2e14a7b7.tar.bz2 openembedded-core-cc6e2ee53c49206aa3377c512c3bd1de2e14a7b7.zip |
gst-ffmpeg: fix for Security Advisory CVE-2013-0845
libavcodec/alsdec.c in FFmpeg before 1.0.4 allows remote attackers to
have an unspecified impact via a crafted block length, which triggers an
out-of-bounds write.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0845
Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Diffstat (limited to 'meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13')
-rw-r--r-- | meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch | 61 |
1 files changed, 61 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch new file mode 100644 index 0000000000..73980f4265 --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch @@ -0,0 +1,61 @@ +From 6df0d3e2916c223dbe4262bf1b876dff1cb3f980 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer <michaelni@gmx.at> +Date: Wed, 12 Dec 2012 12:28:45 +0100 +Subject: [PATCH] alsdec: check block length + +Upstream-Status: Backport + +Commit 6df0d3e2916c223dbe4262bf1b876dff1cb3f980 release/1.0 + +Fix writing over the end + +Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind +Signed-off-by: Michael Niedermayer <michaelni@gmx.at> +(cherry picked from commit 0ceca269b66ec12a23bf0907bd2c220513cdbf16) + +Signed-off-by: Michael Niedermayer <michaelni@gmx.at> +--- + libavcodec/alsdec.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c +index 46dd0b4..1095b01 100644 +--- a/gst-libs/ext/libav/libavcodec/alsdec.c ++++ b/gst-libs/ext/libav/libavcodec/alsdec.c +@@ -552,12 +552,15 @@ static void get_block_sizes(ALSDecContext *ctx, unsigned int *div_blocks, + + /** Read the block data for a constant block + */ +-static void read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd) ++static int read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd) + { + ALSSpecificConfig *sconf = &ctx->sconf; + AVCodecContext *avctx = ctx->avctx; + GetBitContext *gb = &ctx->gb; + ++ if (bd->block_length <= 0) ++ return -1; ++ + *bd->raw_samples = 0; + *bd->const_block = get_bits1(gb); // 1 = constant value, 0 = zero block (silence) + bd->js_blocks = get_bits1(gb); +@@ -572,6 +575,8 @@ static void read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd) + + // ensure constant block decoding by reusing this field + *bd->const_block = 1; ++ ++ return 0; + } + + +@@ -971,7 +976,8 @@ static int read_block(ALSDecContext *ctx, ALSBlockData *bd) + if (read_var_block_data(ctx, bd)) + return -1; + } else { +- read_const_block_data(ctx, bd); ++ if (read_const_block_data(ctx, bd) < 0) ++ return -1; + } + + return 0; +-- |