diff options
3 files changed, 102 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-smc-fix-off-by-1-error.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-smc-fix-off-by-1-error.patch new file mode 100644 index 0000000000..3ca6fc4dc5 --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-smc-fix-off-by-1-error.patch @@ -0,0 +1,32 @@ +From c17a0ad1df15a94d0b1239adc2afb593bdf0a153 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer <michaelni@gmx.at> +Date: Fri, 3 Oct 2014 22:50:45 +0200 +Subject: [PATCH 1/2] avcodec/smc: fix off by 1 error + +Upstream-Status: Backport + +Fixes out of array access +Fixes: asan_heap-oob_1685bf0_5_asan_heap-oob_1f35116_430_smc.mov + +Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind +Signed-off-by: Michael Niedermayer <michaelni@gmx.at> +--- + libavcodec/smc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gst-libs/ext/libav/libavcodec/smc.c b/gst-libs/ext/libav/libavcodec/smc.c +index 3cd5e53..dec9f71 100644 +--- a/gst-libs/ext/libav/libavcodec/smc.c ++++ b/gst-libs/ext/libav/libavcodec/smc.c +@@ -69,7 +69,7 @@ typedef struct SmcContext { + row_ptr += stride * 4; \ + } \ + total_blocks--; \ +- if (total_blocks < 0) \ ++ if (total_blocks < 0 + !!n_blocks) \ + { \ + av_log(s->avctx, AV_LOG_INFO, "warning: block counter just went negative (this should not happen)\n"); \ + return; \ +-- +2.1.0 + diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch new file mode 100644 index 0000000000..c8bafd570e --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch @@ -0,0 +1,68 @@ +From 6043c431c97d55173f339fafbd033d3c0642e2e9 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer <michaelni@gmx.at> +Date: Fri, 3 Oct 2014 01:50:27 +0200 +Subject: [PATCH 2/2] avcodec/mjpegdec: check bits per pixel for changes + similar to dimensions + +Upstream-Status: Backport + +Fixes out of array accesses +Fixes: asan_heap-oob_16668e9_2_asan_heap-oob_16668e9_346_miss_congeniality_pegasus_mjpg.avi + +Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind +Signed-off-by: Michael Niedermayer <michaelni@gmx.at> + +Conflicts: + libavcodec/mjpegdec.c +--- + libavcodec/mjpegdec.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/gst-libs/ext/libav/libavcodec/mjpegdec.c b/gst-libs/ext/libav/libavcodec/mjpegdec.c +index 84343c0..c0137d8 100644 +--- a/gst-libs/ext/libav/libavcodec/mjpegdec.c ++++ b/gst-libs/ext/libav/libavcodec/mjpegdec.c +@@ -210,16 +210,16 @@ int ff_mjpeg_decode_dht(MJpegDecodeContext *s) + + int ff_mjpeg_decode_sof(MJpegDecodeContext *s) + { +- int len, nb_components, i, width, height, pix_fmt_id; ++ int len, nb_components, i, bits, width, height, pix_fmt_id; + + /* XXX: verify len field validity */ + len = get_bits(&s->gb, 16); +- s->bits= get_bits(&s->gb, 8); ++ bits= get_bits(&s->gb, 8); + +- if(s->pegasus_rct) s->bits=9; +- if(s->bits==9 && !s->pegasus_rct) s->rct=1; //FIXME ugly ++ if(s->pegasus_rct) bits=9; ++ if(bits==9 && !s->pegasus_rct) s->rct=1; //FIXME ugly + +- if (s->bits != 8 && !s->lossless){ ++ if (bits != 8 && !s->lossless){ + av_log(s->avctx, AV_LOG_ERROR, "only 8 bits/component accepted\n"); + return -1; + } +@@ -239,7 +239,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) + if (nb_components <= 0 || + nb_components > MAX_COMPONENTS) + return -1; +- if (s->ls && !(s->bits <= 8 || nb_components == 1)){ ++ if (s->ls && !(bits <= 8 || nb_components == 1)){ + av_log(s->avctx, AV_LOG_ERROR, "only <= 8 bits/component or 16-bit gray accepted for JPEG-LS\n"); + return -1; + } +@@ -272,10 +272,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) + + /* if different size, realloc/alloc picture */ + /* XXX: also check h_count and v_count */ +- if (width != s->width || height != s->height) { ++ if (width != s->width || height != s->height || bits != s->bits) { + av_freep(&s->qscale_table); + + s->width = width; ++ s->bits= bits; + s->height = height; + s->interlaced = 0; + diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb b/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb index 395054de5d..30e5deb1f9 100644 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb +++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb @@ -55,6 +55,8 @@ SRC_URI = "http://gstreamer.freedesktop.org/src/${BPN}/${BPN}-${PV}.tar.bz2 \ file://0001-ffserver-set-oformat.patch \ file://0001-h264-set-parameters-from-SPS-whenever-it-changes.patch \ file://0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch \ + file://0001-avcodec-smc-fix-off-by-1-error.patch \ + file://0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch \ ${@bb.utils.contains('PACKAGECONFIG', 'libav9', 'file://libav-9.patch', '', d)} \ " |