From fe44ac167a2a76531af3519f3889fce92024567b Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Mon, 18 May 2015 16:58:40 +0300 Subject: gstreamer: remove 0.10 recipes gstreamer 0.10 is still available from meta-openembedded/meta-multimedia See also https://bugzilla.yoctoproject.org/show_bug.cgi?id=6294 http://lists.openembedded.org/pipermail/openembedded-core/2015-April/104276.html Signed-off-by: Alexander Kanavin Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie --- .../0001-aacdec-check-channel-count.patch | 34 - .../0001-alac-fix-nb_samples-order-case.patch | 30 - .../0001-alsdec-check-block-length.patch | 61 - ...ac3dec-Check-coding-mode-against-channels.patch | 37 - ...util-fix-signedness-in-sizeof-comparissio.patch | 40 - ...le-use-av_image_get_linesize-to-calculate.patch | 50 - ...c-parser-reset-indexes-on-realloc-failure.patch | 50 - ...a-Perform-pointer-advance-and-checks-befo.patch | 81 - .../0001-avcodec-smc-fix-off-by-1-error.patch | 32 - ...egtsenc-Check-data-array-size-in-mpegts_w.patch | 69 - .../0001-eamad-fix-out-of-array-accesses.patch | 29 - ...-error-concealment-initialize-block-index.patch | 29 - ...alment-Check-that-the-picture-is-not-in-a.patch | 37 - .../0001-ffserver-set-oformat.patch | 36 - ...t-ref-count-check-and-limit-fix-out-of-ar.patch | 29 - ...t-parameters-from-SPS-whenever-it-changes.patch | 145 - ...rror-concealment-when-SPS-and-slices-are-.patch | 33 - .../0001-h264_sei-Fix-infinite-loop.patch | 39 - ...01-huffyuvdec-Check-init_vlc-return-codes.patch | 87 - .../0001-huffyuvdec-Skip-len-0-cases.patch | 61 - ...f-compute-probe-buffer-size-more-reliably.patch | 45 - .../0001-mjpegdec-check-SE.patch | 32 - ...heck-RLE-size-before-copying.-Fix-out-of-.patch | 34 - ...er-dont-access-out-of-array-elements-at-t.patch | 44 - ...array-index-before-use-fix-out-of-array-a.patch | 30 - .../0001-qdm2dec-fix-buffer-overflow.patch | 58 - ...001-roqvideodec-check-dimensions-validity.patch | 36 - ...Check-that-the-last-indexes-are-within-th.patch | 32 - ...-vp3-Copy-all-3-frames-for-thread-updates.patch | 32 - ...-read-for-negative-tokens-and-memleaks-on.patch | 183 - ...o-check-chunk-sizes-before-reading-chunks.patch | 51 - ...egdec-check-bits-per-pixel-for-changes-si.patch | 68 - .../gst-ffmpeg-0.10.13/configure-fix.patch | 22 - .../gst-ffmpeg-CVE-2013-0855.patch | 100 - .../gst-ffmpeg-CVE-2013-3674.patch | 26 - .../gst-ffmpeg-0.10.13/h264_qpel_mmx.patch | 57 - .../gstreamer/gst-ffmpeg-0.10.13/libav-9.patch | 9304 -------------------- .../gst-ffmpeg-0.10.13/libav_e500mc.patch | 21 - .../gstreamer/gst-ffmpeg-0.10.13/libav_e5500.patch | 19 - .../gstreamer/gst-ffmpeg-0.10.13/lower-rank.diff | 16 - .../gstreamer/gst-ffmpeg_0.10.13.bb | 90 - .../gstreamer/gst-fluendo-mp3_0.10.31.bb | 14 - .../gstreamer/gst-fluendo-mpegdemux_0.10.85.bb | 12 - meta/recipes-multimedia/gstreamer/gst-fluendo.inc | 14 - .../gstreamer/gst-meta-base_0.10.bb | 73 - .../gstreamer/gst-openmax/gcc_4.6.patch | 18 - .../gstreamer/gst-openmax/ptr-array.patch | 46 - .../gstreamer/gst-openmax_0.10.1.bb | 35 - .../gstreamer/gst-plugins-bad_0.10.23.bb | 50 - ...le-Fix-build-on-x86-if-emmintrin.h-is-ava.patch | 37 - .../configure.ac-fix-subparse-plugin.patch | 27 - .../gst-plugins-base-tremor.patch | 20 - .../gstreamer/gst-plugins-base_0.10.36.bb | 39 - ...-conditional-gl-framebuffer-undefined-use.patch | 35 - .../gstreamer/gst-plugins-gl_0.10.3.bb | 28 - ...ild-with-recent-kernels-the-v4l2_buffer-i.patch | 33 - ...define-V4L2_CID_HCENTER-and-V4L2_CID_VCEN.patch | 45 - .../0407-mulawdec-fix-integer-overrun.patch | 47 - .../gstreamer/gst-plugins-good_0.10.31.bb | 47 - .../gstreamer/gst-plugins-ugly_0.10.19.bb | 29 - meta/recipes-multimedia/gstreamer/gst-plugins.inc | 28 - ...ix-self-comparison-always-evaluates-to-tr.patch | 32 - .../gstreamer/gstreamer-0.10.36/check_fix.patch | 19 - .../gst-inspect-check-error.patch | 16 - ...mer-change-priv_gst_parse_yylex-arguments.patch | 33 - .../gstreamer-0.10.36/gstregistrybinary.c | 487 - .../gstreamer-0.10.36/gstregistrybinary.h | 194 - .../gstreamer/gstreamer_0.10.36.bb | 51 - 68 files changed, 12818 deletions(-) delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-aacdec-check-channel-count.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alac-fix-nb_samples-order-case.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-atrac3dec-Check-coding-mode-against-channels.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-dsputil-fix-signedness-in-sizeof-comparissio.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-msrle-use-av_image_get_linesize-to-calculate.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-parser-reset-indexes-on-realloc-failure.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-rpza-Perform-pointer-advance-and-checks-befo.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-smc-fix-off-by-1-error.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avformat-mpegtsenc-Check-data-array-size-in-mpegts_w.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-eamad-fix-out-of-array-accesses.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error-concealment-initialize-block-index.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error_concealment-Check-that-the-picture-is-not-in-a.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-ffserver-set-oformat.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-correct-ref-count-check-and-limit-fix-out-of-ar.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-set-parameters-from-SPS-whenever-it-changes.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264_sei-Fix-infinite-loop.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Check-init_vlc-return-codes.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Skip-len-0-cases.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-lavf-compute-probe-buffer-size-more-reliably.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-mjpegdec-check-SE.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pgssubdec-check-RLE-size-before-copying.-Fix-out-of-.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pngdec-filter-dont-access-out-of-array-elements-at-t.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2-check-array-index-before-use-fix-out-of-array-a.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2dec-fix-buffer-overflow.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-roqvideodec-check-dimensions-validity.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-smackerdec-Check-that-the-last-indexes-are-within-th.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-vp3-Copy-all-3-frames-for-thread-updates.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-vp3-fix-oob-read-for-negative-tokens-and-memleaks-on.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-vqavideo-check-chunk-sizes-before-reading-chunks.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/configure-fix.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-CVE-2013-0855.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-CVE-2013-3674.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/h264_qpel_mmx.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/libav-9.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/libav_e500mc.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/libav_e5500.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/lower-rank.diff delete mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb delete mode 100644 meta/recipes-multimedia/gstreamer/gst-fluendo-mp3_0.10.31.bb delete mode 100644 meta/recipes-multimedia/gstreamer/gst-fluendo-mpegdemux_0.10.85.bb delete mode 100644 meta/recipes-multimedia/gstreamer/gst-fluendo.inc delete mode 100644 meta/recipes-multimedia/gstreamer/gst-meta-base_0.10.bb delete mode 100644 meta/recipes-multimedia/gstreamer/gst-openmax/gcc_4.6.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-openmax/ptr-array.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-openmax_0.10.1.bb delete mode 100644 meta/recipes-multimedia/gstreamer/gst-plugins-bad_0.10.23.bb delete mode 100644 meta/recipes-multimedia/gstreamer/gst-plugins-base-0.10.36/audioresample-Fix-build-on-x86-if-emmintrin.h-is-ava.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-plugins-base-0.10.36/configure.ac-fix-subparse-plugin.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-plugins-base-0.10.36/gst-plugins-base-tremor.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-plugins-base_0.10.36.bb delete mode 100644 meta/recipes-multimedia/gstreamer/gst-plugins-gl/0001-conditional-gl-framebuffer-undefined-use.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-plugins-gl_0.10.3.bb delete mode 100644 meta/recipes-multimedia/gstreamer/gst-plugins-good-0.10.31/0001-v4l2-fix-build-with-recent-kernels-the-v4l2_buffer-i.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-plugins-good-0.10.31/0001-v4l2_calls-define-V4L2_CID_HCENTER-and-V4L2_CID_VCEN.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-plugins-good-0.10.31/0407-mulawdec-fix-integer-overrun.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gst-plugins-good_0.10.31.bb delete mode 100644 meta/recipes-multimedia/gstreamer/gst-plugins-ugly_0.10.19.bb delete mode 100644 meta/recipes-multimedia/gstreamer/gst-plugins.inc delete mode 100644 meta/recipes-multimedia/gstreamer/gstreamer-0.10.36/0001-baseparse-Fix-self-comparison-always-evaluates-to-tr.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gstreamer-0.10.36/check_fix.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gstreamer-0.10.36/gst-inspect-check-error.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gstreamer-0.10.36/gstreamer-change-priv_gst_parse_yylex-arguments.patch delete mode 100644 meta/recipes-multimedia/gstreamer/gstreamer-0.10.36/gstregistrybinary.c delete mode 100644 meta/recipes-multimedia/gstreamer/gstreamer-0.10.36/gstregistrybinary.h delete mode 100644 meta/recipes-multimedia/gstreamer/gstreamer_0.10.36.bb (limited to 'meta') diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-aacdec-check-channel-count.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-aacdec-check-channel-count.patch deleted file mode 100644 index 7da0e14525..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-aacdec-check-channel-count.patch +++ /dev/null @@ -1,34 +0,0 @@ -gst-ffmpeg: aacdec: check channel count - -Prevent out of array accesses - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer -(cherry picked from commit 96f452ac647dae33c53c242ef3266b65a9beafb6) - -Upstream-Status: Backport - -Signed-off-by: Yue Tao ---- - libavcodec/aacdec.c | 5 +++++ - 1 files changed, 5 insertions(+), 0 deletions(-) - -diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c -index 239153a..6c17c33 100644 ---- a/gst-libs/ext/libav/libavcodec/aacdec.c -+++ b/gst-libs/ext/libav/libavcodec/aacdec.c -@@ -914,6 +914,11 @@ static av_cold int aac_decode_init(AVCodecContext *avctx) - } - } - -+ if (avctx->channels > MAX_CHANNELS) { -+ av_log(avctx, AV_LOG_ERROR, "Too many channels\n"); -+ return AVERROR_INVALIDDATA; -+ } -+ - AAC_INIT_VLC_STATIC( 0, 304); - AAC_INIT_VLC_STATIC( 1, 270); - AAC_INIT_VLC_STATIC( 2, 550); --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alac-fix-nb_samples-order-case.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alac-fix-nb_samples-order-case.patch deleted file mode 100644 index 10ce0f332c..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alac-fix-nb_samples-order-case.patch +++ /dev/null @@ -1,30 +0,0 @@ -From e0884eadf6a15e93142131b695f48776f9a0ac31 Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer -Date: Sat, 10 Nov 2012 17:14:04 +0100 -Subject: [PATCH] alac: fix nb_samples < order case - -Upstream-Status: Backport - -Commit e0884eadf6a15e93142131b695f48776f9a0ac31 release/1.0 - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer -(cherry picked from commit fd4f4923cce6a2cbf4f48640b4ac706e614a1594) ---- - libavcodec/alac.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/libavcodec/alac.c b/libavcodec/alac.c -index 9cd1737..e8e844a 100644 ---- a/gst-libs/ext/libav/libavcodec/alac.c -+++ b/gst-libs/ext/libav/libavcodec/alac.c -@@ -278,7 +278,7 @@ static void predictor_decompress_fir_ada - - /* read warm-up samples */ - if (predictor_coef_num > 0) -- for (i = 0; i < predictor_coef_num; i++) { -+ for (i = 0; i < predictor_coef_num && i < output_size; i++) { - int32_t val; - - val = buffer_out[i] + error_buffer[i+1]; --- diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch deleted file mode 100644 index 73980f4265..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 6df0d3e2916c223dbe4262bf1b876dff1cb3f980 Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer -Date: Wed, 12 Dec 2012 12:28:45 +0100 -Subject: [PATCH] alsdec: check block length - -Upstream-Status: Backport - -Commit 6df0d3e2916c223dbe4262bf1b876dff1cb3f980 release/1.0 - -Fix writing over the end - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer -(cherry picked from commit 0ceca269b66ec12a23bf0907bd2c220513cdbf16) - -Signed-off-by: Michael Niedermayer ---- - libavcodec/alsdec.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c -index 46dd0b4..1095b01 100644 ---- a/gst-libs/ext/libav/libavcodec/alsdec.c -+++ b/gst-libs/ext/libav/libavcodec/alsdec.c -@@ -552,12 +552,15 @@ static void get_block_sizes(ALSDecContext *ctx, unsigned int *div_blocks, - - /** Read the block data for a constant block - */ --static void read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd) -+static int read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd) - { - ALSSpecificConfig *sconf = &ctx->sconf; - AVCodecContext *avctx = ctx->avctx; - GetBitContext *gb = &ctx->gb; - -+ if (bd->block_length <= 0) -+ return -1; -+ - *bd->raw_samples = 0; - *bd->const_block = get_bits1(gb); // 1 = constant value, 0 = zero block (silence) - bd->js_blocks = get_bits1(gb); -@@ -572,6 +575,8 @@ static void read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd) - - // ensure constant block decoding by reusing this field - *bd->const_block = 1; -+ -+ return 0; - } - - -@@ -971,7 +976,8 @@ static int read_block(ALSDecContext *ctx, ALSBlockData *bd) - if (read_var_block_data(ctx, bd)) - return -1; - } else { -- read_const_block_data(ctx, bd); -+ if (read_const_block_data(ctx, bd) < 0) -+ return -1; - } - - return 0; --- diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-atrac3dec-Check-coding-mode-against-channels.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-atrac3dec-Check-coding-mode-against-channels.patch deleted file mode 100644 index 42cb5f40b4..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-atrac3dec-Check-coding-mode-against-channels.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 2502914c5f8eb77659d7c0868396862557a63245 Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer -Date: Fri, 9 Nov 2012 13:26:20 +0100 -Subject: [PATCH] atrac3dec: Check coding mode against channels. - -Upstream-Status: Backport - -Commit 2502914c5f8eb77659d7c0868396862557a63245 release/1.0 - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer -(cherry picked from commit 13451f5520ce6b0afde861b2285dda659f8d4fb4) - -Conflicts: - - libavcodec/atrac3.c ---- - libavcodec/atrac3.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/libavcodec/atrac3.c b/libavcodec/atrac3.c -index 7d076be..1da4c78 100644 ---- a/gst-libs/ext/libav/libavcodec/atrac3.c -+++ b/gst-libs/ext/libav/libavcodec/atrac3.c -@@ -955,6 +955,11 @@ static av_cold int atrac3_decode_init(AVCodecContext *avctx) - } - /* Check the extradata. */ - -+ if (q->codingMode == JOINT_STEREO && avctx->channels < 2) { -+ av_log(avctx, AV_LOG_ERROR, "Invalid coding mode\n"); -+ return AVERROR_INVALIDDATA; -+ } -+ - if (q->atrac3version != 4) { - av_log(avctx,AV_LOG_ERROR,"Version %d != 4.\n",q->atrac3version); - return AVERROR_INVALIDDATA; --- diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-dsputil-fix-signedness-in-sizeof-comparissio.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-dsputil-fix-signedness-in-sizeof-comparissio.patch deleted file mode 100644 index 31fa51a3ea..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-dsputil-fix-signedness-in-sizeof-comparissio.patch +++ /dev/null @@ -1,40 +0,0 @@ -From a99aff4e4bbef8e64b51f267cd1769214e1b4e80 Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer -Date: Fri, 30 Aug 2013 23:40:47 +0200 -Subject: [PATCH] avcodec/dsputil: fix signedness in sizeof() comparissions - -Signed-off-by: Michael Niedermayer -(cherry picked from commit 454a11a1c9c686c78aa97954306fb63453299760) - -Upstream-Status: Backport - -Signed-off-by: Michael Niedermayer ---- - libavcodec/dsputil.c | 4 ++-- - 1 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/libavcodec/dsputil.c b/libavcodec/dsputil.c -index 53dc2eb..6264832 100644 ---- a/gst-libs/ext/libav/libavcodec/dsputil.c -+++ b/gst-libs/ext/libav/libavcodec/dsputil.c -@@ -1912,7 +1912,7 @@ void ff_set_cmp(DSPContext* c, me_cmp_func *cmp, int type){ - - static void add_bytes_c(uint8_t *dst, uint8_t *src, int w){ - long i; -- for(i=0; i<=w-sizeof(long); i+=sizeof(long)){ -+ for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){ - long a = *(long*)(src+i); - long b = *(long*)(dst+i); - *(long*)(dst+i) = ((a&pb_7f) + (b&pb_7f)) ^ ((a^b)&pb_80); -@@ -1937,7 +1937,7 @@ static void diff_bytes_c(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w){ - } - }else - #endif -- for(i=0; i<=w-sizeof(long); i+=sizeof(long)){ -+ for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){ - long a = *(long*)(src1+i); - long b = *(long*)(src2+i); - *(long*)(dst+i) = ((a|pb_80) - (b&pb_7f)) ^ ((a^b^pb_80)&pb_80); --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-msrle-use-av_image_get_linesize-to-calculate.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-msrle-use-av_image_get_linesize-to-calculate.patch deleted file mode 100644 index b0a3fb10c7..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-msrle-use-av_image_get_linesize-to-calculate.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 573d5fdedae72bf59d8c0b0766fdee171063d36f Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer -Date: Sun, 16 Feb 2014 23:08:52 +0100 -Subject: [PATCH] avcodec/msrle: use av_image_get_linesize() to calculate the - linesize - -Upstream-Status: Backport - -Commit 573d5fdedae72bf59d8c0b0766fdee171063d36f release/0.9 - -Fixes out of array access -Fixes: 14a74a0a2dc67ede543f0e35d834fbbe-asan_heap-oob_49572c_556_cov_215466444_44_001_engine_room.mov -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer -(cherry picked from commit c919e1ca2ecfc47d796382973ba0e48b8f6f92a2) - -Conflicts: - - libavcodec/msrle.c -(cherry picked from commit bc1c8ec5e65098fd2ccd8456f667151dfc9cda42) - -Signed-off-by: Michael Niedermayer ---- - libavcodec/msrle.c | 3 ++- - 1 files changed, 2 insertions(+), 1 deletions(-) - -diff --git a/libavcodec/msrle.c b/libavcodec/msrle.c -index 30159bb..c39ae7b 100644 ---- a/gst-libs/ext/libav/libavcodec/msrle.c -+++ b/gst-libs/ext/libav/libavcodec/msrle.c -@@ -35,6 +35,7 @@ - #include "avcodec.h" - #include "dsputil.h" - #include "msrledec.h" -+#include "libavutil/imgutils.h" - - typedef struct MsrleContext { - AVCodecContext *avctx; -@@ -107,7 +108,7 @@ static int msrle_decode_frame(AVCodecContext *avctx, - - /* FIXME how to correctly detect RLE ??? */ - if (avctx->height * istride == avpkt->size) { /* assume uncompressed */ -- int linesize = avctx->width * avctx->bits_per_coded_sample / 8; -+ int linesize = av_image_get_linesize(avctx->pix_fmt, avctx->width, 0); - uint8_t *ptr = s->frame.data[0]; - uint8_t *buf = avpkt->data + (avctx->height-1)*istride; - int i, j; --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-parser-reset-indexes-on-realloc-failure.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-parser-reset-indexes-on-realloc-failure.patch deleted file mode 100644 index 5ff65834e4..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-parser-reset-indexes-on-realloc-failure.patch +++ /dev/null @@ -1,50 +0,0 @@ -gst-ffmpeg: avcodec/parser: reset indexes on realloc failure - -Fixes Ticket2982 - -Signed-off-by: Michael Niedermayer -(cherry picked from commit f31011e9abfb2ae75bb32bc44e2c34194c8dc40a) - -Signed-off-by: Michael Niedermayer - -Upstream-Status: Backport - -Signed-off-by: Yue Tao - ---- - libavcodec/parser.c | 10 +++++++--- - 1 files changed, 7 insertions(+), 3 deletions(-) - -diff --git a/libavcodec/parser.c b/libavcodec/parser.c -index 2c6de6e..66eca06 100644 ---- a/gst-libs/ext/libav/libavcodec/parser.c -+++ b/gst-libs/ext/libav/libavcodec/parser.c -@@ -241,8 +241,10 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s - if(next == END_NOT_FOUND){ - void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, (*buf_size) + pc->index + FF_INPUT_BUFFER_PADDING_SIZE); - -- if(!new_buffer) -+ if(!new_buffer) { -+ pc->index = 0; - return AVERROR(ENOMEM); -+ } - pc->buffer = new_buffer; - memcpy(&pc->buffer[pc->index], *buf, *buf_size); - pc->index += *buf_size; -@@ -255,9 +257,11 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s - /* append to buffer */ - if(pc->index){ - void* new_buffer = av_fast_realloc(pc->buffer, &pc->buffer_size, next + pc->index + FF_INPUT_BUFFER_PADDING_SIZE); -- -- if(!new_buffer) -+ if(!new_buffer) { -+ pc->overread_index = -+ pc->index = 0; - return AVERROR(ENOMEM); -+ } - pc->buffer = new_buffer; - if (next > -FF_INPUT_BUFFER_PADDING_SIZE) - memcpy(&pc->buffer[pc->index], *buf, --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-rpza-Perform-pointer-advance-and-checks-befo.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-rpza-Perform-pointer-advance-and-checks-befo.patch deleted file mode 100644 index 7f6eb48889..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-rpza-Perform-pointer-advance-and-checks-befo.patch +++ /dev/null @@ -1,81 +0,0 @@ -gst-ffmpeg: avcodec/rpza: Perform pointer advance and checks before - using the pointers - -Fixes out of array accesses -Fixes Ticket2850 - -Signed-off-by: Michael Niedermayer -(cherry picked from commit 3819db745da2ac7fb3faacb116788c32f4753f34) - -Signed-off-by: Michael Niedermayer - -Upstream-Status: Backport - -Singed-off-by: Yue Tao - ---- - libavcodec/rpza.c | 8 ++++---- - 1 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/libavcodec/rpza.c b/libavcodec/rpza.c -index 635b406..f291a95 100644 ---- a/gst-libs/ext/libav/libavcodec/rpza.c -+++ b/gst-libs/ext/libav/libavcodec/rpza.c -@@ -83,7 +83,7 @@ static void rpza_decode_stream(RpzaContext *s) - unsigned short *pixels = (unsigned short *)s->frame.data[0]; - - int row_ptr = 0; -- int pixel_ptr = 0; -+ int pixel_ptr = -4; - int block_ptr; - int pixel_x, pixel_y; - int total_blocks; -@@ -139,6 +139,7 @@ static void rpza_decode_stream(RpzaContext *s) - colorA = AV_RB16 (&s->buf[stream_ptr]); - stream_ptr += 2; - while (n_blocks--) { -+ ADVANCE_BLOCK() - block_ptr = row_ptr + pixel_ptr; - for (pixel_y = 0; pixel_y < 4; pixel_y++) { - for (pixel_x = 0; pixel_x < 4; pixel_x++){ -@@ -147,7 +148,6 @@ static void rpza_decode_stream(RpzaContext *s) - } - block_ptr += row_inc; - } -- ADVANCE_BLOCK(); - } - break; - -@@ -184,6 +184,7 @@ static void rpza_decode_stream(RpzaContext *s) - color4[2] |= ((21 * ta + 11 * tb) >> 5); - - while (n_blocks--) { -+ ADVANCE_BLOCK(); - block_ptr = row_ptr + pixel_ptr; - for (pixel_y = 0; pixel_y < 4; pixel_y++) { - index = s->buf[stream_ptr++]; -@@ -194,12 +195,12 @@ static void rpza_decode_stream(RpzaContext *s) - } - block_ptr += row_inc; - } -- ADVANCE_BLOCK(); - } - break; - - /* Fill block with 16 colors */ - case 0x00: -+ ADVANCE_BLOCK(); - block_ptr = row_ptr + pixel_ptr; - for (pixel_y = 0; pixel_y < 4; pixel_y++) { - for (pixel_x = 0; pixel_x < 4; pixel_x++){ -@@ -213,7 +214,6 @@ static void rpza_decode_stream(RpzaContext *s) - } - block_ptr += row_inc; - } -- ADVANCE_BLOCK(); - break; - - /* Unknown opcode */ --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-smc-fix-off-by-1-error.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-smc-fix-off-by-1-error.patch deleted file mode 100644 index 3ca6fc4dc5..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-smc-fix-off-by-1-error.patch +++ /dev/null @@ -1,32 +0,0 @@ -From c17a0ad1df15a94d0b1239adc2afb593bdf0a153 Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer -Date: Fri, 3 Oct 2014 22:50:45 +0200 -Subject: [PATCH 1/2] avcodec/smc: fix off by 1 error - -Upstream-Status: Backport - -Fixes out of array access -Fixes: asan_heap-oob_1685bf0_5_asan_heap-oob_1f35116_430_smc.mov - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer ---- - libavcodec/smc.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/gst-libs/ext/libav/libavcodec/smc.c b/gst-libs/ext/libav/libavcodec/smc.c -index 3cd5e53..dec9f71 100644 ---- a/gst-libs/ext/libav/libavcodec/smc.c -+++ b/gst-libs/ext/libav/libavcodec/smc.c -@@ -69,7 +69,7 @@ typedef struct SmcContext { - row_ptr += stride * 4; \ - } \ - total_blocks--; \ -- if (total_blocks < 0) \ -+ if (total_blocks < 0 + !!n_blocks) \ - { \ - av_log(s->avctx, AV_LOG_INFO, "warning: block counter just went negative (this should not happen)\n"); \ - return; \ --- -2.1.0 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avformat-mpegtsenc-Check-data-array-size-in-mpegts_w.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avformat-mpegtsenc-Check-data-array-size-in-mpegts_w.patch deleted file mode 100644 index 68bb66e4e2..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avformat-mpegtsenc-Check-data-array-size-in-mpegts_w.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 12770701856a05b6b3cd706f708f8e9a4e8a1336 Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer -Date: Thu, 13 Feb 2014 13:59:51 +0100 -Subject: [PATCH] avformat/mpegtsenc: Check data array size in - mpegts_write_pmt() - -Upstream-Status: Backport - -COmmit 12770701856a05b6b3cd706f708f8e9a4e8a1336 release/0.11 - -Prevents out of array writes - -Signed-off-by: Michael Niedermayer -(cherry picked from commit 842b6c14bcfc1c5da1a2d288fd65386eb8c158ad) - -Conflicts: - - libavformat/mpegtsenc.c -(cherry picked from commit e87de3f50b765134588d0b048c32ed4b8acc16fb) - -Signed-off-by: Michael Niedermayer ---- - libavformat/mpegtsenc.c | 9 +++++++-- - 1 files changed, 7 insertions(+), 2 deletions(-) - -diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c -index 793e205..a12d19f 100644 ---- a/gst-libs/ext/libav/libavformat/mpegtsenc.c -+++ b/gst-libs/ext/libav/libavformat/mpegtsenc.c -@@ -240,7 +240,7 @@ static void mpegts_write_pat(AVFormatContext *s) - data, q - data); - } - --static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service) -+static int mpegts_write_pmt(AVFormatContext *s, MpegTSService *service) - { - // MpegTSWrite *ts = s->priv_data; - uint8_t data[1012], *q, *desc_length_ptr, *program_info_length_ptr; -@@ -293,6 +293,10 @@ static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service) - stream_type = STREAM_TYPE_PRIVATE_DATA; - break; - } -+ -+ if (q - data > sizeof(data) - 32) -+ return AVERROR(EINVAL); -+ - *q++ = stream_type; - put16(&q, 0xe000 | ts_st->pid); - desc_length_ptr = q; -@@ -324,7 +328,7 @@ static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service) - len_ptr = q++; - *len_ptr = 0; - -- for (p = lang->value; next && *len_ptr < 255 / 4 * 4; p = next + 1) { -+ for (p = lang->value; next && *len_ptr < 255 / 4 * 4 && q - data < sizeof(data) - 4; p = next + 1) { - next = strchr(p, ','); - if (strlen(p) != 3 && (!next || next != p + 3)) - continue; /* not a 3-letter code */ -@@ -386,6 +390,7 @@ static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service) - } - mpegts_write_section1(&service->pmt, PMT_TID, service->sid, 0, 0, 0, - data, q - data); -+ return 0; - } - - /* NOTE: str == NULL is accepted for an empty string */ --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-eamad-fix-out-of-array-accesses.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-eamad-fix-out-of-array-accesses.patch deleted file mode 100644 index f45e3fd59d..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-eamad-fix-out-of-array-accesses.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 63ac64864c6e0e84355aa3caa5b92208997a9a8d Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer -Date: Sat, 17 Nov 2012 16:26:55 +0100 -Subject: [PATCH] eamad: fix out of array accesses - -Upstream-Status: Backport - -Commit 63ac64864c6e0e84355aa3caa5b92208997a9a8d release/1.1 - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer ---- - libavcodec/eamad.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/libavcodec/eamad.c b/libavcodec/eamad.c -index 2805195..e38650e 100644 ---- a/gst-libs/ext/libav/libavcodec/eamad.c -+++ b/gst-libs/ext/libav/libavcodec/eamad.c -@@ -237,7 +237,7 @@ static int decode_frame(AVCodecContext *avctx, - int chunk_type; - int inter; - -- if (buf_size < 17) { -+ if (buf_size < 26) { - av_log(avctx, AV_LOG_ERROR, "Input buffer too small\n"); - *data_size = 0; - return -1; --- diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error-concealment-initialize-block-index.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error-concealment-initialize-block-index.patch deleted file mode 100644 index e0e4239c2f..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error-concealment-initialize-block-index.patch +++ /dev/null @@ -1,29 +0,0 @@ -gst-ffmpeg: error concealment: initialize block index. - -Fixes CVE-2011-3941 (out of bounds write) - -Upstream-Status: Backport - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer ---- - libavcodec/error_resilience.c | 3 +++ - 1 files changed, 3 insertions(+), 0 deletions(-) - -diff --git a/libavcodec/error_resilience.c b/libavcodec/error_resilience.c -index 8bb5d0c..d55c000 100644 ---- a/gst-libs/ext/libav/libavcodec/error_resilience.c -+++ b/gst-libs/ext/libav/libavcodec/error_resilience.c -@@ -45,6 +45,9 @@ static void decode_mb(MpegEncContext *s, int ref){ - s->dest[1] = s->current_picture.data[1] + (s->mb_y * (16>>s->chroma_y_shift) * s->uvlinesize) + s->mb_x * (16>>s->chroma_x_shift); - s->dest[2] = s->current_picture.data[2] + (s->mb_y * (16>>s->chroma_y_shift) * s->uvlinesize) + s->mb_x * (16>>s->chroma_x_shift); - -+ ff_init_block_index(s); -+ ff_update_block_index(s); -+ - if(CONFIG_H264_DECODER && s->codec_id == CODEC_ID_H264){ - H264Context *h= (void*)s; - h->mb_xy= s->mb_x + s->mb_y*s->mb_stride; --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error_concealment-Check-that-the-picture-is-not-in-a.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error_concealment-Check-that-the-picture-is-not-in-a.patch deleted file mode 100644 index 8eef6e99cc..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-error_concealment-Check-that-the-picture-is-not-in-a.patch +++ /dev/null @@ -1,37 +0,0 @@ -gst-ffmpeg: error_concealment: Check that the picture is not in a half - -Fixes state becoming inconsistent -Fixes a null pointer dereference - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer -(cherry picked from commit 23318a57358358e7a4dc551e830e4503f0638cfe) - -Upstream-Status: Backport - -Signed-off-by: Yue Tao - ---- - libavcodec/error_resilience.c | 6 ++++++ - 1 files changed, 6 insertions(+), 0 deletions(-) - -diff --git a/libavcodec/error_resilience.c b/libavcodec/error_resilience.c -index 01f7424..2b6bc42 100644 ---- a/gst-libs/ext/libav/libavcodec/error_resilience.c -+++ b/gst-libs/ext/libav/libavcodec/error_resilience.c -@@ -793,6 +793,12 @@ void ff_er_frame_end(MpegEncContext *s){ - s->picture_structure != PICT_FRAME || // we dont support ER of field pictures yet, though it should not crash if enabled - s->error_count==3*s->mb_width*(s->avctx->skip_top + s->avctx->skip_bottom)) return; - -+ if ( s->picture_structure == PICT_FRAME -+ && s->current_picture.linesize[0] != s->current_picture_ptr->linesize[0]) { -+ av_log(s->avctx, AV_LOG_ERROR, "Error concealment not possible, frame not fully initialized\n"); -+ return; -+ } -+ - if(s->current_picture.motion_val[0] == NULL){ - av_log(s->avctx, AV_LOG_ERROR, "Warning MVs not available\n"); - --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-ffserver-set-oformat.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-ffserver-set-oformat.patch deleted file mode 100644 index 80325db4d6..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-ffserver-set-oformat.patch +++ /dev/null @@ -1,36 +0,0 @@ -gst-ffmpeg: ffserver: set oformat - -Fix Ticket1986 - -Signed-off-by: Michael Niedermayer -(cherry picked from commit cbe43e62c9ac7d4aefdc13476f6f691bd626525f) - -Upstream-Status: Backport - ---- - ffserver.c | 4 +++- - 1 files changed, 3 insertions(+), 1 deletions(-) - -diff --git a/ffserver.c b/ffserver.c -index 4044d0f..8740140 100644 ---- a/gst-libs/ext/libav/ffserver.c -+++ b/gst-libs/ext/libav/ffserver.c -@@ -2937,12 +2937,14 @@ static int prepare_sdp_description(FFStream *stream, uint8_t **pbuffer, - { - AVFormatContext *avc; - AVStream *avs = NULL; -+ AVOutputFormat *rtp_format = av_guess_format("rtp", NULL, NULL); - int i; - - avc = avformat_alloc_context(); -- if (avc == NULL) { -+ if (avc == NULL || !rtp_format) { - return -1; - } -+ avc->oformat = rtp_format; - av_dict_set(&avc->metadata, "title", - stream->title[0] ? stream->title : "No Title", 0); - avc->nb_streams = stream->nb_streams; --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-correct-ref-count-check-and-limit-fix-out-of-ar.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-correct-ref-count-check-and-limit-fix-out-of-ar.patch deleted file mode 100644 index d4f55b2696..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-correct-ref-count-check-and-limit-fix-out-of-ar.patch +++ /dev/null @@ -1,29 +0,0 @@ -From d6c184880ee2e09fd68c0ae217173832cee5afc1 Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer -Date: Sun, 18 Nov 2012 16:29:04 +0100 -Subject: [PATCH] h264: correct ref count check and limit, fix out of array - accesses. - -Upstream-Status: Backport - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer ---- - libavcodec/h264.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/libavcodec/h264.c b/libavcodec/h264.c -index da43f1e..32cede5 100644 ---- a/gst-libs/ext/libav/libavcodec/h264.c -+++ b/gst-libs/ext/libav/libavcodec/h264.c -@@ -2870,6 +2870,9 @@ static int decode_slice_header(H264Conte - h->ref_count[0]= get_ue_golomb(&s->gb) + 1; - if(h->slice_type_nos==AV_PICTURE_TYPE_B) - h->ref_count[1]= get_ue_golomb(&s->gb) + 1; -+ else -+ // full range is spec-ok in this case, even for frames -+ h->ref_count[1] = 1; - - if(h->ref_count[0]-1 > 32-1 || h->ref_count[1]-1 > 32-1){ - av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow\n"); --- diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-set-parameters-from-SPS-whenever-it-changes.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-set-parameters-from-SPS-whenever-it-changes.patch deleted file mode 100644 index 05a9de3334..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-set-parameters-from-SPS-whenever-it-changes.patch +++ /dev/null @@ -1,145 +0,0 @@ -gst-ffmpeg: h264: set parameters from SPS whenever it changes - -Fixes a crash in the fuzzed sample sample_varPAR.avi_s26638 with -alternating bit depths. - -Upstream-Status: Backport - -Signed-off-by: Yue Tao - -diff --git a/gst-libs/ext/libav/libavcodec/h264.c.old b/gst-libs/ext/libav/libavcodec/h264.c -index 3621f41..718906a 100644 ---- a/gst-libs/ext/libav/libavcodec/h264.c.old -+++ b/gst-libs/ext/libav/libavcodec/h264.c -@@ -2491,6 +2491,34 @@ int ff_h264_get_profile(SPS *sps) - return profile; - } - -+static int h264_set_parameter_from_sps(H264Context *h) -+{ -+ MpegEncContext *s = &h->s; -+ AVCodecContext * avctx= s->avctx; -+ -+ if (s->flags& CODEC_FLAG_LOW_DELAY || -+ (h->sps.bitstream_restriction_flag && !h->sps.num_reorder_frames)) -+ s->low_delay=1; -+ -+ if(avctx->has_b_frames < 2) -+ avctx->has_b_frames= !s->low_delay; -+ -+ if (avctx->bits_per_raw_sample != h->sps.bit_depth_luma) { -+ if (h->sps.bit_depth_luma >= 8 && h->sps.bit_depth_luma <= 10) { -+ avctx->bits_per_raw_sample = h->sps.bit_depth_luma; -+ h->pixel_shift = h->sps.bit_depth_luma > 8; -+ -+ ff_h264dsp_init(&h->h264dsp, h->sps.bit_depth_luma); -+ ff_h264_pred_init(&h->hpc, s->codec_id, h->sps.bit_depth_luma); -+ dsputil_init(&s->dsp, s->avctx); -+ } else { -+ av_log(avctx, AV_LOG_DEBUG, "Unsupported bit depth: %d\n", h->sps.bit_depth_luma); -+ return -1; -+ } -+ } -+ return 0; -+} -+ - /** - * decodes a slice header. - * This will also call MPV_common_init() and frame_start() as needed. -@@ -2505,7 +2533,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ - MpegEncContext * const s0 = &h0->s; - unsigned int first_mb_in_slice; - unsigned int pps_id; -- int num_ref_idx_active_override_flag; -+ int num_ref_idx_active_override_flag, ret; - unsigned int slice_type, tmp, i, j; - int default_ref_list_done = 0; - int last_pic_structure; -@@ -2569,7 +2597,17 @@ static int decode_slice_header(H264Context *h, H264Context *h0){ - av_log(h->s.avctx, AV_LOG_ERROR, "non-existing SPS %u referenced\n", h->pps.sps_id); - return -1; - } -- h->sps = *h0->sps_buffers[h->pps.sps_id]; -+ -+ if (h->pps.sps_id != h->current_sps_id || -+ h0->sps_buffers[h->pps.sps_id]->new) { -+ h0->sps_buffers[h->pps.sps_id]->new = 0; -+ -+ h->current_sps_id = h->pps.sps_id; -+ h->sps = *h0->sps_buffers[h->pps.sps_id]; -+ -+ if ((ret = h264_set_parameter_from_sps(h)) < 0) -+ return ret; -+ } - - s->avctx->profile = ff_h264_get_profile(&h->sps); - s->avctx->level = h->sps.level_idc; -@@ -3811,26 +3811,8 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){ - case NAL_SPS: - init_get_bits(&s->gb, ptr, bit_length); - ff_h264_decode_seq_parameter_set(h); -- -- if (s->flags& CODEC_FLAG_LOW_DELAY || -- (h->sps.bitstream_restriction_flag && !h->sps.num_reorder_frames)) -- s->low_delay=1; -- -- if(avctx->has_b_frames < 2) -- avctx->has_b_frames= !s->low_delay; -- -- if (avctx->bits_per_raw_sample != h->sps.bit_depth_luma) { -- if (h->sps.bit_depth_luma >= 8 && h->sps.bit_depth_luma <= 10) { -- avctx->bits_per_raw_sample = h->sps.bit_depth_luma; -- h->pixel_shift = h->sps.bit_depth_luma > 8; -- -- ff_h264dsp_init(&h->h264dsp, h->sps.bit_depth_luma); -- ff_h264_pred_init(&h->hpc, s->codec_id, h->sps.bit_depth_luma); -- dsputil_init(&s->dsp, s->avctx); -- } else { -- av_log(avctx, AV_LOG_DEBUG, "Unsupported bit depth: %d\n", h->sps.bit_depth_luma); -- return -1; -- } -+ if (h264_set_parameter_from_sps(h) < 0) { -+ return -1; - } - break; - case NAL_PPS: -diff --git a/gst-libs/ext/libav/libavcodec/h264.h.old b/gst-libs/ext/libav/libavcodec/h264.h -index e3cc815..b77ad98 100644 ---- a/gst-libs/ext/libav/libavcodec/h264.h.old -+++ b/gst-libs/ext/libav/libavcodec/h264.h -@@ -202,6 +202,7 @@ typedef struct SPS{ - int bit_depth_chroma; ///< bit_depth_chroma_minus8 + 8 - int residual_color_transform_flag; ///< residual_colour_transform_flag - int constraint_set_flags; ///< constraint_set[0-3]_flag -+ int new; ///< flag to keep track if the decoder context needs re-init due to changed SPS - }SPS; - - /** -@@ -333,6 +334,7 @@ typedef struct H264Context{ - int emu_edge_width; - int emu_edge_height; - -+ unsigned current_sps_id; ///< id of the current SPS - SPS sps; ///< current sps - - /** -diff --git a/gst-libs/ext/libav/libavcodec/h264_ps.c.old b/gst-libs/ext/libav/libavcodec/h264_ps.c -index 7491807..0929098 100644 ---- a/gst-libs/ext/libav/libavcodec/h264_ps.c.old -+++ b/gst-libs/ext/libav/libavcodec/h264_ps.c -@@ -438,10 +438,13 @@ int ff_h264_decode_seq_parameter_set(H264Context *h){ - sps->timing_info_present_flag ? sps->time_scale : 0 - ); - } -+ sps->new = 1; - - av_free(h->sps_buffers[sps_id]); -- h->sps_buffers[sps_id]= sps; -- h->sps = *sps; -+ h->sps_buffers[sps_id] = sps; -+ h->sps = *sps; -+ h->current_sps_id = sps_id; -+ - return 0; - fail: - av_free(sps); diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch deleted file mode 100644 index 5d45c1a96c..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch +++ /dev/null @@ -1,33 +0,0 @@ -gst-ffmpeg: h264: skip error concealment when SPS and slices are - mismatching - -Fixes out of array accesses - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer -(cherry picked from commit 695af8eed642ff0104834495652d1ee784a4c14d) - -Upstream-Status: Backport - -Signed-off-by: Michael Niedermayer -Signed-off-by: Yue Tao ---- - libavcodec/h264.c | 2 +- - 1 files changed, 1 insertions(+), 1 deletions(-) - -diff --git a/libavcodec/h264.c b/libavcodec/h264.c -index da144db..0aab4e7 100644 ---- a/gst-libs/ext/libav/libavcodec/h264.c -+++ b/gst-libs/ext/libav/libavcodec/h264.c -@@ -2351,7 +2351,7 @@ static int field_end(H264Context *h, int in_setup) - * past end by one (callers fault) and resync_mb_y != 0 - * causes problems for the first MB line, too. - */ -- if (!FIELD_PICTURE) -+ if (!FIELD_PICTURE && h->current_slice && !h->sps.new) - ff_er_frame_end(s); - - ff_MPV_frame_end(s); --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264_sei-Fix-infinite-loop.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264_sei-Fix-infinite-loop.patch deleted file mode 100644 index 1e62b50360..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264_sei-Fix-infinite-loop.patch +++ /dev/null @@ -1,39 +0,0 @@ -gst-ffmpeg: h264_sei: Fix infinite loop. - -Fixsot yet fixed parts of CVE-2011-3946. - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer - -Upstream-Status: Backport - -Signed-off-by: Yue Tao - ---- - libavcodec/h264_sei.c | 4 ++++ - 1 files changed, 4 insertions(+), 0 deletions(-) - - -diff --git a/libavcodec/h264_sei.c b/libavcodec/h264_sei.c -index 374e53d..80d70e5 100644 ---- a/gst-libs/ext/libav/libavcodec/h264_sei.c -+++ b/gst-libs/ext/libav/libavcodec/h264_sei.c -@@ -169,11 +169,15 @@ int ff_h264_decode_sei(H264Context *h){ - - type=0; - do{ -+ if (get_bits_left(&s->gb) < 8) -+ return -1; - type+= show_bits(&s->gb, 8); - }while(get_bits(&s->gb, 8) == 255); - - size=0; - do{ -+ if (get_bits_left(&s->gb) < 8) -+ return -1; - size+= show_bits(&s->gb, 8); - }while(get_bits(&s->gb, 8) == 255); - --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Check-init_vlc-return-codes.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Check-init_vlc-return-codes.patch deleted file mode 100644 index e859e443bb..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Check-init_vlc-return-codes.patch +++ /dev/null @@ -1,87 +0,0 @@ -From b666debffec1fcbb19ef377635a53b9a58bca8a4 Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer -Date: Tue, 29 Jan 2013 18:29:41 +0100 -Subject: [PATCH] huffyuvdec: Check init_vlc() return codes. - -Upstream-Status: Backport - -Commit b666debffec1fcbb19ef377635a53b9a58bca8a4 release/1.0 - -Prevents out of array writes - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer -(cherry picked from commit f67a0d115254461649470452058fa3c28c0df294) - -Signed-off-by: Michael Niedermayer ---- - libavcodec/huffyuv.c | 14 ++++++++++---- - 1 file changed, 10 insertions(+), 4 deletions(-) - -diff --git a/libavcodec/huffyuv.c b/libavcodec/huffyuv.c -index 58da789..993e524 100644 ---- a/gst-libs/ext/libav/libavcodec/huffyuv.c -+++ b/gst-libs/ext/libav/libavcodec/huffyuv.c -@@ -33,6 +33,7 @@ - #include "put_bits.h" - #include "dsputil.h" - #include "thread.h" -+#include "libavutil/avassert.h" - - #define VLC_BITS 11 - -@@ -287,6 +287,7 @@ static void generate_joint_tables(HYuvCo - int len1 = s->len[p][u]; - if (len1 > limit || !len1) - continue; -+ av_assert0(i < (1 << VLC_BITS)); - len[i] = len0 + len1; - bits[i] = (s->bits[0][y] << len1) + s->bits[p][u]; - symbols[i] = (y<<8) + u; -@@ -320,6 +321,7 @@ static void generate_joint_tables(HYuvCo - int len2 = s->len[2][r&255]; - if (len2 > limit1 || !len2) - continue; -+ av_assert0(i < (1 << VLC_BITS)); - len[i] = len0 + len1 + len2; - bits[i] = (code << len2) + s->bits[2][r&255]; - if(s->decorrelate){ -@@ -343,6 +345,7 @@ static void generate_joint_tables(HYuvCo - static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length){ - GetBitContext gb; - int i; -+ int ret; - - init_get_bits(&gb, src, length*8); - -@@ -353,7 +356,9 @@ static int read_huffman_tables(HYuvConte - return -1; - } - free_vlc(&s->vlc[i]); -- init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0); -+ if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, -+ s->bits[i], 4, 4, 0)) < 0) -+ return ret; - } - - generate_joint_tables(s); -@@ -365,6 +370,7 @@ static int read_old_huffman_tables(HYuvC - #if 1 - GetBitContext gb; - int i; -+ int ret; - - init_get_bits(&gb, classic_shift_luma, sizeof(classic_shift_luma)*8); - if(read_len_table(s->len[0], &gb)<0) -@@ -385,7 +391,9 @@ static int read_old_huffman_tables(HYuvC - - for(i=0; i<3; i++){ - free_vlc(&s->vlc[i]); -- init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0); -+ if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, -+ s->bits[i], 4, 4, 0)) < 0) -+ return ret; - } - - generate_joint_tables(s); --- diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Skip-len-0-cases.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Skip-len-0-cases.patch deleted file mode 100644 index 94bf4b6fba..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-huffyuvdec-Skip-len-0-cases.patch +++ /dev/null @@ -1,61 +0,0 @@ -From db0f7f7394e1f994ed38db043f78ed0f10bde0da Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer -Date: Tue, 29 Jan 2013 19:22:33 +0100 -Subject: [PATCH] huffyuvdec: Skip len==0 cases - -Upstream-Status: Backport - -Commit db0f7f7394e1f994ed38db043f78ed0f10bde0da release/1.0 - -Fixes vlc decoding for hypothetical files that would contain such cases. - -Signed-off-by: Michael Niedermayer -(cherry picked from commit 0dfc01c2bbf4b71bb56201bc4a393321e15d1b31) - -Signed-off-by: Michael Niedermayer ---- - libavcodec/huffyuv.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/libavcodec/huffyuv.c b/libavcodec/huffyuv.c -index 993e524..72ed351 100644 ---- a/gst-libs/ext/libav/libavcodec/huffyuv.c -+++ b/gst-libs/ext/libav/libavcodec/huffyuv.c -@@ -281,11 +281,11 @@ static void generate_joint_tables(HYuvCo - for(i=y=0; y<256; y++){ - int len0 = s->len[0][y]; - int limit = VLC_BITS - len0; -- if(limit <= 0) -+ if(limit <= 0 || !len0) - continue; - for(u=0; u<256; u++){ - int len1 = s->len[p][u]; -- if(len1 > limit) -+ if (len1 > limit || !len1) - continue; - len[i] = len0 + len1; - bits[i] = (s->bits[0][y] << len1) + s->bits[p][u]; -@@ -308,17 +308,17 @@ static void generate_joint_tables(HYuvCo - for(i=0, g=-16; g<16; g++){ - int len0 = s->len[p0][g&255]; - int limit0 = VLC_BITS - len0; -- if(limit0 < 2) -+ if (limit0 < 2 || !len0) - continue; - for(b=-16; b<16; b++){ - int len1 = s->len[p1][b&255]; - int limit1 = limit0 - len1; -- if(limit1 < 1) -+ if (limit1 < 1 || !len1) - continue; - code = (s->bits[p0][g&255] << len1) + s->bits[p1][b&255]; - for(r=-16; r<16; r++){ - int len2 = s->len[2][r&255]; -- if(len2 > limit1) -+ if (len2 > limit1 || !len2) - continue; - len[i] = len0 + len1 + len2; - bits[i] = (code << len2) + s->bits[2][r&255]; --- -1.8.5.2.233.g932f7e4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-lavf-compute-probe-buffer-size-more-reliably.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-lavf-compute-probe-buffer-size-more-reliably.patch deleted file mode 100644 index ea4aa222b3..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-lavf-compute-probe-buffer-size-more-reliably.patch +++ /dev/null @@ -1,45 +0,0 @@ -gst-ffmpeg: lavf: compute probe buffer size more reliably. - -The previous code computes the offset by reversing the growth -of the allocated buffer size: it is complex and did lead to -inconsistencies when the size limit is reached. - -Fix trac ticket #1991. -(cherry picked from commit 03847eb8259291b4ff1bd840bd779d0699d71f96) - -Conflicts: - libavformat/utils.c - -Upstream-Status: Backport - -Signed-off-by: Yue Tao - ---- - libavformat/utils.c | 4 ++-- - 1 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/libavformat/utils.c b/libavformat/utils.c -index 7940037..be73c4a 100644 ---- a/gst-libs/ext/libav/libavformat/utils.c -+++ b/gst-libs/ext/libav/libavformat/utils.c -@@ -459,7 +459,7 @@ int av_probe_input_buffer(AVIOContext *pb, AVInputFormat **fmt, - { - AVProbeData pd = { filename ? filename : "", NULL, -offset }; - unsigned char *buf = NULL; -- int ret = 0, probe_size; -+ int ret = 0, probe_size, buf_offset = 0; - - if (!max_probe_size) { - max_probe_size = PROBE_BUF_MAX; -@@ -499,7 +499,7 @@ int av_probe_input_buffer(AVIOContext *pb, AVInputFormat **fmt, - score = 0; - ret = 0; /* error was end of file, nothing read */ - } -- pd.buf_size += ret; -+ pd.buf_size = buf_offset += ret; - pd.buf = &buf[offset]; - - memset(pd.buf + pd.buf_size, 0, AVPROBE_PADDING_SIZE); --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-mjpegdec-check-SE.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-mjpegdec-check-SE.patch deleted file mode 100644 index d90bafac91..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-mjpegdec-check-SE.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 1f41cffe1e3e79620f587545bdfcbd7e6e68ed29 Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer -Date: Sun, 11 Nov 2012 00:01:24 +0100 -Subject: [PATCH] mjpegdec: check SE. - -Upstream-Status: Backport - -Commit 1f41cffe1e3e79620f587545bdfcbd7e6e68ed29 release/1.1 - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer ---- - libavcodec/mjpegdec.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c -index 6b5266d..0a71a6f 100644 ---- a/gst-libs/ext/libav/libavcodec/mjpegdec.c -+++ b/gst-libs/ext/libav/libavcodec/mjpegdec.c -@@ -905,6 +905,11 @@ static int mjpeg_decode_scan_progressive - int16_t *quant_matrix = s->quant_matrixes[ s->quant_index[c] ]; - GetBitContext mb_bitmask_gb; - -+ if (se > 63) { -+ av_log(s->avctx, AV_LOG_ERROR, "SE %d is too large\n", se); -+ return AVERROR_INVALIDDATA; -+ } -+ - if (mb_bitmask) { - init_get_bits(&mb_bitmask_gb, mb_bitmask, s->mb_width*s->mb_height); - } --- diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pgssubdec-check-RLE-size-before-copying.-Fix-out-of-.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pgssubdec-check-RLE-size-before-copying.-Fix-out-of-.patch deleted file mode 100644 index 1041347c87..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pgssubdec-check-RLE-size-before-copying.-Fix-out-of-.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 28bf685bfc6d0c744369cdf367f61a78d80d0b01 Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer -Date: Thu, 15 Nov 2012 16:41:28 +0100 -Subject: [PATCH] pgssubdec: check RLE size before copying. Fix out of array - accesses - -Upstream-Status: Backport - -Commit 28bf685bfc6d0c744369cdf367f61a78d80d0b01 release/1.1 - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer -(cherry picked from commit c0d68be555f5858703383040e04fcd6529777061) ---- - libavcodec/pgssubdec.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/libavcodec/pgssubdec.c b/libavcodec/pgssubdec.c -index 728f178..26a3c2a 100644 ---- a/gst-libs/ext/libav/libavcodec/pgssubdec.c -+++ b/gst-libs/ext/libav/libavcodec/pgssubdec.c -@@ -202,6 +202,11 @@ static int parse_picture_segment(AVCodec - return -1; - } - -+ if (buf_size > rle_bitmap_len) { -+ av_log(avctx, AV_LOG_ERROR, "too much RLE data\n"); -+ return AVERROR_INVALIDDATA; -+ } -+ - ctx->picture.w = width; - ctx->picture.h = height; - --- diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pngdec-filter-dont-access-out-of-array-elements-at-t.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pngdec-filter-dont-access-out-of-array-elements-at-t.patch deleted file mode 100644 index 1e5fb7deb1..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-pngdec-filter-dont-access-out-of-array-elements-at-t.patch +++ /dev/null @@ -1,44 +0,0 @@ -gst-ffmpeg: pngdec/filter: dont access out of array elements at the end - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind - -Upstream-Status: Backport - -Signed-off-by: Yue Tao ---- - libavcodec/pngdec.c | 12 ++++-------- - 1 files changed, 4 insertions(+), 8 deletions(-) - -diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c -index 97c0ad1..193e35e 100644 ---- a/gst-libs/ext/libav/libavcodec/pngdec.c -+++ b/gst-libs/ext/libav/libavcodec/pngdec.c -@@ -190,7 +190,7 @@ void ff_add_png_paeth_prediction(uint8_t *dst, uint8_t *src, uint8_t *top, int w - if(bpp >= 2) g = dst[1];\ - if(bpp >= 3) b = dst[2];\ - if(bpp >= 4) a = dst[3];\ -- for(; i < size; i+=bpp) {\ -+ for(; i <= size - bpp; i+=bpp) {\ - dst[i+0] = r = op(r, src[i+0], last[i+0]);\ - if(bpp == 1) continue;\ - dst[i+1] = g = op(g, src[i+1], last[i+1]);\ -@@ -206,13 +206,9 @@ void ff_add_png_paeth_prediction(uint8_t *dst, uint8_t *src, uint8_t *top, int w - else if(bpp == 2) UNROLL1(2, op)\ - else if(bpp == 3) UNROLL1(3, op)\ - else if(bpp == 4) UNROLL1(4, op)\ -- else {\ -- for (; i < size; i += bpp) {\ -- int j;\ -- for (j = 0; j < bpp; j++)\ -- dst[i+j] = op(dst[i+j-bpp], src[i+j], last[i+j]);\ -- }\ -- } -+ for (; i < size; i++) {\ -+ dst[i] = op(dst[i-bpp], src[i], last[i]);\ -+ }\ - - /* NOTE: 'dst' can be equal to 'last' */ - static void png_filter_row(PNGDSPContext *dsp, uint8_t *dst, int filter_type, --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2-check-array-index-before-use-fix-out-of-array-a.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2-check-array-index-before-use-fix-out-of-array-a.patch deleted file mode 100644 index 8c94232d6d..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2-check-array-index-before-use-fix-out-of-array-a.patch +++ /dev/null @@ -1,30 +0,0 @@ -gst-ffmpeg: qdm2: check array index before use, fix out of array - accesses - -Upstream-Status: Backport - -Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind -Signed-off-by: Michael Niedermayer ---- - libavcodec/qdm2.c | 5 +++++ - 1 files changed, 5 insertions(+), 0 deletions(-) - -diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c -index 4cf4b2f..1dfb8d5 100644 ---- a/gst-libs/ext/libav/libavcodec/qdm2.c -+++ b/gst-libs/ext/libav/libavcodec/qdm2.c -@@ -1257,6 +1257,11 @@ static void qdm2_decode_super_block (QDM2Context *q) - for (i = 0; packet_bytes > 0; i++) { - int j; - -+ if (i>=FF_ARRAY_ELEMS(q->sub_packet_list_A)) { -+ SAMPLES_NEEDED_2("too many packet bytes"); -+ return; -+ } -+ - q->sub_packet_list_A[i].next = NULL; - - if (i > 0) { --- -1.7.5.4 - diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2dec-fix-buffer-overflow.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2dec-fix-buffer-overflow.patch deleted file mode 100644 index 43ffc03a69..0000000000 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2dec-fix-buffer-overflow.patch +++ /dev/null @@ -1,58 +0,0 @@ -gst-ffmpeg: qdm2dec: fix buffer