diff options
Diffstat (limited to 'meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-8544.patch')
-rw-r--r-- | meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-8544.patch | 56 |
1 files changed, 0 insertions, 56 deletions
diff --git a/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-8544.patch b/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-8544.patch deleted file mode 100644 index a124e3a123..0000000000 --- a/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-8544.patch +++ /dev/null | |||
@@ -1,56 +0,0 @@ | |||
1 | From e1c0cfaa419aa5d320540d5a1b3f8fd9b82ab7e5 Mon Sep 17 00:00:00 2001 | ||
2 | From: Michael Niedermayer <michaelni@gmx.at> | ||
3 | Date: Fri, 3 Oct 2014 16:08:32 +0200 | ||
4 | Subject: [PATCH] avcodec/tiff: more completely check bpp/bppcount | ||
5 | |||
6 | (Upstream commit e1c0cfaa419aa5d320540d5a1b3f8fd9b82ab7e5) | ||
7 | |||
8 | Fixes pixel format selection | ||
9 | Fixes out of array accesses | ||
10 | Fixes: asan_heap-oob_1766029_6_asan_heap-oob_20aa045_332_cov_1823216757_m2-d1d366d7965db766c19a66c7a2ccbb6b.tif | ||
11 | |||
12 | Upstream-Status: Backport | ||
13 | |||
14 | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind | ||
15 | Signed-off-by: Michael Niedermayer <michaelni@gmx.at> | ||
16 | Signed-off-by: Yue Tao <yue.tao@windriver.com> | ||
17 | --- | ||
18 | libavcodec/tiff.c | 13 ++++++++++--- | ||
19 | 1 file changed, 10 insertions(+), 3 deletions(-) | ||
20 | |||
21 | diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c | ||
22 | index 6e2096f..0870e31 100644 | ||
23 | --- a/gst-libs/ext/libav/libavcodec/tiff.c | ||
24 | +++ b/gst-libs/ext/libav/libavcodec/tiff.c | ||
25 | @@ -324,11 +324,11 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t * | ||
26 | s->height = value; | ||
27 | break; | ||
28 | case TIFF_BPP: | ||
29 | - s->bppcount = count; | ||
30 | - if(count > 4){ | ||
31 | - av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", s->bpp, count); | ||
32 | + if(count > 4U){ | ||
33 | + av_log(s->avctx, AV_LOG_ERROR, "This format is not supported (bpp=%d, %d components)\n", value, count); | ||
34 | return -1; | ||
35 | } | ||
36 | + s->bppcount = count; | ||
37 | if(count == 1) s->bpp = value; | ||
38 | else{ | ||
39 | switch(type){ | ||
40 | @@ -344,6 +344,13 @@ static int tiff_decode_tag(TiffContext *s, const uint8_t *start, const uint8_t * | ||
41 | s->bpp = -1; | ||
42 | } | ||
43 | } | ||
44 | + if (s->bpp > 64U) { | ||
45 | + av_log(s->avctx, AV_LOG_ERROR, | ||
46 | + "This format is not supported (bpp=%d, %d components)\n", | ||
47 | + s->bpp, count); | ||
48 | + s->bpp = 0; | ||
49 | + return AVERROR_INVALIDDATA; | ||
50 | + } | ||
51 | break; | ||
52 | case TIFF_SAMPLES_PER_PIXEL: | ||
53 | if (count != 1) { | ||
54 | -- | ||
55 | 1.7.9.5 | ||
56 | |||