diff options
Diffstat (limited to 'import-layers/meta-openembedded/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-8543.patch')
-rw-r--r-- | import-layers/meta-openembedded/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-8543.patch | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/import-layers/meta-openembedded/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-8543.patch b/import-layers/meta-openembedded/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-8543.patch new file mode 100644 index 0000000000..b65e55fc1e --- /dev/null +++ b/import-layers/meta-openembedded/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-8543.patch @@ -0,0 +1,35 @@ +From 8b0e96e1f21b761ca15dbb470cd619a1ebf86c3e Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer <michaelni@gmx.at> +Date: Fri, 3 Oct 2014 14:45:04 +0200 +Subject: [PATCH] avcodec/mmvideo: Bounds check 2nd line of HHV Intra blocks + +(Upstream commit 8b0e96e1f21b761ca15dbb470cd619a1ebf86c3e) + +Fixes out of array access +Fixes: asan_heap-oob_4da4f3_8_asan_heap-oob_4da4f3_419_scene1a.mm + +Upstream-Status: Backport + +Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind +Signed-off-by: Michael Niedermayer <michaelni@gmx.at> +Signed-off-by: Yue Tao <yue.tao@windriver.com> +--- + libavcodec/mmvideo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libavcodec/mmvideo.c b/libavcodec/mmvideo.c +index 026d463..9ff6393 100644 +--- a/gst-libs/ext/libav/libavcodec/mmvideo.c ++++ b/gst-libs/ext/libav/libavcodec/mmvideo.c +@@ -104,7 +104,7 @@ static void mm_decode_intra(MmContext * s, int half_horiz, int half_vert, const + + if (color) { + memset(s->frame.data[0] + y*s->frame.linesize[0] + x, color, run_length); +- if (half_vert) ++ if (half_vert && y + half_vert < s->avctx->height) + memset(s->frame.data[0] + (y+1)*s->frame.linesize[0] + x, color, run_length); + } + x+= run_length; +-- +1.7.9.5 + |