gst-ffmpeg: fix CVE issues

Backport patches to fix following CVE issues:

* CVE-2011-4352
* CVE-2014-7933
* CVE-2014-8542
* CVE-2014-8543
* CVE-2014-8544
* CVE-2014-8545
* CVE-2014-8546
* CVE-2014-8547
* CVE-2014-9318
* CVE-2014-9603

Patch for CVE-2014-9603 in upstream is applied for version 2.x. Becuase
source code changes, just partly backport part of the commit which is
applicable to version 0.10.13.

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>

1 files changed, 36 insertions, 0 deletions

diff --git a/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-8545.patch b/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-8545.patch
new file mode 100644
index 000000000..29d5f776a
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-8545.patch
@@ -0,0 +1,36 @@
+From 3e2b745020c2dbf0201fe7df3dad9e7e0b2e1bb6 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Fri, 3 Oct 2014 17:35:58 +0200
+Subject: [PATCH] avcodec/pngdec: Check bits per pixel before setting
+ monoblack pixel format
+
+(Upstream commit 3e2b745020c2dbf0201fe7df3dad9e7e0b2e1bb6)
+
+Fixes out of array accesses
+Fixes: asan_heap-oob_14dbfcf_4_asan_heap-oob_1ce5767_179_add_method_small.png
+
+Upstream-Status: Backport
+
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+---
+ libavcodec/pngdec.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
+index da91aab..f3603b3 100644
+--- a/gst-libs/ext/libav/libavcodec/pngdec.c
++++ b/gst-libs/ext/libav/libavcodec/pngdec.c
+@@ -481,7 +481,7 @@ static int decode_frame(AVCodecContext *avctx,
+                 } else if (s->bit_depth == 16 &&
+                            s->color_type == PNG_COLOR_TYPE_RGB) {
+                     avctx->pix_fmt = PIX_FMT_RGB48BE;
+-                } else if (s->bit_depth == 1 &&
++                } else if (s->bit_depth == 1 && s->bits_per_pixel == 1 &&
+                            s->color_type == PNG_COLOR_TYPE_GRAY) {
+                     avctx->pix_fmt = PIX_FMT_MONOBLACK;
+                 } else if (s->color_type == PNG_COLOR_TYPE_PALETTE) {
+-- 
+1.7.9.5
+