1 files changed, 100 insertions, 0 deletions

diff --git a/meta-multimedia/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-CVE-2013-0855.patch b/meta-multimedia/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-CVE-2013-0855.patch
new file mode 100644
index 000000000..3c8d8e353
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-CVE-2013-0855.patch
@@ -0,0 +1,100 @@
+gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-0855
+
+Upstream-Status: Backport 
+
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+
+diff --git a/gst-libs/ext/libav/libavcodec/alac.c.old b/gst-libs/ext/libav/libavcodec/alac.c
+index 2a0df8c..bcbd56d 100644
+--- a/gst-libs/ext/libav/libavcodec/alac.c.old
++++ b/gst-libs/ext/libav/libavcodec/alac.c
+@@ -87,18 +87,44 @@ typedef struct {
+     int wasted_bits;
+ } ALACContext;
+ 
+-static void allocate_buffers(ALACContext *alac)
++static av_cold int alac_decode_close(AVCodecContext *avctx)
++{
++    ALACContext *alac = avctx->priv_data;
++
++    int chan;
++    for (chan = 0; chan < MAX_CHANNELS; chan++) {
++        av_freep(&alac->predicterror_buffer[chan]);
++        av_freep(&alac->outputsamples_buffer[chan]);
++        av_freep(&alac->wasted_bits_buffer[chan]);
++    }
++
++    return 0;
++}
++
++static int allocate_buffers(ALACContext *alac)
+ {
+     int chan;
++    int buf_size;
++
++    if (alac->setinfo_max_samples_per_frame > INT_MAX / sizeof(int32_t))
++        goto buf_alloc_fail;
++    buf_size = alac->setinfo_max_samples_per_frame * sizeof(int32_t);
++
+     for (chan = 0; chan < MAX_CHANNELS; chan++) {
+-        alac->predicterror_buffer[chan] =
+-            av_malloc(alac->setinfo_max_samples_per_frame * 4);
+ 
+-        alac->outputsamples_buffer[chan] =
+-            av_malloc(alac->setinfo_max_samples_per_frame * 4);
++        FF_ALLOC_OR_GOTO(alac->avctx, alac->predicterror_buffer[chan],
++                         buf_size, buf_alloc_fail);
+ 
+-        alac->wasted_bits_buffer[chan] = av_malloc(alac->setinfo_max_samples_per_frame * 4);
++        FF_ALLOC_OR_GOTO(alac->avctx, alac->outputsamples_buffer[chan],
++                         buf_size, buf_alloc_fail);
++
++        FF_ALLOC_OR_GOTO(alac->avctx, alac->wasted_bits_buffer[chan],
++                         buf_size, buf_alloc_fail);
+     }
++    return 0;
++buf_alloc_fail:
++    alac_decode_close(alac->avctx);
++    return AVERROR(ENOMEM);
+ }
+ 
+ static int alac_set_info(ALACContext *alac)
+@@ -131,8 +157,6 @@ static int alac_set_info(ALACContext *alac)
+     bytestream_get_be32(&ptr);      /* bitrate ? */
+     bytestream_get_be32(&ptr);      /* samplerate */
+ 
+-    allocate_buffers(alac);
+-
+     return 0;
+ }
+ 
+@@ -659,6 +683,7 @@ static int alac_decode_frame(AVCodecContext *avctx,
+ 
+ static av_cold int alac_decode_init(AVCodecContext * avctx)
+ {
++    int ret;
+     ALACContext *alac = avctx->priv_data;
+     alac->avctx = avctx;
+     alac->numchannels = alac->avctx->channels;
+@@ -674,18 +699,9 @@ static av_cold int alac_decode_init(AVCodecContext * avctx)
+         return -1;
+     }
+ 
+-    return 0;
+-}
+-
+-static av_cold int alac_decode_close(AVCodecContext *avctx)
+-{
+-    ALACContext *alac = avctx->priv_data;
+-
+-    int chan;
+-    for (chan = 0; chan < MAX_CHANNELS; chan++) {
+-        av_freep(&alac->predicterror_buffer[chan]);
+-        av_freep(&alac->outputsamples_buffer[chan]);
+-        av_freep(&alac->wasted_bits_buffer[chan]);
++    if ((ret = allocate_buffers(alac)) < 0) {
++        av_log(avctx, AV_LOG_ERROR, "Error allocating buffers\n");
++        return ret;
+     }
+ 
+     return 0;