diff options
author | Yue Tao <Yue.Tao@windriver.com> | 2014-04-27 21:02:51 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2014-05-29 13:43:30 +0100 |
commit | f91b780b1a7708394c855da99d76b3b8b30a9065 (patch) | |
tree | ab80f97041c6bc8578240ed1218a1dce91db7d08 /meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13 | |
parent | 938e925356cb8bfc782a3c34f5739f353fc6b9c9 (diff) | |
download | poky-f91b780b1a7708394c855da99d76b3b8b30a9065.tar.gz |
gst-ffmpeg: fix for Security Advisory CVE-2013-0850
The decode_slice_header function in libavcodec/h264.c in FFmpeg before
1.1 allows remote attackers to have an unspecified impact via crafted
H.264 data, which triggers an out-of-bounds array access.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0850
(From OE-Core rev: 69f3f0f94f4fd224e5a6b275207adf0539d085c3)
(From OE-Core rev: bf7b08d94c1d8282ca7ea584254d5c0d1fd7e469)
Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13')
-rw-r--r-- | meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-correct-ref-count-check-and-limit-fix-out-of-ar.patch | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-correct-ref-count-check-and-limit-fix-out-of-ar.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-correct-ref-count-check-and-limit-fix-out-of-ar.patch new file mode 100644 index 0000000000..d4f55b2696 --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-correct-ref-count-check-and-limit-fix-out-of-ar.patch | |||
@@ -0,0 +1,29 @@ | |||
1 | From d6c184880ee2e09fd68c0ae217173832cee5afc1 Mon Sep 17 00:00:00 2001 | ||
2 | From: Michael Niedermayer <michaelni@gmx.at> | ||
3 | Date: Sun, 18 Nov 2012 16:29:04 +0100 | ||
4 | Subject: [PATCH] h264: correct ref count check and limit, fix out of array | ||
5 | accesses. | ||
6 | |||
7 | Upstream-Status: Backport | ||
8 | |||
9 | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind | ||
10 | Signed-off-by: Michael Niedermayer <michaelni@gmx.at> | ||
11 | --- | ||
12 | libavcodec/h264.c | 2 +- | ||
13 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
14 | |||
15 | diff --git a/libavcodec/h264.c b/libavcodec/h264.c | ||
16 | index da43f1e..32cede5 100644 | ||
17 | --- a/gst-libs/ext/libav/libavcodec/h264.c | ||
18 | +++ b/gst-libs/ext/libav/libavcodec/h264.c | ||
19 | @@ -2870,6 +2870,9 @@ static int decode_slice_header(H264Conte | ||
20 | h->ref_count[0]= get_ue_golomb(&s->gb) + 1; | ||
21 | if(h->slice_type_nos==AV_PICTURE_TYPE_B) | ||
22 | h->ref_count[1]= get_ue_golomb(&s->gb) + 1; | ||
23 | + else | ||
24 | + // full range is spec-ok in this case, even for frames | ||
25 | + h->ref_count[1] = 1; | ||
26 | |||
27 | if(h->ref_count[0]-1 > 32-1 || h->ref_count[1]-1 > 32-1){ | ||
28 | av_log(h->s.avctx, AV_LOG_ERROR, "reference overflow\n"); | ||
29 | -- | ||