summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/gstreamer
diff options
context:
space:
mode:
authorYue Tao <Yue.Tao@windriver.com>2014-04-27 15:10:15 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2014-05-21 19:50:20 +0100
commit35773420b413d49ac09cfad7b5fffad0c74bfd89 (patch)
tree35b72ec3b44e714c14a69c85479e96b3d7a543f3 /meta/recipes-multimedia/gstreamer
parent6a134113db439455c649fb8e8043f60dda45377f (diff)
downloadpoky-35773420b413d49ac09cfad7b5fffad0c74bfd89.tar.gz
gst-ffmpeg: fix for Security Advisory CVE-2013-0845
libavcodec/alsdec.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via a crafted block length, which triggers an out-of-bounds write. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0845 (From OE-Core rev: cc6e2ee53c49206aa3377c512c3bd1de2e14a7b7) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-multimedia/gstreamer')
-rw-r--r--meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch61
-rw-r--r--meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb1
2 files changed, 62 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch
new file mode 100644
index 0000000000..73980f4265
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-alsdec-check-block-length.patch
@@ -0,0 +1,61 @@
1From 6df0d3e2916c223dbe4262bf1b876dff1cb3f980 Mon Sep 17 00:00:00 2001
2From: Michael Niedermayer <michaelni@gmx.at>
3Date: Wed, 12 Dec 2012 12:28:45 +0100
4Subject: [PATCH] alsdec: check block length
5
6Upstream-Status: Backport
7
8Commit 6df0d3e2916c223dbe4262bf1b876dff1cb3f980 release/1.0
9
10Fix writing over the end
11
12Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
13Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
14(cherry picked from commit 0ceca269b66ec12a23bf0907bd2c220513cdbf16)
15
16Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
17---
18 libavcodec/alsdec.c | 10 ++++++++--
19 1 file changed, 8 insertions(+), 2 deletions(-)
20
21diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
22index 46dd0b4..1095b01 100644
23--- a/gst-libs/ext/libav/libavcodec/alsdec.c
24+++ b/gst-libs/ext/libav/libavcodec/alsdec.c
25@@ -552,12 +552,15 @@ static void get_block_sizes(ALSDecContext *ctx, unsigned int *div_blocks,
26
27 /** Read the block data for a constant block
28 */
29-static void read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd)
30+static int read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd)
31 {
32 ALSSpecificConfig *sconf = &ctx->sconf;
33 AVCodecContext *avctx = ctx->avctx;
34 GetBitContext *gb = &ctx->gb;
35
36+ if (bd->block_length <= 0)
37+ return -1;
38+
39 *bd->raw_samples = 0;
40 *bd->const_block = get_bits1(gb); // 1 = constant value, 0 = zero block (silence)
41 bd->js_blocks = get_bits1(gb);
42@@ -572,6 +575,8 @@ static void read_const_block_data(ALSDecContext *ctx, ALSBlockData *bd)
43
44 // ensure constant block decoding by reusing this field
45 *bd->const_block = 1;
46+
47+ return 0;
48 }
49
50
51@@ -971,7 +976,8 @@ static int read_block(ALSDecContext *ctx, ALSBlockData *bd)
52 if (read_var_block_data(ctx, bd))
53 return -1;
54 } else {
55- read_const_block_data(ctx, bd);
56+ if (read_const_block_data(ctx, bd) < 0)
57+ return -1;
58 }
59
60 return 0;
61--
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb b/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb
index 847b927f8d..430bcc7f1d 100644
--- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb
@@ -28,6 +28,7 @@ SRC_URI = "http://gstreamer.freedesktop.org/src/${BPN}/${BPN}-${PV}.tar.bz2 \
28 file://0001-avcodec-msrle-use-av_image_get_linesize-to-calculate.patch \ 28 file://0001-avcodec-msrle-use-av_image_get_linesize-to-calculate.patch \
29 file://0001-huffyuvdec-Skip-len-0-cases.patch \ 29 file://0001-huffyuvdec-Skip-len-0-cases.patch \
30 file://0001-huffyuvdec-Check-init_vlc-return-codes.patch \ 30 file://0001-huffyuvdec-Check-init_vlc-return-codes.patch \
31 file://0001-alsdec-check-block-length.patch \
31" 32"
32 33
33SRC_URI[md5sum] = "7f5beacaf1312db2db30a026b36888c4" 34SRC_URI[md5sum] = "7f5beacaf1312db2db30a026b36888c4"