summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2dec-fix-buffer-overflow.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2dec-fix-buffer-overflow.patch')
-rw-r--r--meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2dec-fix-buffer-overflow.patch58
1 files changed, 58 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2dec-fix-buffer-overflow.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2dec-fix-buffer-overflow.patch
new file mode 100644
index 0000000000..43ffc03a69
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-qdm2dec-fix-buffer-overflow.patch
@@ -0,0 +1,58 @@
1gst-ffmpeg: qdm2dec: fix buffer overflow. Fixes NGS00144
2
3This also adds a few lines of code from master that are needed for this fix.
4
5Thanks to Phillip for suggestions to improve the patch.
6Found-by: Phillip Langlois
7
8Upstream-Status: Backport
9
10Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
11---
12 libavcodec/qdm2.c | 9 +++++++--
13 1 files changed, 7 insertions(+), 2 deletions(-)
14
15diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c
16index 3aa9e5b..e000df8 100644
17--- a/gst-libs/ext/libav/libavcodec/qdm2.c
18+++ b/gst-libs/ext/libav/libavcodec/qdm2.c
19@@ -76,6 +76,7 @@ do { \
20 #define SAMPLES_NEEDED_2(why) \
21 av_log (NULL,AV_LOG_INFO,"This file triggers some missing code. Please contact the developers.\nPosition: %s\n",why);
22
23+#define QDM2_MAX_FRAME_SIZE 512
24
25 typedef int8_t sb_int8_array[2][30][64];
26
27@@ -168,7 +169,7 @@ typedef struct {
28 /// I/O data
29 const uint8_t *compressed_data;
30 int compressed_size;
31- float output_buffer[1024];
32+ float output_buffer[QDM2_MAX_FRAME_SIZE * MPA_MAX_CHANNELS * 2];
33
34 /// Synthesis filter
35 MPADSPContext mpadsp;
36@@ -1819,6 +1820,9 @@ static av_cold int qdm2_decode_init(AVCodecContext *avctx)
37 s->group_order = av_log2(s->group_size) + 1;
38 s->frame_size = s->group_size / 16; // 16 iterations per super block
39
40+ if (s->frame_size > QDM2_MAX_FRAME_SIZE)
41+ return AVERROR_INVALIDDATA;
42+
43 s->sub_sampling = s->fft_order - 7;
44 s->frequency_range = 255 / (1 << (2 - s->sub_sampling));
45
46@@ -1887,6 +1891,9 @@ static int qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
47 int ch, i;
48 const int frame_size = (q->frame_size * q->channels);
49
50+ if((unsigned)frame_size > FF_ARRAY_ELEMS(q->output_buffer)/2)
51+ return -1;
52+
53 /* select input buffer */
54 q->compressed_data = in;
55 q->compressed_size = q->checksum_size;
56--
571.7.5.4
58