From 4435ab4a3b2acbd66910dad5c602ec71f8902386 Mon Sep 17 00:00:00 2001
From: Chen Qi <Qi.Chen@windriver.com>
Date: Tue, 26 Sep 2017 15:43:24 +0800
Subject: ffmpeg: backport patches to fix 12 CVEs

Backport patches to fix the following CVEs.

CVE-2017-14054
CVE-2017-14055
CVE-2017-14056
CVE-2017-14057
CVE-2017-14058
CVE-2017-14059
CVE-2017-14169
CVE-2017-14170
CVE-2017-14171
CVE-2017-14222
CVE-2017-14223
CVE-2017-14225

(From OE-Core rev: 13862938a6a7a938f8d781655ceaf78a81b57549)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
 .../ffmpeg/ffmpeg/CVE-2017-14222.patch             | 40 ++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2017-14222.patch

(limited to 'meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2017-14222.patch')

diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2017-14222.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2017-14222.patch
new file mode 100644
index 0000000000..ee02037948
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2017-14222.patch
@@ -0,0 +1,40 @@
+From 9cb4eb772839c5e1de2855d126bf74ff16d13382 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michael@niedermayer.cc>
+Date: Tue, 5 Sep 2017 00:16:29 +0200
+Subject: [PATCH] avformat/mov: Fix DoS in read_tfra()
+
+Fixes: Missing EOF check in loop
+No testcase
+
+Found-by: Xiaohei and Wangchu from Alibaba Security Team
+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
+
+CVE: CVE-2017-14222
+Upstream-Status: Backport
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ libavformat/mov.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/libavformat/mov.c b/libavformat/mov.c
+index 994e9c6..2519707 100644
+--- a/libavformat/mov.c
++++ b/libavformat/mov.c
+@@ -6094,6 +6094,13 @@ static int read_tfra(MOVContext *mov, AVIOContext *f)
+     }
+     for (i = 0; i < index->item_count; i++) {
+         int64_t time, offset;
++
++        if (avio_feof(f)) {
++            index->item_count = 0;
++            av_freep(&index->items);
++            return AVERROR_INVALIDDATA;
++        }
++
+         if (version == 1) {
+             time   = avio_rb64(f);
+             offset = avio_rb64(f);
+-- 
+2.1.0
+
-- 
cgit v1.2.3-54-g00ecf