From 3fc5cfe3dd4e8cf966990671c834df6562525179 Mon Sep 17 00:00:00 2001 From: Roy Li Date: Tue, 18 Nov 2014 21:02:11 -0600 Subject: gst-ffmpeg: fixes for CVE-2014-8548 and CVE-2014-8541 Issue: LIN7-1755 Issue: LIN7-1739 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8541 libavcodec/mjpegdec.c in FFmpeg before 2.4.2 considers only dimension differences, and not bits-per-pixel differences, when determining whether an image size has changed, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MJPEG data. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8548 Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Quicktime Graphics (aka SMC) video data. (From OE-Core rev: 4bd50c5a967af2b8f0fe77b8f9c100169e4fc531) Signed-off-by: Roy Li Signed-off-by: Mark Hatle Signed-off-by: Ross Burton Signed-off-by: Richard Purdie --- ...egdec-check-bits-per-pixel-for-changes-si.patch | 68 ++++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch (limited to 'meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch') diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch new file mode 100644 index 0000000000..c8bafd570e --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch @@ -0,0 +1,68 @@ +From 6043c431c97d55173f339fafbd033d3c0642e2e9 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Fri, 3 Oct 2014 01:50:27 +0200 +Subject: [PATCH 2/2] avcodec/mjpegdec: check bits per pixel for changes + similar to dimensions + +Upstream-Status: Backport + +Fixes out of array accesses +Fixes: asan_heap-oob_16668e9_2_asan_heap-oob_16668e9_346_miss_congeniality_pegasus_mjpg.avi + +Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind +Signed-off-by: Michael Niedermayer + +Conflicts: + libavcodec/mjpegdec.c +--- + libavcodec/mjpegdec.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/gst-libs/ext/libav/libavcodec/mjpegdec.c b/gst-libs/ext/libav/libavcodec/mjpegdec.c +index 84343c0..c0137d8 100644 +--- a/gst-libs/ext/libav/libavcodec/mjpegdec.c ++++ b/gst-libs/ext/libav/libavcodec/mjpegdec.c +@@ -210,16 +210,16 @@ int ff_mjpeg_decode_dht(MJpegDecodeContext *s) + + int ff_mjpeg_decode_sof(MJpegDecodeContext *s) + { +- int len, nb_components, i, width, height, pix_fmt_id; ++ int len, nb_components, i, bits, width, height, pix_fmt_id; + + /* XXX: verify len field validity */ + len = get_bits(&s->gb, 16); +- s->bits= get_bits(&s->gb, 8); ++ bits= get_bits(&s->gb, 8); + +- if(s->pegasus_rct) s->bits=9; +- if(s->bits==9 && !s->pegasus_rct) s->rct=1; //FIXME ugly ++ if(s->pegasus_rct) bits=9; ++ if(bits==9 && !s->pegasus_rct) s->rct=1; //FIXME ugly + +- if (s->bits != 8 && !s->lossless){ ++ if (bits != 8 && !s->lossless){ + av_log(s->avctx, AV_LOG_ERROR, "only 8 bits/component accepted\n"); + return -1; + } +@@ -239,7 +239,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) + if (nb_components <= 0 || + nb_components > MAX_COMPONENTS) + return -1; +- if (s->ls && !(s->bits <= 8 || nb_components == 1)){ ++ if (s->ls && !(bits <= 8 || nb_components == 1)){ + av_log(s->avctx, AV_LOG_ERROR, "only <= 8 bits/component or 16-bit gray accepted for JPEG-LS\n"); + return -1; + } +@@ -272,10 +272,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) + + /* if different size, realloc/alloc picture */ + /* XXX: also check h_count and v_count */ +- if (width != s->width || height != s->height) { ++ if (width != s->width || height != s->height || bits != s->bits) { + av_freep(&s->qscale_table); + + s->width = width; ++ s->bits= bits; + s->height = height; + s->interlaced = 0; + -- cgit v1.2.3-54-g00ecf