gst-ffmpeg: fixes for CVE-2014-8548 and CVE-2014-8541
PATCH 1/1 gst-ffmpeg: fixes for CVE-2014-8548 and CVE-2014-8541
From: Roy Li <[email protected]>
Issue: LIN7-1755
Issue: LIN7-1739
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8541
libavcodec/mjpegdec.c in FFmpeg before 2.4.2 considers only dimension differences, and not bits-per-pixel differences, when determining whether an image size has changed, which allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted MJPEG data.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8548
Off-by-one error in libavcodec/smc.c in FFmpeg before 2.4.2 allows remote attackers to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via crafted Quicktime Graphics (aka SMC) video data.
--- .../0001-avcodec-smc-fix-off-by-1-error.patch | 32 ++++++++++ ...egdec-check-bits-per-pixel-for-changes-si.patch | 68 ++++++++++++++++++++++ .../gstreamer/gst-ffmpeg_0.10.13.bb | 2 + 3 files changed, 102 insertions(+) create mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-smc-fix-off-by-1-error.patch create mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch
meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-smc-fix-off-by-1-error.patch new file +32 -0
@@ -0,0 +1,32 @@ +From c17a0ad1df15a94d0b1239adc2afb593bdf0a153 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer <[email protected]> +Date: Fri, 3 Oct 2014 22:50:45 +0200 +Subject: [PATCH 1/2] avcodec/smc: fix off by 1 error + +Upstream-Status: Backport + +Fixes out of array access +Fixes: asan_heap-oob_1685bf0_5_asan_heap-oob_1f35116_430_smc.mov + +Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind +Signed-off-by: Michael Niedermayer <[email protected]> +--- + libavcodec/smc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gst-libs/ext/libav/libavcodec/smc.c b/gst-libs/ext/libav/libavcodec/smc.c +index 3cd5e53..dec9f71 100644 +--- a/gst-libs/ext/libav/libavcodec/smc.c ++++ b/gst-libs/ext/libav/libavcodec/smc.c +@@ -69,7 +69,7 @@ typedef struct SmcContext { + row_ptr += stride * 4; \ + } \ + total_blocks--; \ +- if (total_blocks < 0) \ ++ if (total_blocks < 0 + !!n_blocks) \ + { \ + av_log(s->avctx, AV_LOG_INFO, "warning: block counter just went negative (this should not happen)\n"); \ + return; \ +-- +2.1.0 +
meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch new file +68 -0
68 lines not on this page · raw message
meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb +2 -0
@@ -55,6 +55,8 @@ SRC_URI = "http://gstreamer.freedesktop.org/src/${BPN}/${BPN}-${PV}.tar.bz2 \ file://0001-ffserver-set-oformat.patch \ file://0001-h264-set-parameters-from-SPS-whenever-it-changes.patch \ file://0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch \ + file://0001-avcodec-smc-fix-off-by-1-error.patch \ + file://0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch \ ${@bb.utils.contains('PACKAGECONFIG', 'libav9', 'file://libav-9.patch', '', d)} \ "
Signature · 1 line
1.9.3