mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-22 15:32:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

gst-ffmpeg: fix for Security Advisory CVE-2014-2263

Browse Source 
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB)
muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier,
allows remote attackers to have unspecified impact and vectors, which
trigger an out-of-bounds write.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2263

(From OE-Core rev: 70bf8c8dea82e914a6dcf67aefb6386dbc7706cd)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Yue Tao
2014-04-14 18:38:34 +08:00
committed by Richard Purdie
parent 1532ea067d
commit 46a9ffc167
2 changed files with 70 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

69
meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avformat-mpegtsenc-Check-data-array-size-in-mpegts_w.patch Normal file
View File

@@ -0,0 +1,69 @@
From 12770701856a05b6b3cd706f708f8e9a4e8a1336 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Thu, 13 Feb 2014 13:59:51 +0100
Subject: [PATCH] avformat/mpegtsenc: Check data array size in
mpegts_write_pmt()
Upstream-Status: Backport
COmmit 12770701856a05b6b3cd706f708f8e9a4e8a1336 release/0.11
Prevents out of array writes
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 842b6c14bcfc1c5da1a2d288fd65386eb8c158ad)
Conflicts:
libavformat/mpegtsenc.c
(cherry picked from commit e87de3f50b765134588d0b048c32ed4b8acc16fb)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
libavformat/mpegtsenc.c | 9 +++++++--
1 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c
index 793e205..a12d19f 100644
--- a/gst-libs/ext/libav/libavformat/mpegtsenc.c
+++ b/gst-libs/ext/libav/libavformat/mpegtsenc.c
@@ -240,7 +240,7 @@ static void mpegts_write_pat(AVFormatContext *s)
data, q - data);
}
-static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
+static int mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
{
// MpegTSWrite *ts = s->priv_data;
uint8_t data[1012], *q, *desc_length_ptr, *program_info_length_ptr;
@@ -293,6 +293,10 @@ static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
stream_type = STREAM_TYPE_PRIVATE_DATA;
break;
}
+
+ if (q - data > sizeof(data) - 32)
+ return AVERROR(EINVAL);
+
*q++ = stream_type;
put16(&q, 0xe000 | ts_st->pid);
desc_length_ptr = q;
@@ -324,7 +328,7 @@ static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
len_ptr = q++;
*len_ptr = 0;
- for (p = lang->value; next && *len_ptr < 255 / 4 * 4; p = next + 1) {
+ for (p = lang->value; next && *len_ptr < 255 / 4 * 4 && q - data < sizeof(data) - 4; p = next + 1) {
next = strchr(p, ',');
if (strlen(p) != 3 && (!next || next != p + 3))
continue; /* not a 3-letter code */
@@ -386,6 +390,7 @@ static void mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)
}
mpegts_write_section1(&service->pmt, PMT_TID, service->sid, 0, 0, 0,
data, q - data);
+ return 0;
}
/* NOTE: str == NULL is accepted for an empty string */
--
1.7.5.4

1
meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb
View File

@@ -23,6 +23,7 @@ SRC_URI = "http://gstreamer.freedesktop.org/src/${BPN}/${BPN}-${PV}.tar.bz2 \
file://libav_e500mc.patch \
file://libav_e5500.patch \
file://gst-ffmpeg-CVE-2013-3674.patch \
file://0001-avformat-mpegtsenc-Check-data-array-size-in-mpegts_w.patch \
"
SRC_URI[md5sum] = "7f5beacaf1312db2db30a026b36888c4"