diff options
| author | miwi <miwi@FreeBSD.org> | 2009-01-16 07:56:54 +0800 |
|---|---|---|
| committer | miwi <miwi@FreeBSD.org> | 2009-01-16 07:56:54 +0800 |
| commit | 266555a27e556b5df7e6fb2bb74a52d952ad508f (patch) | |
| tree | e15b618e5b7e599e212483288d5ea60c2a15103c /multimedia/mplayer | |
| parent | d7b066c37c222cd818b63c2e444974e4964d198c (diff) | |
| download | freebsd-ports-gnome-266555a27e556b5df7e6fb2bb74a52d952ad508f.tar.gz freebsd-ports-gnome-266555a27e556b5df7e6fb2bb74a52d952ad508f.tar.zst freebsd-ports-gnome-266555a27e556b5df7e6fb2bb74a52d952ad508f.zip | |
- Fix FFmpeg libavformat "str_read_packet()" Buffer Overflow
PR: 130573
Submitted by: Eygene Ryabinkin <rea-fbsd@codelabs.ru>
Approved by: maintainer via private mail
Security: http://www.vuxml.org/freebsd/5ccb1c14-e357-11dd-a765-0030843d3802.html
Diffstat (limited to 'multimedia/mplayer')
| -rw-r--r-- | multimedia/mplayer/Makefile | 2 | ||||
| -rw-r--r-- | multimedia/mplayer/files/patch-CVE-2008-3162 | 52 |
2 files changed, 53 insertions, 1 deletions
diff --git a/multimedia/mplayer/Makefile b/multimedia/mplayer/Makefile index a03ffd1d85d1..d1c7ac3e4c9b 100644 --- a/multimedia/mplayer/Makefile +++ b/multimedia/mplayer/Makefile @@ -7,7 +7,7 @@ PORTNAME= mplayer PORTVERSION= ${MPLAYER_PORT_VERSION} -PORTREVISION= 9 +PORTREVISION= 10 COMMENT= High performance media player supporting many formats diff --git a/multimedia/mplayer/files/patch-CVE-2008-3162 b/multimedia/mplayer/files/patch-CVE-2008-3162 new file mode 100644 index 000000000000..73a80cd65e9b --- /dev/null +++ b/multimedia/mplayer/files/patch-CVE-2008-3162 @@ -0,0 +1,52 @@ +--- libavformat/psxstr.c 2008/06/26 20:50:15 13992 ++++ libavformat/psxstr.c 2008/06/26 22:22:10 13993 +@@ -274,12 +274,23 @@ + int current_sector = AV_RL16(§or[0x1C]); + int sector_count = AV_RL16(§or[0x1E]); + int frame_size = AV_RL32(§or[0x24]); +- int bytes_to_copy; ++ ++ if(!( frame_size>=0 ++ && current_sector < sector_count ++ && sector_count*VIDEO_DATA_CHUNK_SIZE >=frame_size)){ ++ av_log(s, AV_LOG_ERROR, "Invalid parameters %d %d %d\n", current_sector, sector_count, frame_size); ++ return AVERROR_INVALIDDATA; ++ } ++ + // printf("%d %d %d\n",current_sector,sector_count,frame_size); + /* if this is the first sector of the frame, allocate a pkt */ + pkt = &str->tmp_pkt; +- if (current_sector == 0) { +- if (av_new_packet(pkt, frame_size)) ++ ++ if(pkt->size != sector_count*VIDEO_DATA_CHUNK_SIZE){ ++ if(pkt->data) ++ av_log(s, AV_LOG_ERROR, "missmatching sector_count\n"); ++ av_free_packet(pkt); ++ if (av_new_packet(pkt, sector_count*VIDEO_DATA_CHUNK_SIZE)) + return AVERROR(EIO); + + pkt->pos= url_ftell(pb) - RAW_CD_SECTOR_SIZE; +@@ -293,15 +304,15 @@ + str->pts += (90000 / 15); + } + +- /* load all the constituent chunks in the video packet */ +- bytes_to_copy = frame_size - current_sector*VIDEO_DATA_CHUNK_SIZE; +- if (bytes_to_copy>0) { +- if (bytes_to_copy>VIDEO_DATA_CHUNK_SIZE) bytes_to_copy=VIDEO_DATA_CHUNK_SIZE; +- memcpy(pkt->data + current_sector*VIDEO_DATA_CHUNK_SIZE, +- sector + VIDEO_DATA_HEADER_SIZE, bytes_to_copy); +- } ++ memcpy(pkt->data + current_sector*VIDEO_DATA_CHUNK_SIZE, ++ sector + VIDEO_DATA_HEADER_SIZE, ++ VIDEO_DATA_CHUNK_SIZE); ++ + if (current_sector == sector_count-1) { ++ pkt->size= frame_size; + *ret_pkt = *pkt; ++ pkt->data= NULL; ++ pkt->size= -1; + return 0; + } + |