From: Yue Tao <[email protected]> Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-7010 Signed-off-by: Yue Tao <[email protected]> Signed-off-by: Roy Li <[email protected]> --- ...util-fix-signedness-in-sizeof-comparissio.patch | 38 ++++++++++++++++++++ .../gstreamer/gst-ffmpeg_0.10.13.bb | 1 + 2 files changed, 39 insertions(+) create mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-dsputil-fix-signedness-in-sizeof-comparissio.patch diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-dsputil-fix-signedness-in-sizeof-comparissio.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-dsputil-fix-signedness-in-sizeof-comparissio.patch new file mode 100644 index 0000000..88cc389 --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-avcodec-dsputil-fix-signedness-in-sizeof-comparissio.patch @@ -0,0 +1,38 @@ +From a99aff4e4bbef8e64b51f267cd1769214e1b4e80 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer <[email protected]> +Date: Fri, 30 Aug 2013 23:40:47 +0200 +Subject: [PATCH] avcodec/dsputil: fix signedness in sizeof() comparissions + +Signed-off-by: Michael Niedermayer <[email protected]> +(cherry picked from commit 454a11a1c9c686c78aa97954306fb63453299760) + +Signed-off-by: Michael Niedermayer <[email protected]> +--- + libavcodec/dsputil.c | 4 ++-- + 1 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/libavcodec/dsputil.c b/libavcodec/dsputil.c +index 53dc2eb..6264832 100644 +--- a/gst-libs/ext/libav/libavcodec/dsputil.c ++++ b/gst-libs/ext/libav/libavcodec/dsputil.c +@@ -1912,7 +1912,7 @@ void ff_set_cmp(DSPContext* c, me_cmp_func *cmp, int type){ + + static void add_bytes_c(uint8_t *dst, uint8_t *src, int w){ + long i; +- for(i=0; i<=w-sizeof(long); i+=sizeof(long)){ ++ for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){ + long a = *(long*)(src+i); + long b = *(long*)(dst+i); + *(long*)(dst+i) = ((a&pb_7f) + (b&pb_7f)) ^ ((a^b)&pb_80); +@@ -1937,7 +1937,7 @@ static void diff_bytes_c(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w){ + } + }else + #endif +- for(i=0; i<=w-sizeof(long); i+=sizeof(long)){ ++ for(i=0; i<=w-(int)sizeof(long); i+=sizeof(long)){ + long a = *(long*)(src1+i); + long b = *(long*)(src2+i); + *(long*)(dst+i) = ((a|pb_80) - (b&pb_7f)) ^ ((a^b^pb_80)&pb_80); +-- +1.7.5.4 + diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb b/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb index a540211..c3681b6 100644 --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb +++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb @@ -48,6 +48,7 @@ SRC_URI = "http://gstreamer.freedesktop.org/src/${BPN}/${BPN}-${PV}.tar.bz2 \ file://0001-qdm2dec-fix-buffer-overflow.patch \ file://0001-huffyuvdec-check-width-more-completely-avoid-out-of-.patch \ file://0001-smackerdec-Check-that-the-last-indexes-are-within-th.patch \ + file://0001-avcodec-dsputil-fix-signedness-in-sizeof-comparissio.patch \ " SRC_URI[md5sum] = "7f5beacaf1312db2db30a026b36888c4" -- 1.7.10.4 -- _______________________________________________ Openembedded-core mailing list [email protected] http://lists.openembedded.org/mailman/listinfo/openembedded-core
