diff options
| author | Jason E. Hale <jhale@FreeBSD.org> | 2018-03-25 17:09:05 +0000 |
|---|---|---|
| committer | Jason E. Hale <jhale@FreeBSD.org> | 2018-03-25 17:09:05 +0000 |
| commit | db032688dfff0df0cd92849f13033b28a8b1b1f2 (patch) | |
| tree | 798b5fbd8a866689a9e7a6acdefbbe97f5e7555e /multimedia/mythtv/files/patch-CVE-2017-05025 | |
| parent | - update to 2.0 (diff) | |
Update multimedia/mythtv and related ports to 29.1 [1]
Convert multimedia/mythtv-frontend to a slave port of multimedia/mythtv
which should make future updates much easier.
Upstream security patches have been added to address known
vulnerabilities in the bundled ffmpeg 3.2.
PR: 225652 (initial patches to update to 29.0) [1]
Submitted by: <lucylangthorne55@gmail.com> [1]
Differential Revision: https://reviews.freebsd.org/D14563
Diffstat (limited to 'multimedia/mythtv/files/patch-CVE-2017-05025')
| -rw-r--r-- | multimedia/mythtv/files/patch-CVE-2017-05025 | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/multimedia/mythtv/files/patch-CVE-2017-05025 b/multimedia/mythtv/files/patch-CVE-2017-05025 new file mode 100644 index 000000000000..8d790d11542c --- /dev/null +++ b/multimedia/mythtv/files/patch-CVE-2017-05025 @@ -0,0 +1,30 @@ +From cf8e004a51b08c6e8ceaeebca85ab84c7ed0b4cf Mon Sep 17 00:00:00 2001 +From: Matt Wolenetz <wolenetz@google.com> +Date: Wed, 14 Dec 2016 15:24:42 -0800 +Subject: [PATCH] lavf/mov.c: Avoid heap allocation wrap in mov_read_hdlr + +Core of patch is from paul@paulmehta.com +Reference https://crbug.com/643950 + +Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> +Check value reduced as the code does not support larger lengths + +(cherry picked from commit fd30e4d57fe5841385f845440688505b88c0f4a9) +Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> +--- + libavformat/mov.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git libavformat/mov.c libavformat/mov.c +index 1e2141808da..17d0475aae1 100644 +--- external/FFmpeg/libavformat/mov.c ++++ external/FFmpeg/libavformat/mov.c +@@ -739,6 +739,8 @@ static int mov_read_hdlr(MOVContext *c, AVIOContext *pb, MOVAtom atom) + + title_size = atom.size - 24; + if (title_size > 0) { ++ if (title_size > FFMIN(INT_MAX, SIZE_MAX-1)) ++ return AVERROR_INVALIDDATA; + title_str = av_malloc(title_size + 1); /* Add null terminator */ + if (!title_str) + return AVERROR(ENOMEM); |