diff options
Diffstat (limited to 'multimedia/mythtv/files/patch-CVE-2016-10192')
-rw-r--r-- | multimedia/mythtv/files/patch-CVE-2016-10192 | 40 |
1 files changed, 0 insertions, 40 deletions
diff --git a/multimedia/mythtv/files/patch-CVE-2016-10192 b/multimedia/mythtv/files/patch-CVE-2016-10192 deleted file mode 100644 index f2d9c9a9fbe4..000000000000 --- a/multimedia/mythtv/files/patch-CVE-2016-10192 +++ /dev/null @@ -1,40 +0,0 @@ -From c12ee64e80af2517005231388fdf4ea78f16bb0e Mon Sep 17 00:00:00 2001 -From: Michael Niedermayer <michael@niedermayer.cc> -Date: Mon, 5 Dec 2016 17:27:45 +0100 -Subject: [PATCH] ffserver: Check chunk size - -Fixes out of array access - -Fixes: poc_ffserver.py -Found-by: Paul Cher <paulcher@icloud.com> -Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> -(cherry picked from commit a5d25faa3f4b18dac737fdb35d0dd68eb0dc2156) -Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> ---- - ffserver.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git ffserver.c ffserver.c -index 453d790e6cd..aec808e78cb 100644 ---- external/FFmpeg/ffserver.c.orig -+++ external/FFmpeg/ffserver.c -@@ -2702,8 +2702,10 @@ static int http_receive_data(HTTPContext *c) - } else if (c->buffer_ptr - c->buffer >= 2 && - !memcmp(c->buffer_ptr - 1, "\r\n", 2)) { - c->chunk_size = strtol(c->buffer, 0, 16); -- if (c->chunk_size == 0) // end of stream -+ if (c->chunk_size <= 0) { // end of stream or invalid chunk size -+ c->chunk_size = 0; - goto fail; -+ } - c->buffer_ptr = c->buffer; - break; - } else if (++loop_run > 10) -@@ -2725,6 +2727,7 @@ static int http_receive_data(HTTPContext *c) - /* end of connection : close it */ - goto fail; - else { -+ av_assert0(len <= c->chunk_size); - c->chunk_size -= len; - c->buffer_ptr += len; - c->data_count += len; |