diff options
Diffstat (limited to 'multimedia/mythtv/files/patch-CVE-2017-09608b')
| -rw-r--r-- | multimedia/mythtv/files/patch-CVE-2017-09608b | 82 |
1 files changed, 82 insertions, 0 deletions
diff --git a/multimedia/mythtv/files/patch-CVE-2017-09608b b/multimedia/mythtv/files/patch-CVE-2017-09608b new file mode 100644 index 000000000000..7a28a94c3de1 --- /dev/null +++ b/multimedia/mythtv/files/patch-CVE-2017-09608b @@ -0,0 +1,82 @@ +From da693f8daa62cb76a2aa05021d6c8d53a1b816b2 Mon Sep 17 00:00:00 2001 +From: Paul B Mahol <onemda@gmail.com> +Date: Sun, 23 Apr 2017 11:53:57 +0200 +Subject: [PATCH] avcodec/dnxhd_parser: fix parsing interlaced video, simplify + code + +There appears to be no need to treat interlaced videos differently, +also that code is flawed, as for at least one input cur_field would +be always 0. + +Fixes ticket #6344. + +Signed-off-by: Paul B Mahol <onemda@gmail.com> +(cherry picked from commit ac30754a148df58822a272555d1f6f860e42037e) +--- + libavcodec/dnxhd_parser.c | 14 +------------- + 1 file changed, 1 insertion(+), 13 deletions(-) + +diff --git a/libavcodec/dnxhd_parser.c b/libavcodec/dnxhd_parser.c +index 4f9bbceeeb5..a1f632a620e 100644 +--- external/FFmpeg/libavcodec/dnxhd_parser.c ++++ external/FFmpeg/libavcodec/dnxhd_parser.c +@@ -29,8 +29,6 @@ + + typedef struct { + ParseContext pc; +- int interlaced; +- int cur_field; /* first field is 0, second is 1 */ + int cur_byte; + int remaining; + int w, h; +@@ -56,8 +54,6 @@ static int dnxhd_find_frame_end(DNXHDParserContext *dctx, + uint64_t state = pc->state64; + int pic_found = pc->frame_start_found; + int i = 0; +- int interlaced = dctx->interlaced; +- int cur_field = dctx->cur_field; + + if (!pic_found) { + for (i = 0; i < buf_size; i++) { +@@ -65,8 +61,6 @@ static int dnxhd_find_frame_end(DNXHDParserContext *dctx, + if (ff_dnxhd_check_header_prefix(state & 0xffffffffff00LL) != 0) { + i++; + pic_found = 1; +- interlaced = (state&2)>>1; /* byte following the 5-byte header prefix */ +- cur_field = state&1; + dctx->cur_byte = 0; + dctx->remaining = 0; + break; +@@ -97,13 +91,11 @@ static int dnxhd_find_frame_end(DNXHDParserContext *dctx, + if (dctx->remaining <= 0) + return dctx->remaining; + } +- if (buf_size - i >= dctx->remaining && (!dctx->interlaced || dctx->cur_field)) { ++ if (buf_size - i + 47 >= dctx->remaining) { + int remaining = dctx->remaining; + + pc->frame_start_found = 0; + pc->state64 = -1; +- dctx->interlaced = interlaced; +- dctx->cur_field = 0; + dctx->cur_byte = 0; + dctx->remaining = 0; + return remaining; +@@ -120,8 +112,6 @@ static int dnxhd_find_frame_end(DNXHDParserContext *dctx, + + pc->frame_start_found = 0; + pc->state64 = -1; +- dctx->interlaced = interlaced; +- dctx->cur_field = 0; + dctx->cur_byte = 0; + dctx->remaining = 0; + return remaining; +@@ -129,8 +119,6 @@ static int dnxhd_find_frame_end(DNXHDParserContext *dctx, + } + pc->frame_start_found = pic_found; + pc->state64 = state; +- dctx->interlaced = interlaced; +- dctx->cur_field = cur_field; + return END_NOT_FOUND; + } + |