diff options
| author |   Eric Hameleers <alien@slackware.com> | 2019-05-27 13:34:52 +0000 |
|---|---|---|
| committer | Eric Hameleers <alien@slackware.com> | 2019-05-27 13:34:52 +0000 |
| commit | ff2f2a8b04fb04e0284996a483cb6ed4ad8791b2 (patch) | |
| tree | 0ae7cbcb402f221c8ba046254854cc69763e5211 | |
| parent | 40a7bab38db37b5c4b65cf607832fe0c2873f440 (diff) | |
| download | asb-ff2f2a8b04fb04e0284996a483cb6ed4ad8791b2.tar.gz asb-ff2f2a8b04fb04e0284996a483cb6ed4ad8791b2.tar.xz | |
Initial revision
| -rw-r--r-- | vlc/build/patches/ffmpeg_mkv-overshoot.patch | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/vlc/build/patches/ffmpeg_mkv-overshoot.patch b/vlc/build/patches/ffmpeg_mkv-overshoot.patch new file mode 100644 index 00000000..742893b0 --- /dev/null +++ b/vlc/build/patches/ffmpeg_mkv-overshoot.patch @@ -0,0 +1,24 @@ +#ffmpeg: don't use EBML elements in Matroska that are bigger than their parents. +#https://hackerone.com/reports/492882 + +--- ffmpeg/libavformat/matroskadec.c.overshoot 2019-02-11 16:03:57.375444600 +0100 ++++ ffmpeg/libavformat/matroskadec.c 2019-02-11 16:04:04.418307200 +0100 +@@ -1197,6 +1197,18 @@ static int ebml_parse_elem(MatroskaDemux + length, max_lengths[syntax->type], syntax->type); + return AVERROR_INVALIDDATA; + } ++ if (matroska->num_levels > 0) { ++ MatroskaLevel *level = &matroska->levels[matroska->num_levels - 1]; ++ AVIOContext *pb = matroska->ctx->pb; ++ int64_t pos = avio_tell(pb); ++ if (level->length != (uint64_t) -1 && ++ (pos + length) > (level->start + level->length)) { ++ av_log(matroska->ctx, AV_LOG_ERROR, ++ "Invalid length 0x%"PRIx64" > 0x%"PRIx64" in parent\n", ++ length, level->start + level->length); ++ return AVERROR_INVALIDDATA; ++ } ++ } + } + + switch (syntax->type) { |