From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.windriver.com (mail.windriver.com [147.11.1.11]) by mail.openembedded.org (Postfix) with ESMTP id 06E546AC85 for ; Fri, 29 Aug 2014 06:37:35 +0000 (UTC) Received: from ALA-HCA.corp.ad.wrs.com (ala-hca.corp.ad.wrs.com [147.11.189.40]) by mail.windriver.com (8.14.9/8.14.5) with ESMTP id s7T6bbrr027102 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Thu, 28 Aug 2014 23:37:37 -0700 (PDT) Received: from [128.224.162.151] (128.224.162.151) by ALA-HCA.corp.ad.wrs.com (147.11.189.50) with Microsoft SMTP Server id 14.3.174.1; Thu, 28 Aug 2014 23:37:37 -0700 Message-ID: <54001FBC.1020008@windriver.com> Date: Fri, 29 Aug 2014 14:37:48 +0800 From: "yue.tao" User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.0 MIME-Version: 1.0 To: References: <1409293376-10981-1-git-send-email-Yue.Tao@windriver.com> <1409293376-10981-2-git-send-email-Yue.Tao@windriver.com> In-Reply-To: <1409293376-10981-2-git-send-email-Yue.Tao@windriver.com> Subject: Re: [PATCH 2/2] gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-0869 X-BeenThere: openembedded-core@lists.openembedded.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Patches and discussions about the oe-core layer List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Aug 2014 06:37:36 -0000 Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 8bit Ditto On 2014年08月29日 14:22, Yue Tao wrote: > The field_end function in libavcodec/h264.c in FFmpeg before 1.1.2 > allows remote attackers to have an unspecified impact via crafted H.264 > data, related to an SPS and slice mismatch and an out-of-bounds array > access. > > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0869 > > Signed-off-by: Yue Tao > --- > ...rror-concealment-when-SPS-and-slices-are-.patch | 33 ++++++++++++++++++++ > .../gstreamer/gst-ffmpeg_0.10.13.bb | 1 + > 2 files changed, 34 insertions(+) > create mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch > > diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch > new file mode 100644 > index 0000000..7dcba36 > --- /dev/null > +++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch > @@ -0,0 +1,33 @@ > +gst-ffmpeg: h264: skip error concealment when SPS and slices are > + mismatching > + > +Fixes out of array accesses > + > +Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind > +Signed-off-by: Michael Niedermayer > +(cherry picked from commit 695af8eed642ff0104834495652d1ee784a4c14d) > + > +Upstream-Status: Pending > + > +Signed-off-by: Michael Niedermayer > +Signed-off-by: Yue Tao > +--- > + libavcodec/h264.c | 2 +- > + 1 files changed, 1 insertions(+), 1 deletions(-) > + > +diff --git a/libavcodec/h264.c b/libavcodec/h264.c > +index da144db..0aab4e7 100644 > +--- a/gst-libs/ext/libav/libavcodec/h264.c > ++++ b/gst-libs/ext/libav/libavcodec/h264.c > +@@ -2351,7 +2351,7 @@ static int field_end(H264Context *h, int in_setup) > + * past end by one (callers fault) and resync_mb_y != 0 > + * causes problems for the first MB line, too. > + */ > +- if (!FIELD_PICTURE) > ++ if (!FIELD_PICTURE && h->current_slice && !h->sps.new) > + ff_er_frame_end(s); > + > + ff_MPV_frame_end(s); > +-- > +1.7.5.4 > + > diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb b/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb > index 3ccb7be..395054d 100644 > --- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb > +++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb > @@ -54,6 +54,7 @@ SRC_URI = "http://gstreamer.freedesktop.org/src/${BPN}/${BPN}-${PV}.tar.bz2 \ > file://0001-lavf-compute-probe-buffer-size-more-reliably.patch \ > file://0001-ffserver-set-oformat.patch \ > file://0001-h264-set-parameters-from-SPS-whenever-it-changes.patch \ > + file://0001-h264-skip-error-concealment-when-SPS-and-slices-are-.patch \ > ${@bb.utils.contains('PACKAGECONFIG', 'libav9', 'file://libav-9.patch', '', d)} \ > " >