guix-play/gnu/packages/patches/libvpx-vp9-out-of-bounds-access.patch
Mark H Weaver 3b02429c8a gnu: libvpx: Apply bug fixes.
Fixes build on armhf.

* gnu/packages/patches/libvpx-fix-armhf-link.patch,
  gnu/packages/patches/libvpx-fix-ssse3-quantize.patch,
  gnu/packages/patches/libvpx-vp9-out-of-bounds-access.patch: New files.
* gnu-system.am (dist_patch_DATA): Add them.
* gnu/packages/video.scm (libvpx): Add patches.  On armhf, add additional
  configure flags to avoid requiring support for NEON.
2015-02-02 03:54:42 -05:00

36 lines
1005 B
Diff

Copied from Debian.
# HG changeset patch
# User Ralph Giles <giles@mozilla.com>
# Date 1412209683 25200
# Node ID 6023f0b4f8ba49dd117106cc98cd8007c2142bf6
# Parent 8c431dcec0ffde13988d47eacf341113ea883245
Bug 1063327 - Reject vp9 frames with invalid tiles. r=kinetik, a=abillings
diff --git a/vp9/decoder/vp9_decodframe.c b/vp9/decoder/vp9_decodframe.c
--- a/vp9/decoder/vp9_decodframe.c
+++ b/vp9/decoder/vp9_decodframe.c
@@ -863,16 +863,21 @@ static size_t get_tile(const uint8_t *co
if (!is_last) {
if (!read_is_valid(*data, 4, data_end))
vpx_internal_error(error_info, VPX_CODEC_CORRUPT_FRAME,
"Truncated packet or corrupt tile length");
size = read_be32(*data);
*data += 4;
+
+ if (size > data_end - *data) {
+ vpx_internal_error(error_info, VPX_CODEC_CORRUPT_FRAME,
+ "Truncated packet or corrupt tile size");
+ }
} else {
size = data_end - *data;
}
return size;
}
typedef struct TileBuffer {
const uint8_t *data;