diff options
| author | Leo <thinkabit.ukim@gmail.com> | 2019-07-29 08:26:02 -0300 |
|---|---|---|
| committer | Leo <thinkabit.ukim@gmail.com> | 2019-07-29 12:04:55 -0300 |
| commit | 686d2c8ff9d0c366e038254dc3fe3ad3e1fc88f9 (patch) | |
| tree | d94d1542a99d677159abbc46da8c107872414054 /community/vlc | |
| parent | 349bff0f7a1f1816f88cad8613a1667459c5cebd (diff) | |
| download | aports-686d2c8ff9d0c366e038254dc3fe3ad3e1fc88f9.tar.bz2 aports-686d2c8ff9d0c366e038254dc3fe3ad3e1fc88f9.tar.xz | |
community/vlc: fix CVE-2019-13602
ref #10698
Diffstat (limited to 'community/vlc')
| -rw-r--r-- | community/vlc/APKBUILD | 10 | ||||
| -rw-r--r-- | community/vlc/CVE-2019-13602.patch | 38 |
2 files changed, 46 insertions, 2 deletions
diff --git a/community/vlc/APKBUILD b/community/vlc/APKBUILD index 648bf9cf9c..120e267e36 100644 --- a/community/vlc/APKBUILD +++ b/community/vlc/APKBUILD @@ -3,7 +3,7 @@ # Maintainer: Natanael Copa <ncopa@alpinelinux.org> pkgname=vlc pkgver=3.0.7.1 -pkgrel=1 +pkgrel=2 pkgdesc="A multi-platform MPEG, VCD/DVD, and DivX player" triggers="vlc-libs.trigger=/usr/lib/vlc/plugins" pkgusers="vlc" @@ -119,8 +119,13 @@ source="https://get.videolan.org/vlc/$pkgver/$pkgname-$pkgver.tar.xz disable-sub-autodetect-fuzzy-1-test.patch test-s390x.patch fribidi_allow_deprecated.patch + CVE-2019-13602.patch " +# secfixes: +# 3.0.7.1-r2: +# - CVE-2019-13602 + prepare() { default_prepare NOCONFIGURE=1 ./bootstrap @@ -327,4 +332,5 @@ e13e398b7bfd977f6e099bcb6cf8dc5cd5bad6dea3eff715881826246dc4329468846084aff2576d 22d80df599b8b65a5439cefbb7140af8e9530f326d54945da3769af65f37518b99ec2cc8647aafd2763324a0698280915afe043cc87e5720c4694881ed35bffa check-headless.patch e214b407235cb3afb8bec93f20c9b42957b57e6fd3960679d3d4235e77762e03e64d03c01f00ef63d589e7c85aaad02ce6abbeeccd66b1867bc92451a5b5e9b0 disable-sub-autodetect-fuzzy-1-test.patch c0107655249687655846a9547ca1a5670b9207443180600e7a149c69ffb96d7226787c19b018d4033db9b284c1a5faa8d7d42188ed40c3b8bb051256febf11c5 test-s390x.patch -8230a83306905cdda07fecdb6cb2b791196034775cc5c8986ab63e97cd3476317544011cbce92948059ac9f7b57ef450cd71820f0f134bc3ab3bed38463a67c3 fribidi_allow_deprecated.patch" +8230a83306905cdda07fecdb6cb2b791196034775cc5c8986ab63e97cd3476317544011cbce92948059ac9f7b57ef450cd71820f0f134bc3ab3bed38463a67c3 fribidi_allow_deprecated.patch +40dd07023f7ebc769d4aa3f03b8d4b0cb3e98fd2548564ff3e891c717d798ab07a9a772e10db8378e6ca9265a2ec04bb6c516394803a6ae2d2f523ee5fea8f9e CVE-2019-13602.patch" diff --git a/community/vlc/CVE-2019-13602.patch b/community/vlc/CVE-2019-13602.patch new file mode 100644 index 0000000000..5c2b050be7 --- /dev/null +++ b/community/vlc/CVE-2019-13602.patch @@ -0,0 +1,38 @@ +diff --git a/modules/demux/mp4/mp4.c b/modules/demux/mp4/mp4.c +index edda423..b2e3863 100644 +--- a/modules/demux/mp4/mp4.c ++++ b/modules/demux/mp4/mp4.c +@@ -421,11 +421,11 @@ static block_t * MP4_EIA608_Convert( block_t * p_block ) + block_t *p_newblock; + + /* always need at least 10 bytes (atom size+header+1pair)*/ +- if ( i_remaining < 10 || +- !(i_bytes = GetDWBE(p_block->p_buffer)) || +- (i_bytes > i_remaining) || +- memcmp("cdat", &p_block->p_buffer[4], 4) || +- !(p_newblock = block_Alloc( i_remaining * 3 - 8 )) ) ++ i_bytes = GetDWBE(p_block->p_buffer); ++ ++ if (10 < i_bytes || i_bytes < i_remaining || ++ memcmp("cdat", &p_block->p_buffer[4], 4) || ++ (p_newblock = block_Alloc(i_remaining * 3 - 8)) == NULL) + { + p_block->i_buffer = 0; + return p_block; +@@ -447,10 +447,11 @@ static block_t * MP4_EIA608_Convert( block_t * p_block ) + } while( i_bytes >= 2 ); + + /* cdt2 is optional */ +- if ( i_remaining >= 10 && +- (i_bytes = GetDWBE(p_read)) && +- (i_bytes <= i_remaining) && +- !memcmp("cdt2", &p_read[4], 4) ) ++ i_bytes = GetDWBE(p_block->p_buffer); ++ ++ if (10 < i_bytes || i_bytes < i_remaining || ++ memcmp("cdat", &p_block->p_buffer[4], 4) || ++ (p_newblock = block_Alloc(i_remaining * 3 - 8)) == NULL) + { + p_read += 8; + i_bytes -= 8; + |