diff options
Diffstat (limited to 'main/ffmpeg/CVE-2014-5272.patch')
| -rw-r--r-- | main/ffmpeg/CVE-2014-5272.patch | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/main/ffmpeg/CVE-2014-5272.patch b/main/ffmpeg/CVE-2014-5272.patch new file mode 100644 index 0000000000..e272e7ccd2 --- /dev/null +++ b/main/ffmpeg/CVE-2014-5272.patch @@ -0,0 +1,32 @@ +From 3539d6c63a16e1b2874bb037a86f317449c58770 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer <michaelni@gmx.at> +Date: Sun, 10 Aug 2014 21:59:33 +0200 +Subject: [PATCH] avcodec/iff: check pixfmt for rgb8 / rgbn + +Fixes out of array access + +Found-by: Piotr Bandurski <ami_stuff@o2.pl> +Signed-off-by: Michael Niedermayer <michaelni@gmx.at> +--- + libavcodec/iff.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/libavcodec/iff.c b/libavcodec/iff.c +index 00f5261..ce06b36 100644 +--- a/libavcodec/iff.c ++++ b/libavcodec/iff.c +@@ -849,9 +849,9 @@ static int decode_frame(AVCodecContext *avctx, + break; + case 4: + bytestream2_init(&gb, buf, buf_size); +- if (avctx->codec_tag == MKTAG('R', 'G', 'B', '8')) ++ if (avctx->codec_tag == MKTAG('R', 'G', 'B', '8') && avctx->pix_fmt == AV_PIX_FMT_RGB32) + decode_rgb8(&gb, s->frame->data[0], avctx->width, avctx->height, s->frame->linesize[0]); +- else if (avctx->codec_tag == MKTAG('R', 'G', 'B', 'N')) ++ else if (avctx->codec_tag == MKTAG('R', 'G', 'B', 'N') && avctx->pix_fmt == AV_PIX_FMT_RGB444) + decode_rgbn(&gb, s->frame->data[0], avctx->width, avctx->height, s->frame->linesize[0]); + else + return unsupported(avctx); +-- +1.7.10.4 + |