unofficial mirror of guix-devel@gnu.org 
 help / color / mirror / code / Atom feed
blob bef3448b819b1fde34f478111fcb8d2bee6947fd 1677 bytes (raw)
name: patches/libvpx-CVE-2016-2818.patch 	 # note: path name is non-authoritative(*)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
Patch contents copied from Mozilla esr45 changeset 312077:7ebfe49f001c

  changeset:   312077:7ebfe49f001c
  user:        Randell Jesup <rjesup@jesup.org>
  Date:        Fri Apr 15 23:11:01 2016 -0400
  summary:     Bug 1263384: validate input frames against configured resolution in vp8 r=rillian, a=ritu,lizzard

  MozReview-Commit-ID: BxDCnJe0mzs

--- libvpx-1.5.0/vp8/vp8_cx_iface.c.orig	2015-11-09 17:12:38.000000000 -0500
+++ libvpx-1.5.0/vp8/vp8_cx_iface.c	2016-06-08 08:48:46.037213092 -0400
@@ -860,11 +860,20 @@
     if (img != NULL) {
       res = image2yuvconfig(img, &sd);
 
-      if (vp8_receive_raw_frame(ctx->cpi, ctx->next_frame_flag | lib_flags, &sd,
-                                dst_time_stamp, dst_end_time_stamp)) {
-        VP8_COMP *cpi = (VP8_COMP *)ctx->cpi;
-        res = update_error_state(ctx, &cpi->common.error);
-      }
+            if (sd.y_width != ctx->cfg.g_w || sd.y_height != ctx->cfg.g_h) {
+                /* from vp8_encoder.h for g_w/g_h:
+                   "Note that the frames passed as input to the encoder must have this resolution"
+                */
+                ctx->base.err_detail = "Invalid input frame resolution";
+                res = VPX_CODEC_INVALID_PARAM;
+            } else {
+                if (vp8_receive_raw_frame(ctx->cpi, ctx->next_frame_flag | lib_flags,
+                                          &sd, dst_time_stamp, dst_end_time_stamp))
+                {
+                    VP8_COMP *cpi = (VP8_COMP *)ctx->cpi;
+                    res = update_error_state(ctx, &cpi->common.error);
+                }
+            }
 
       /* reset for next frame */
       ctx->next_frame_flag = 0;

debug log:

solving bef3448b819b1fde34f478111fcb8d2bee6947fd ...
found bef3448b819b1fde34f478111fcb8d2bee6947fd in https://git.savannah.gnu.org/cgit/guix.git

(*) Git path names are given by the tree(s) the blob belongs to.
    Blobs themselves have no identifier aside from the hash of its contents.^

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).