diff options
| author | A. Wilcox <awilcox@wilcox-tech.com> | 2020-05-10 00:53:07 +0000 |
|---|---|---|
| committer | A. Wilcox <awilcox@wilcox-tech.com> | 2020-05-10 00:53:07 +0000 |
| commit | 37d91537b3ba473dcbe29bef26a458c1f27ec8b1 (patch) | |
| tree | fcee5cee9b7e90f77583879ed500e6c7c9b06edb /user/ffmpeg/CVE-2020-12284.patch | |
| parent | 2196072f13ded27b9579b329e84e3572998579ef (diff) | |
| parent | 37f871df2a0ce73cbda11caba1dc63c8118b14fb (diff) | |
| download | packages-37d91537b3ba473dcbe29bef26a458c1f27ec8b1.tar.gz packages-37d91537b3ba473dcbe29bef26a458c1f27ec8b1.tar.bz2 packages-37d91537b3ba473dcbe29bef26a458c1f27ec8b1.tar.xz packages-37d91537b3ba473dcbe29bef26a458c1f27ec8b1.zip | |
Merge branch 'sec/2020.05.05' into 'master'
Security updates for 2020.05.05
See merge request adelie/packages!446
Diffstat (limited to 'user/ffmpeg/CVE-2020-12284.patch')
| -rw-r--r-- | user/ffmpeg/CVE-2020-12284.patch | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/user/ffmpeg/CVE-2020-12284.patch b/user/ffmpeg/CVE-2020-12284.patch new file mode 100644 index 000000000..7360b5870 --- /dev/null +++ b/user/ffmpeg/CVE-2020-12284.patch @@ -0,0 +1,32 @@ +From 1812352d767ccf5431aa440123e2e260a4db2726 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer <michael@niedermayer.cc> +Date: Sat, 7 Mar 2020 15:42:58 +0100 +Subject: [PATCH] avcodec/cbs_jpeg: Check length for SOS + +Fixes: out of array access +Fixes: 19734/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5673507031875584 +Fixes: 19353/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5703944462663680 + +Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg +Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> +--- + libavcodec/cbs_jpeg.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/libavcodec/cbs_jpeg.c b/libavcodec/cbs_jpeg.c +index 6bbce5f..89512a2 100644 +--- a/libavcodec/cbs_jpeg.c ++++ b/libavcodec/cbs_jpeg.c +@@ -197,6 +197,9 @@ static int cbs_jpeg_split_fragment(CodedBitstreamContext *ctx, + if (marker == JPEG_MARKER_SOS) { + length = AV_RB16(frag->data + start); + ++ if (length > end - start) ++ return AVERROR_INVALIDDATA; ++ + data_ref = NULL; + data = av_malloc(end - start + + AV_INPUT_BUFFER_PADDING_SIZE); +-- +2.7.4 + |