File vlc-CVE-2019-13962.patch of Package vlc

Overview Repositories Revisions Requests Users Attributes Meta

File vlc-CVE-2019-13962.patch of Package vlc (Revision f727e41dd20d71ab1f1376c042b7a362)

Currently displaying revision f727e41dd20d71ab1f1376c042b7a362 , Show latest

From 2b4f9d0b0e0861f262c90e9b9b94e7d53b864509 Mon Sep 17 00:00:00 2001
From: Francois Cartegnie <fcvlcdev@free.fr>
Date: Mon, 20 May 2019 14:27:39 +0200
Subject: [PATCH] codec: avcodec: fix broken check before copy (fix #22240)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

copy parameters are the picture ones

regression by c988b8d58b01ef6d628e3051774a2032dd7f6b7d

(cherry picked from commit 603ecaf0f3fdf3b0a83cd2c773e05ac347b2149a)
Signed-off-by: Hugo BeauzÃ©e-Luyssen <hugo@beauzee.fr>
---
 modules/codec/avcodec/video.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/modules/codec/avcodec/video.c b/modules/codec/avcodec/video.c
index 097e7cb11a..c5899fd736 100644
--- a/modules/codec/avcodec/video.c
+++ b/modules/codec/avcodec/video.c
@@ -364,8 +364,9 @@ static int lavc_CopyPicture(decoder_t *dec, picture_t *pic, AVFrame *frame)
                 sys->p_context->pix_fmt, (name != NULL) ? name : "unknown");
         return VLC_EGENERIC;
     } else if (fourcc != pic->format.i_chroma
-     || frame->width > (int) pic->format.i_width
-     || frame->height > (int) pic->format.i_height)
+     /* ensure we never read more than dst lines/pixels from src */
+     || frame->width != (int) pic->format.i_visible_width
+     || frame->height < (int) pic->format.i_visible_height)
     {
         msg_Warn(dec, "dropping frame because the vout changed");
         return VLC_EGENERIC;
-- 
2.11.0

Places

File vlc-CVE-2019-13962.patch of Package vlc (Revision f727e41dd20d71ab1f1376c042b7a362)

Places