pkgsrc/multimedia/mplayer-share/patches/patch-bb
drochner 80ba1e8793 add some patches from upstream which fix CVE-2008-0485, CVE-2008-0486
and two unnamed buffer overflows, bump PKGREVISION of affected pkgs
2008-02-05 17:00:35 +00:00

47 lines
1.5 KiB
Text

$NetBSD: patch-bb,v 1.7 2008/02/05 17:00:36 drochner Exp $
--- libmpdemux/demux_mov.c.orig 2007-10-07 21:49:33.000000000 +0200
+++ libmpdemux/demux_mov.c
@@ -173,11 +173,12 @@ void mov_build_index(mov_track_t* trak,i
i=trak->chunkmap_size;
while(i>0){
--i;
- for(j=trak->chunkmap[i].first;j<last;j++){
+ j=FFMAX(trak->chunkmap[i].first, 0);
+ for(;j<last;j++){
trak->chunks[j].desc=trak->chunkmap[i].sdid;
trak->chunks[j].size=trak->chunkmap[i].spc;
}
- last=trak->chunkmap[i].first;
+ last=FFMIN(trak->chunkmap[i].first, trak->chunks_size);
}
#if 0
@@ -235,6 +236,8 @@ void mov_build_index(mov_track_t* trak,i
s=0;
for(j=0;j<trak->durmap_size;j++){
for(i=0;i<trak->durmap[j].num;i++){
+ if (s >= trak->samples_size)
+ break;
trak->samples[s].pts=pts;
++s;
pts+=trak->durmap[j].dur;
@@ -246,6 +249,8 @@ void mov_build_index(mov_track_t* trak,i
for(j=0;j<trak->chunks_size;j++){
off_t pos=trak->chunks[j].pos;
for(i=0;i<trak->chunks[j].size;i++){
+ if (s >= trak->samples_size)
+ break;
trak->samples[s].pos=pos;
mp_msg(MSGT_DEMUX, MSGL_DBG3, "Sample %5d: pts=%8d off=0x%08X size=%d\n",s,
trak->samples[s].pts,
@@ -1568,8 +1573,7 @@ static void lschunks(demuxer_t* demuxer,
if( udta_len>udta_size)
udta_len=udta_size;
{
- char dump[udta_len-4];
- stream_read(demuxer->stream, (char *)&dump, udta_len-4-4);
+ stream_skip(demuxer->stream, udta_len-4-4);
udta_size -= udta_len;
}
}