Squashed 'import-layers/meta-openembedded/' content from commit 247b126
Change-Id: I40827e9ce5fba63f1cca2a0be44976ae8383b4c0
git-subtree-dir: import-layers/meta-openembedded
git-subtree-split: 247b1267bbe95719cd4877d2d3cfbaf2a2f4865a
Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
diff --git a/import-layers/meta-openembedded/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-CVE-2013-0855.patch b/import-layers/meta-openembedded/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-CVE-2013-0855.patch
new file mode 100644
index 0000000..3c8d8e3
--- /dev/null
+++ b/import-layers/meta-openembedded/meta-multimedia/recipes-multimedia/gstreamer-0.10/gst-ffmpeg-0.10.13/gst-ffmpeg-CVE-2013-0855.patch
@@ -0,0 +1,100 @@
+gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-0855
+
+Upstream-Status: Backport
+
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+
+diff --git a/gst-libs/ext/libav/libavcodec/alac.c.old b/gst-libs/ext/libav/libavcodec/alac.c
+index 2a0df8c..bcbd56d 100644
+--- a/gst-libs/ext/libav/libavcodec/alac.c.old
++++ b/gst-libs/ext/libav/libavcodec/alac.c
+@@ -87,18 +87,44 @@ typedef struct {
+ int wasted_bits;
+ } ALACContext;
+
+-static void allocate_buffers(ALACContext *alac)
++static av_cold int alac_decode_close(AVCodecContext *avctx)
++{
++ ALACContext *alac = avctx->priv_data;
++
++ int chan;
++ for (chan = 0; chan < MAX_CHANNELS; chan++) {
++ av_freep(&alac->predicterror_buffer[chan]);
++ av_freep(&alac->outputsamples_buffer[chan]);
++ av_freep(&alac->wasted_bits_buffer[chan]);
++ }
++
++ return 0;
++}
++
++static int allocate_buffers(ALACContext *alac)
+ {
+ int chan;
++ int buf_size;
++
++ if (alac->setinfo_max_samples_per_frame > INT_MAX / sizeof(int32_t))
++ goto buf_alloc_fail;
++ buf_size = alac->setinfo_max_samples_per_frame * sizeof(int32_t);
++
+ for (chan = 0; chan < MAX_CHANNELS; chan++) {
+- alac->predicterror_buffer[chan] =
+- av_malloc(alac->setinfo_max_samples_per_frame * 4);
+
+- alac->outputsamples_buffer[chan] =
+- av_malloc(alac->setinfo_max_samples_per_frame * 4);
++ FF_ALLOC_OR_GOTO(alac->avctx, alac->predicterror_buffer[chan],
++ buf_size, buf_alloc_fail);
+
+- alac->wasted_bits_buffer[chan] = av_malloc(alac->setinfo_max_samples_per_frame * 4);
++ FF_ALLOC_OR_GOTO(alac->avctx, alac->outputsamples_buffer[chan],
++ buf_size, buf_alloc_fail);
++
++ FF_ALLOC_OR_GOTO(alac->avctx, alac->wasted_bits_buffer[chan],
++ buf_size, buf_alloc_fail);
+ }
++ return 0;
++buf_alloc_fail:
++ alac_decode_close(alac->avctx);
++ return AVERROR(ENOMEM);
+ }
+
+ static int alac_set_info(ALACContext *alac)
+@@ -131,8 +157,6 @@ static int alac_set_info(ALACContext *alac)
+ bytestream_get_be32(&ptr); /* bitrate ? */
+ bytestream_get_be32(&ptr); /* samplerate */
+
+- allocate_buffers(alac);
+-
+ return 0;
+ }
+
+@@ -659,6 +683,7 @@ static int alac_decode_frame(AVCodecContext *avctx,
+
+ static av_cold int alac_decode_init(AVCodecContext * avctx)
+ {
++ int ret;
+ ALACContext *alac = avctx->priv_data;
+ alac->avctx = avctx;
+ alac->numchannels = alac->avctx->channels;
+@@ -674,18 +699,9 @@ static av_cold int alac_decode_init(AVCodecContext * avctx)
+ return -1;
+ }
+
+- return 0;
+-}
+-
+-static av_cold int alac_decode_close(AVCodecContext *avctx)
+-{
+- ALACContext *alac = avctx->priv_data;
+-
+- int chan;
+- for (chan = 0; chan < MAX_CHANNELS; chan++) {
+- av_freep(&alac->predicterror_buffer[chan]);
+- av_freep(&alac->outputsamples_buffer[chan]);
+- av_freep(&alac->wasted_bits_buffer[chan]);
++ if ((ret = allocate_buffers(alac)) < 0) {
++ av_log(avctx, AV_LOG_ERROR, "Error allocating buffers\n");
++ return ret;
+ }
+
+ return 0;