summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2020-22015.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2020-22015.patch')
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2020-22015.patch44
1 files changed, 0 insertions, 44 deletions
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2020-22015.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2020-22015.patch
deleted file mode 100644
index 5c911299cb..0000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2020-22015.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 4c1afa292520329eecd1cc7631bc59a8cca95c46 Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Sat, 29 May 2021 09:22:27 +0200
-Subject: [PATCH] avformat/movenc: Check pal_size before use
-
-Fixes: assertion failure
-Fixes: out of array read
-Fixes: Ticket8190
-Fixes: CVE-2020-22015
-
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-
-
-CVE: CVE-2020-22015
-Upstream-Status: Backport [4c1afa292520329eecd1cc7631bc59a8cca95c46]
-
-Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
----
- libavformat/movenc.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/libavformat/movenc.c b/libavformat/movenc.c
-index 2ab507df15..7d839f447b 100644
---- a/libavformat/movenc.c
-+++ b/libavformat/movenc.c
-@@ -2160,11 +2160,13 @@ static int mov_write_video_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContex
- avio_wb16(pb, 0x18); /* Reserved */
-
- if (track->mode == MODE_MOV && track->par->format == AV_PIX_FMT_PAL8) {
-- int pal_size = 1 << track->par->bits_per_coded_sample;
-- int i;
-+ int pal_size, i;
- avio_wb16(pb, 0); /* Color table ID */
- avio_wb32(pb, 0); /* Color table seed */
- avio_wb16(pb, 0x8000); /* Color table flags */
-+ if (track->par->bits_per_coded_sample < 0 || track->par->bits_per_coded_sample > 8)
-+ return AVERROR(EINVAL);
-+ pal_size = 1 << track->par->bits_per_coded_sample;
- avio_wb16(pb, pal_size - 1); /* Color table size (zero-relative) */
- for (i = 0; i < pal_size; i++) {
- uint32_t rgb = track->palette[i];
---
-2.32.0
-