* [PATCH 0/4] Upgrade packages and some CVEs fix for gst-ffmpeg
@ 2015-05-19 1:08 Kai Kang
2015-05-19 1:08 ` [PATCH 1/4] vala: upgrade to version 0.28.0 Kai Kang
` (3 more replies)
0 siblings, 4 replies; 8+ messages in thread
From: Kai Kang @ 2015-05-19 1:08 UTC (permalink / raw)
To: openembedded-core
The following changes since commit bc162d21dd148252efcf3ed771e04c791ef4d869:
bitbake: tests/parse: Add file missing from previous commit (2015-05-16 22:40:44 +0100)
are available in the git repository at:
git://git.yoctoproject.org/poky-contrib kangkai/uprade-pkgs-may19
http://git.yoctoproject.org/cgit.cgi//log/?h=kangkai/uprade-pkgs-may19
Kai Kang (4):
vala: upgrade to version 0.28.0
alsa-tools: upgrade to version 1.0.29
alsa-utils: upgrade to 1.0.29
gst-ffmpeg: fix CVEs
.../vala/{vala_0.26.1.bb => vala_0.28.0.bb} | 4 +--
.../alsa/alsa-tools/autotools.patch | 4 +--
.../alsa/alsa-tools/gitcompile_hdajacksensetest | 13 +++++++
.../{alsa-tools_1.0.28.bb => alsa-tools_1.0.29.bb} | 10 ++++--
...conf_1.0.28.bb => alsa-utils-scripts_1.0.29.bb} | 8 +++--
.../{alsa-utils_1.0.28.bb => alsa-utils_1.0.29.bb} | 9 +++--
.../gst-ffmpeg-fix-CVE-2014-7933.patch | 38 ++++++++++++++++++++
.../gst-ffmpeg-fix-CVE-2014-9318.patch | 37 +++++++++++++++++++
.../gst-ffmpeg-fix-CVE-2014-9603.patch | 41 ++++++++++++++++++++++
.../gstreamer/gst-ffmpeg_0.10.13.bb | 3 ++
10 files changed, 153 insertions(+), 14 deletions(-)
rename meta/recipes-devtools/vala/{vala_0.26.1.bb => vala_0.28.0.bb} (42%)
create mode 100755 meta/recipes-multimedia/alsa/alsa-tools/gitcompile_hdajacksensetest
rename meta/recipes-multimedia/alsa/{alsa-tools_1.0.28.bb => alsa-tools_1.0.29.bb} (82%)
rename meta/recipes-multimedia/alsa/{alsa-utils-alsaconf_1.0.28.bb => alsa-utils-scripts_1.0.29.bb} (49%)
rename meta/recipes-multimedia/alsa/{alsa-utils_1.0.28.bb => alsa-utils_1.0.29.bb} (95%)
create mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-7933.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-9318.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-9603.patch
--
1.9.1
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH 1/4] vala: upgrade to version 0.28.0
2015-05-19 1:08 [PATCH 0/4] Upgrade packages and some CVEs fix for gst-ffmpeg Kai Kang
@ 2015-05-19 1:08 ` Kai Kang
2015-05-19 1:08 ` [PATCH 2/4] alsa-tools: upgrade to version 1.0.29 Kai Kang
` (2 subsequent siblings)
3 siblings, 0 replies; 8+ messages in thread
From: Kai Kang @ 2015-05-19 1:08 UTC (permalink / raw)
To: openembedded-core
Upgrade vala from version 0.26.1 to 0.28.0.
Signed-off-by: Kai Kang <kai.kang@windriver.com>
---
meta/recipes-devtools/vala/{vala_0.26.1.bb => vala_0.28.0.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-devtools/vala/{vala_0.26.1.bb => vala_0.28.0.bb} (42%)
diff --git a/meta/recipes-devtools/vala/vala_0.26.1.bb b/meta/recipes-devtools/vala/vala_0.28.0.bb
similarity index 42%
rename from meta/recipes-devtools/vala/vala_0.26.1.bb
rename to meta/recipes-devtools/vala/vala_0.28.0.bb
index 3df9cd4..120906c 100644
--- a/meta/recipes-devtools/vala/vala_0.26.1.bb
+++ b/meta/recipes-devtools/vala/vala_0.28.0.bb
@@ -2,5 +2,5 @@ require ${BPN}.inc
SRC_URI += " file://0001-git-version-gen-don-t-append-dirty-if-we-re-not-in-g.patch"
-SRC_URI[md5sum] = "723a03b822d4cc47abc4019685970a3e"
-SRC_URI[sha256sum] = "8407abb19ab3a58bbfc0d288abb47666ef81f76d0540258c03965e7545f59e6b"
+SRC_URI[md5sum] = "8d4ceac3451a0d5497e7be38e5e4c2ad"
+SRC_URI[sha256sum] = "0d9e3bd3f82145664875f7c29b2f544ba92d2814f75412948f774c0727fc977f"
--
1.9.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 2/4] alsa-tools: upgrade to version 1.0.29
2015-05-19 1:08 [PATCH 0/4] Upgrade packages and some CVEs fix for gst-ffmpeg Kai Kang
2015-05-19 1:08 ` [PATCH 1/4] vala: upgrade to version 0.28.0 Kai Kang
@ 2015-05-19 1:08 ` Kai Kang
2015-05-27 12:06 ` Otavio Salvador
2015-05-19 1:08 ` [PATCH 3/4] alsa-utils: upgrade to 1.0.29 Kai Kang
2015-05-19 1:08 ` [PATCH 4/4] gst-ffmpeg: fix CVEs Kai Kang
3 siblings, 1 reply; 8+ messages in thread
From: Kai Kang @ 2015-05-19 1:08 UTC (permalink / raw)
To: openembedded-core
Upgrade alsa-tools from verion 1.0.28 to 1.0.29.
* update autotools.patch
* add file gitcompile which exists in git repo but missing in release
tar ball for sub-directory hdajacksensetest
Signed-off-by: Kai Kang <kai.kang@windriver.com>
---
meta/recipes-multimedia/alsa/alsa-tools/autotools.patch | 4 ++--
.../alsa/alsa-tools/gitcompile_hdajacksensetest | 13 +++++++++++++
.../alsa/{alsa-tools_1.0.28.bb => alsa-tools_1.0.29.bb} | 10 +++++++---
3 files changed, 22 insertions(+), 5 deletions(-)
create mode 100755 meta/recipes-multimedia/alsa/alsa-tools/gitcompile_hdajacksensetest
rename meta/recipes-multimedia/alsa/{alsa-tools_1.0.28.bb => alsa-tools_1.0.29.bb} (82%)
diff --git a/meta/recipes-multimedia/alsa/alsa-tools/autotools.patch b/meta/recipes-multimedia/alsa/alsa-tools/autotools.patch
index 5aec84c..59391d6 100644
--- a/meta/recipes-multimedia/alsa/alsa-tools/autotools.patch
+++ b/meta/recipes-multimedia/alsa/alsa-tools/autotools.patch
@@ -20,13 +20,13 @@ diff -ruN alsa-tools-1.0.24.1-orig//Makefile alsa-tools-1.0.24.1/Makefile
--- alsa-tools-1.0.24.1-orig//Makefile 2011-07-06 11:27:40.207665000 +0800
+++ alsa-tools-1.0.24.1/Makefile 2011-07-14 15:08:08.877665009 +0800
@@ -1,8 +1,8 @@
- VERSION = 1.0.27
+ VERSION = 1.0.29
TOP = .
-SUBDIRS = as10k1 envy24control hdsploader hdspconf hdspmixer \
+SUBDIRS = as10k1 envy24control \
mixartloader pcxhrloader rmedigicontrol sb16_csp seq sscape_ctl \
- us428control usx2yloader vxloader echomixer ld10k1 qlo10k1 \
+ us428control usx2yloader vxloader echomixer \
- hwmixvolume hdajackretask hda-verb
+ hwmixvolume hdajackretask hda-verb hdajacksensetest
all:
diff --git a/meta/recipes-multimedia/alsa/alsa-tools/gitcompile_hdajacksensetest b/meta/recipes-multimedia/alsa/alsa-tools/gitcompile_hdajacksensetest
new file mode 100755
index 0000000..58328bd
--- /dev/null
+++ b/meta/recipes-multimedia/alsa/alsa-tools/gitcompile_hdajacksensetest
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+aclocal $ACLOCAL_FLAGS || exit 1
+automake --foreign --add-missing || exit 1
+autoconf || exit 1
+export CFLAGS='-O2 -Wall -pipe -g'
+echo "CFLAGS=$CFLAGS"
+echo "./configure $@"
+./configure $@ || exit 1
+unset CFLAGS
+if [ -z "$GITCOMPILE_NO_MAKE" ]; then
+ make || exit 1
+fi
diff --git a/meta/recipes-multimedia/alsa/alsa-tools_1.0.28.bb b/meta/recipes-multimedia/alsa/alsa-tools_1.0.29.bb
similarity index 82%
rename from meta/recipes-multimedia/alsa/alsa-tools_1.0.28.bb
rename to meta/recipes-multimedia/alsa/alsa-tools_1.0.29.bb
index d684225..9133012 100644
--- a/meta/recipes-multimedia/alsa/alsa-tools_1.0.28.bb
+++ b/meta/recipes-multimedia/alsa/alsa-tools_1.0.29.bb
@@ -11,10 +11,12 @@ LIC_FILES_CHKSUM = "file://hdsploader/COPYING;md5=94d55d512a9ba36caa9b7df079bae1
SRC_URI = "ftp://ftp.alsa-project.org/pub/tools/${BP}.tar.bz2 \
file://autotools.patch \
${@bb.utils.contains('DISTRO_FEATURES', 'x11', '', \
- 'file://makefile_no_gtk.patch', d)}"
+ 'file://makefile_no_gtk.patch', d)} \
+ file://gitcompile_hdajacksensetest \
+ "
-SRC_URI[md5sum] = "e6c929175d8ee729c06d49b51439bad6"
-SRC_URI[sha256sum] = "76e59711c6d0f39cbddce83ce1ed8da00bad112fee021f94fa990d8685cc3761"
+SRC_URI[md5sum] = "f339a3cd24f748c9d007bdff0e98775b"
+SRC_URI[sha256sum] = "94abf0ab5a73f0710c70d4fb3dc1003af5bae2d2ed721d59d245b41ad0f2fbd1"
inherit autotools-brokensep pkgconfig
@@ -32,6 +34,8 @@ do_compile_prepend () {
#Automake dir is not correctly detected in cross compilation case
export AUTOMAKE_DIR="$(automake --print-libdir)"
export ACLOCAL_FLAGS="--system-acdir=${ACLOCALDIR}/"
+
+ cp ${WORKDIR}/gitcompile_hdajacksensetest ${S}/hdajacksensetest/gitcompile
}
FILES_${PN} += "${datadir}/ld10k1"
--
1.9.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 3/4] alsa-utils: upgrade to 1.0.29
2015-05-19 1:08 [PATCH 0/4] Upgrade packages and some CVEs fix for gst-ffmpeg Kai Kang
2015-05-19 1:08 ` [PATCH 1/4] vala: upgrade to version 0.28.0 Kai Kang
2015-05-19 1:08 ` [PATCH 2/4] alsa-tools: upgrade to version 1.0.29 Kai Kang
@ 2015-05-19 1:08 ` Kai Kang
2015-05-19 1:08 ` [PATCH 4/4] gst-ffmpeg: fix CVEs Kai Kang
3 siblings, 0 replies; 8+ messages in thread
From: Kai Kang @ 2015-05-19 1:08 UTC (permalink / raw)
To: openembedded-core
Upgrade alsa-utils from 1.0.28 to 1.0.29.
* remove PR
* rename package alsa-utils-alsaconf to alsa-utils-scripts, and add
script alsa-info.sh
Signed-off-by: Kai Kang <kai.kang@windriver.com>
---
...lsa-utils-alsaconf_1.0.28.bb => alsa-utils-scripts_1.0.29.bb} | 8 ++++++--
.../alsa/{alsa-utils_1.0.28.bb => alsa-utils_1.0.29.bb} | 9 ++++-----
2 files changed, 10 insertions(+), 7 deletions(-)
rename meta/recipes-multimedia/alsa/{alsa-utils-alsaconf_1.0.28.bb => alsa-utils-scripts_1.0.29.bb} (49%)
rename meta/recipes-multimedia/alsa/{alsa-utils_1.0.28.bb => alsa-utils_1.0.29.bb} (95%)
diff --git a/meta/recipes-multimedia/alsa/alsa-utils-alsaconf_1.0.28.bb b/meta/recipes-multimedia/alsa/alsa-utils-scripts_1.0.29.bb
similarity index 49%
rename from meta/recipes-multimedia/alsa/alsa-utils-alsaconf_1.0.28.bb
rename to meta/recipes-multimedia/alsa/alsa-utils-scripts_1.0.29.bb
index 2d49cc5..a98f9b9 100644
--- a/meta/recipes-multimedia/alsa/alsa-utils-alsaconf_1.0.28.bb
+++ b/meta/recipes-multimedia/alsa/alsa-utils-scripts_1.0.29.bb
@@ -1,17 +1,21 @@
require alsa-utils_${PV}.bb
-SUMMARY = "Shell script that creates ALSA configuration files"
+SUMMARY = "Shell scripts that show help info and create ALSA configuration files"
+PROVIDES = "alsa-utils-alsaconf"
FILESEXTRAPATHS_prepend := "${THISDIR}/alsa-utils:"
PACKAGES = "${PN}"
RDEPENDS_${PN} += "bash"
-FILES_${PN} = "${sbindir}/alsaconf"
+FILES_${PN} = "${sbindir}/alsaconf \
+ ${sbindir}/alsa-info.sh \
+ "
S = "${WORKDIR}/alsa-utils-${PV}"
do_install() {
install -d ${D}${sbindir}
install -m 0755 ${B}/alsaconf/alsaconf ${D}${sbindir}/
+ install -m 0755 ${S}/alsa-info/alsa-info.sh ${D}${sbindir}/
}
diff --git a/meta/recipes-multimedia/alsa/alsa-utils_1.0.28.bb b/meta/recipes-multimedia/alsa/alsa-utils_1.0.29.bb
similarity index 95%
rename from meta/recipes-multimedia/alsa/alsa-utils_1.0.28.bb
rename to meta/recipes-multimedia/alsa/alsa-utils_1.0.29.bb
index 506698e..65cae0b 100644
--- a/meta/recipes-multimedia/alsa/alsa-utils_1.0.28.bb
+++ b/meta/recipes-multimedia/alsa/alsa-utils_1.0.29.bb
@@ -16,8 +16,8 @@ SRC_URI = "ftp://ftp.alsa-project.org/pub/utils/alsa-utils-${PV}.tar.bz2 \
file://alsa-utils-aplay-interrupt-signal-handling.patch \
"
-SRC_URI[md5sum] = "361552d5b1cacd0a1e7ba09e69990211"
-SRC_URI[sha256sum] = "f3ff4c89b0125a7797b1b13cd094cc92276e655458274967386e812d03642acc"
+SRC_URI[md5sum] = "6b289bf874c4c9a63f4b3973093dd404"
+SRC_URI[sha256sum] = "5160058f3e14483ced5de919dd473f93932059454530a9b7ef97dcabd6833e9b"
# lazy hack. needs proper fixing in gettext.m4, see
# http://bugs.openembedded.org/show_bug.cgi?id=2348
@@ -25,8 +25,6 @@ SRC_URI[sha256sum] = "f3ff4c89b0125a7797b1b13cd094cc92276e655458274967386e812d03
#
EXTRA_OECONF_append_libc-uclibc = " --disable-nls"
-PR = "r1"
-
inherit autotools gettext pkgconfig
# This are all packages that we need to make. Also, the now empty alsa-utils
@@ -86,8 +84,9 @@ do_install() {
autotools_do_install
# We don't ship this here because it requires a dependency on bash.
- # See alsa-utils-alsaconf_${PV}.bb
+ # See alsa-utils-scripts_${PV}.bb
rm ${D}${sbindir}/alsaconf
+ rm ${D}${sbindir}/alsa-info.sh
if ${@bb.utils.contains('PACKAGECONFIG', 'udev', 'false', 'true', d)}; then
# This is where alsa-utils will install its rules if we don't tell it anything else.
--
1.9.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 4/4] gst-ffmpeg: fix CVEs
2015-05-19 1:08 [PATCH 0/4] Upgrade packages and some CVEs fix for gst-ffmpeg Kai Kang
` (2 preceding siblings ...)
2015-05-19 1:08 ` [PATCH 3/4] alsa-utils: upgrade to 1.0.29 Kai Kang
@ 2015-05-19 1:08 ` Kai Kang
2015-05-19 13:03 ` Alexander Kanavin
3 siblings, 1 reply; 8+ messages in thread
From: Kai Kang @ 2015-05-19 1:08 UTC (permalink / raw)
To: openembedded-core
Backport patches to fix CVEs: CVE-2014-7933, CVE-2014-9318 and
CVE-2014-9603.
Signed-off-by: Kai Kang <kai.kang@windriver.com>
---
.../gst-ffmpeg-fix-CVE-2014-7933.patch | 38 ++++++++++++++++++++
.../gst-ffmpeg-fix-CVE-2014-9318.patch | 37 +++++++++++++++++++
.../gst-ffmpeg-fix-CVE-2014-9603.patch | 41 ++++++++++++++++++++++
.../gstreamer/gst-ffmpeg_0.10.13.bb | 3 ++
4 files changed, 119 insertions(+)
create mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-7933.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-9318.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-9603.patch
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-7933.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-7933.patch
new file mode 100644
index 0000000..3c537c7
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-7933.patch
@@ -0,0 +1,38 @@
+From 2266b8bc3370856d874334ba62b337ce4f1eb255 Mon Sep 17 00:00:00 2001
+From: Kai Kang <kai.kang@windriver.com>
+Date: Wed, 13 May 2015 16:46:06 +0800
+Subject: [PATCH 2/2] gst-ffmpeg: fix CVE-2014-7933
+
+Upstream-Status: Backport
+
+http://git.videolan.org/?p=ffmpeg.git;a=commit;h=33301f00
+
+Signed-off-by: Kai Kang <kai.kang@windriver.com>
+---
+ gst-libs/ext/libav/libavformat/matroskadec.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/gst-libs/ext/libav/libavformat/matroskadec.c b/gst-libs/ext/libav/libavformat/matroskadec.c
+index 59dce4f..e5f5fc1 100644
+--- a/gst-libs/ext/libav/libavformat/matroskadec.c
++++ b/gst-libs/ext/libav/libavformat/matroskadec.c
+@@ -1916,7 +1916,7 @@ static int matroska_read_seek(AVFormatContext *s, int stream_index,
+ int64_t timestamp, int flags)
+ {
+ MatroskaDemuxContext *matroska = s->priv_data;
+- MatroskaTrack *tracks = matroska->tracks.elem;
++ MatroskaTrack *tracks = NULL;
+ AVStream *st = s->streams[stream_index];
+ int i, index, index_sub, index_min;
+
+@@ -1939,6 +1939,7 @@ static int matroska_read_seek(AVFormatContext *s, int stream_index,
+ return 0;
+
+ index_min = index;
++ tracks = matroska->tracks.elem;
+ for (i=0; i < matroska->tracks.nb_elem; i++) {
+ tracks[i].audio.pkt_cnt = 0;
+ tracks[i].audio.sub_packet_cnt = 0;
+--
+1.9.1
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-9318.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-9318.patch
new file mode 100644
index 0000000..0553cee
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-9318.patch
@@ -0,0 +1,37 @@
+From 0d3a3b9f8907625b361420d48fe05716859620ff Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michaelni@gmx.at>
+Date: Wed, 26 Nov 2014 18:56:39 +0100
+Subject: [PATCH] avcodec/rawdec: Check the return code of
+ avpicture_get_size()
+
+(Upstream commit 1d3a3b9f8907625b361420d48fe05716859620ff)
+
+Fixes out of array access
+Fixes: asan_heap-oob_22388d0_3435_cov_3297128910_small_roll5_FlashCine1.cine
+Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
+
+Upstream-Status: Backport
+
+Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
+Signed-off-by: Yue Tao <yue.tao@windriver.com>
+---
+ libavcodec/rawdec.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c
+index 28792a1..647dfa9 100644
+--- a/gst-libs/ext/libav/libavcodec/rawdec.c
++++ b/gst-libs/ext/libav/libavcodec/rawdec.c
+@@ -87,6 +87,9 @@ static av_cold int raw_init_decoder(AVCodecContext *avctx)
+
+ ff_set_systematic_pal2(context->palette, avctx->pix_fmt);
+ context->length = avpicture_get_size(avctx->pix_fmt, avctx->width, avctx->height);
++ if (context->length < 0)
++ return context->length;
++
+ if((avctx->bits_per_coded_sample == 4 || avctx->bits_per_coded_sample == 2) &&
+ avctx->pix_fmt==PIX_FMT_PAL8 &&
+ (!avctx->codec_tag || avctx->codec_tag == MKTAG('r','a','w',' '))){
+--
+1.7.9.5
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-9603.patch b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-9603.patch
new file mode 100644
index 0000000..5dda4cc
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg-0.10.13/gst-ffmpeg-fix-CVE-2014-9603.patch
@@ -0,0 +1,41 @@
+From dc68faf8339a885bc55fabe5b01f1de4f8f3782c Mon Sep 17 00:00:00 2001
+From: Kai Kang <kai.kang@windriver.com>
+Date: Wed, 13 May 2015 16:30:53 +0800
+Subject: [PATCH 1/2] gst-ffmpeg: fix CVE-2014-9603
+
+Upstream-Status: Backport
+
+Upstream is version 2.x and vmdav.c is splitted into 2 files vmdaudio.c
+and vmdvideo.c. Becuase source code changes, just partly backport commit which
+is applicable to version 0.10.13 to fix CVE-2014-9603.
+
+http://git.videolan.org/?p=ffmpeg.git;a=commit;h=3030fb7e0d41836f8add6399e9a7c7b740b48bfd
+
+Signed-off-by: Kai Kang <kai.kang@windriver.com>
+---
+ gst-libs/ext/libav/libavcodec/vmdav.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/gst-libs/ext/libav/libavcodec/vmdav.c b/gst-libs/ext/libav/libavcodec/vmdav.c
+index d258252..ba88ad8 100644
+--- a/gst-libs/ext/libav/libavcodec/vmdav.c
++++ b/gst-libs/ext/libav/libavcodec/vmdav.c
+@@ -294,10 +294,13 @@ static void vmd_decode(VmdVideoContext *s)
+ len = *pb++;
+ if (len & 0x80) {
+ len = (len & 0x7F) + 1;
+- if (*pb++ == 0xFF)
++ if (*pb++ == 0xFF) {
+ len = rle_unpack(pb, &dp[ofs], len, frame_width - ofs);
+- else
++ } else {
++ if (ofs + len > frame_width)
++ return;
+ memcpy(&dp[ofs], pb, len);
++ }
+ pb += len;
+ ofs += len;
+ } else {
+--
+1.9.1
+
diff --git a/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb b/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb
index b5c838f..b7d008e 100644
--- a/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb
+++ b/meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb
@@ -57,6 +57,9 @@ SRC_URI = "http://gstreamer.freedesktop.org/src/${BPN}/${BPN}-${PV}.tar.bz2 \
file://0001-avcodec-smc-fix-off-by-1-error.patch \
file://0002-avcodec-mjpegdec-check-bits-per-pixel-for-changes-si.patch \
file://libav-9.patch \
+ file://gst-ffmpeg-fix-CVE-2014-7933.patch \
+ file://gst-ffmpeg-fix-CVE-2014-9318.patch \
+ file://gst-ffmpeg-fix-CVE-2014-9603.patch \
"
SRC_URI[md5sum] = "7f5beacaf1312db2db30a026b36888c4"
--
1.9.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH 4/4] gst-ffmpeg: fix CVEs
2015-05-19 1:08 ` [PATCH 4/4] gst-ffmpeg: fix CVEs Kai Kang
@ 2015-05-19 13:03 ` Alexander Kanavin
0 siblings, 0 replies; 8+ messages in thread
From: Alexander Kanavin @ 2015-05-19 13:03 UTC (permalink / raw)
To: openembedded-core
On 05/19/2015 04:08 AM, Kai Kang wrote:
> Backport patches to fix CVEs: CVE-2014-7933, CVE-2014-9318 and
> CVE-2014-9603.
>
Gstreamer 0.10 is moving to meta-multimedia, so you might want to hold
this one off until it lands there.
Alex
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH 2/4] alsa-tools: upgrade to version 1.0.29
2015-05-19 1:08 ` [PATCH 2/4] alsa-tools: upgrade to version 1.0.29 Kai Kang
@ 2015-05-27 12:06 ` Otavio Salvador
2015-05-28 8:06 ` Kang Kai
0 siblings, 1 reply; 8+ messages in thread
From: Otavio Salvador @ 2015-05-27 12:06 UTC (permalink / raw)
To: Kai Kang; +Cc: Patches and discussions about the oe-core layer
On Mon, May 18, 2015 at 10:08 PM, Kai Kang <kai.kang@windriver.com> wrote:
> Upgrade alsa-tools from verion 1.0.28 to 1.0.29.
>
> * update autotools.patch
> * add file gitcompile which exists in git repo but missing in release
> tar ball for sub-directory hdajacksensetest
>
> Signed-off-by: Kai Kang <kai.kang@windriver.com>
Seems this broke framebuffer build:
framebuffer fsl-image-machine-test@ls1021aqds (1/7) patching file Makefile
framebuffer fsl-image-machine-test@ls1021aqds (1/7) Hunk #1 FAILED at 1.
framebuffer fsl-image-machine-test@ls1021aqds (1/7) 1 out of 1 hunk
FAILED -- rejects in file Makefile
framebuffer fsl-image-machine-test@ls1021aqds (1/7) Patch
makefile_no_gtk.patch does not apply (enforce with -f)
framebuffer fsl-image-machine-test@ls1021aqds (1/7) ERROR: Function
failed: patch_do_patch
framebuffer fsl-image-machine-test@ls1021aqds (1/7) ERROR: Logfile of
failure stored in:
.../build-framebuffer/tmp/work/cortexa7hf-vfp-neon-poky-linux-gnueabi/alsa-tools/1.0.29-r0/temp/log.do_patch.26177
framebuffer fsl-image-machine-test@ls1021aqds (1/7) recipe
alsa-tools-1.0.29-r0: task do_patch: Failed
Is it possible to take a look?
--
Otavio Salvador O.S. Systems
http://www.ossystems.com.br http://code.ossystems.com.br
Mobile: +55 (53) 9981-7854 Mobile: +1 (347) 903-9750
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH 2/4] alsa-tools: upgrade to version 1.0.29
2015-05-27 12:06 ` Otavio Salvador
@ 2015-05-28 8:06 ` Kang Kai
0 siblings, 0 replies; 8+ messages in thread
From: Kang Kai @ 2015-05-28 8:06 UTC (permalink / raw)
To: Otavio Salvador; +Cc: Patches and discussions about the oe-core layer
[-- Attachment #1: Type: text/plain, Size: 1357 bytes --]
On 2015年05月27日 20:06, Otavio Salvador wrote:
> On Mon, May 18, 2015 at 10:08 PM, Kai Kang <kai.kang@windriver.com> wrote:
>> Upgrade alsa-tools from verion 1.0.28 to 1.0.29.
>>
>> * update autotools.patch
>> * add file gitcompile which exists in git repo but missing in release
>> tar ball for sub-directory hdajacksensetest
>>
>> Signed-off-by: Kai Kang <kai.kang@windriver.com>
> Seems this broke framebuffer build:
>
> framebuffer fsl-image-machine-test@ls1021aqds (1/7) patching file Makefile
> framebuffer fsl-image-machine-test@ls1021aqds (1/7) Hunk #1 FAILED at 1.
> framebuffer fsl-image-machine-test@ls1021aqds (1/7) 1 out of 1 hunk
> FAILED -- rejects in file Makefile
> framebuffer fsl-image-machine-test@ls1021aqds (1/7) Patch
> makefile_no_gtk.patch does not apply (enforce with -f)
> framebuffer fsl-image-machine-test@ls1021aqds (1/7) ERROR: Function
> failed: patch_do_patch
> framebuffer fsl-image-machine-test@ls1021aqds (1/7) ERROR: Logfile of
> failure stored in:
> .../build-framebuffer/tmp/work/cortexa7hf-vfp-neon-poky-linux-gnueabi/alsa-tools/1.0.29-r0/temp/log.do_patch.26177
> framebuffer fsl-image-machine-test@ls1021aqds (1/7) recipe
> alsa-tools-1.0.29-r0: task do_patch: Failed
>
> Is it possible to take a look?
>
>
OK. I'll send a patch to fix it .
--
Regards,
Neil | Kai Kang
[-- Attachment #2: Type: text/html, Size: 2049 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2015-05-28 8:06 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-05-19 1:08 [PATCH 0/4] Upgrade packages and some CVEs fix for gst-ffmpeg Kai Kang
2015-05-19 1:08 ` [PATCH 1/4] vala: upgrade to version 0.28.0 Kai Kang
2015-05-19 1:08 ` [PATCH 2/4] alsa-tools: upgrade to version 1.0.29 Kai Kang
2015-05-27 12:06 ` Otavio Salvador
2015-05-28 8:06 ` Kang Kai
2015-05-19 1:08 ` [PATCH 3/4] alsa-utils: upgrade to 1.0.29 Kai Kang
2015-05-19 1:08 ` [PATCH 4/4] gst-ffmpeg: fix CVEs Kai Kang
2015-05-19 13:03 ` Alexander Kanavin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.