[PATCH] fixed #1887

Gbp-Pq: Name CVE-2021-40566.patch

diff --git a/src/filters/dec_xvid.c b/src/filters/dec_xvid.c
index dc5012199806399209ea9f93f2420f509240efe1..0d8f40fe74a11c6932468d797964f59098f4c430 100644 (file)
--- a/src/filters/dec_xvid.c
+++ b/src/filters/dec_xvid.c
@@ -179,7 +179,7 @@ static GF_Err xviddec_configure_pid(GF_Filter *filter, GF_FilterPid *pid, Bool i
        /*decode DSI*/
        e = gf_m4v_get_config(p->value.data.ptr, p->value.data.size, &dsi);
        if (e) return e;
-       if (!dsi.width || !dsi.height) return GF_NON_COMPLIANT_BITSTREAM;
+       if (!dsi.width || (dsi.width%2) || !dsi.height) return GF_NON_COMPLIANT_BITSTREAM;
 
        memset(&par, 0, sizeof(par));
        par.width = dsi.width;

diff --git a/src/filters/reframe_mpgvid.c b/src/filters/reframe_mpgvid.c
index 3b0430b63f8543d74f2fdd38bd8c8fc73a87fcf2..7b13500c16629916177614d53c2246c01bbd5573 100644 (file)
--- a/src/filters/reframe_mpgvid.c
+++ b/src/filters/reframe_mpgvid.c
@@ -781,12 +781,17 @@ GF_Err mpgviddmx_process(GF_Filter *filter)
                                //not enough data, accumulate until we can parse the full header
                                if (e==GF_EOS) {
                                        if (vosh_start<0) vosh_start = 0;
-                                       if (ctx->hdr_store_alloc < ctx->hdr_store_size + pck_size - vosh_start) {
-                                               ctx->hdr_store_alloc = (u32) (ctx->hdr_store_size + pck_size - vosh_start);
-                                               ctx->hdr_store = gf_realloc(ctx->hdr_store, sizeof(char)*ctx->hdr_store_alloc);
+                                       if (data == ctx->hdr_store) {
+                                               memmove(ctx->hdr_store, start, remain);
+                                               ctx->hdr_store_size = remain;
+                                       } else {
+                                               if (ctx->hdr_store_alloc < ctx->hdr_store_size + pck_size - vosh_start) {
+                                                       ctx->hdr_store_alloc = (u32) (ctx->hdr_store_size + pck_size - vosh_start);
+                                                       ctx->hdr_store = gf_realloc(ctx->hdr_store, sizeof(char)*ctx->hdr_store_alloc);
+                                               }
+                                               memcpy(ctx->hdr_store + ctx->hdr_store_size, data + vosh_start, (size_t) (pck_size - vosh_start) );
+                                               ctx->hdr_store_size += pck_size - (u32) vosh_start;
                                        }
-                                       memcpy(ctx->hdr_store + ctx->hdr_store_size, data + vosh_start, (size_t) (pck_size - vosh_start) );
-                                       ctx->hdr_store_size += pck_size - (u32) vosh_start;
                                        gf_filter_pid_drop_packet(ctx->ipid);
                                        return GF_OK;
                                } else if (e != GF_OK) {
@@ -820,12 +825,17 @@ GF_Err mpgviddmx_process(GF_Filter *filter)
                                //not enough data, accumulate until we can parse the full header
                                if (e==GF_EOS) {
                                        if (vosh_start<0) vosh_start = 0;
-                                       if (ctx->hdr_store_alloc < ctx->hdr_store_size + pck_size - vosh_start) {
-                                               ctx->hdr_store_alloc = (u32) (ctx->hdr_store_size + pck_size - (u32) vosh_start);
-                                               ctx->hdr_store = gf_realloc(ctx->hdr_store, sizeof(char)*ctx->hdr_store_alloc);
+                                       if (data == ctx->hdr_store) {
+                                               memmove(ctx->hdr_store, start, remain);
+                                               ctx->hdr_store_size = remain;
+                                       } else {
+                                               if (ctx->hdr_store_alloc < ctx->hdr_store_size + pck_size - vosh_start) {
+                                                       ctx->hdr_store_alloc = (u32) (ctx->hdr_store_size + pck_size - (u32) vosh_start);
+                                                       ctx->hdr_store = gf_realloc(ctx->hdr_store, sizeof(char)*ctx->hdr_store_alloc);
+                                               }
+                                               memcpy(ctx->hdr_store + ctx->hdr_store_size, data + vosh_start, (size_t) (pck_size - vosh_start) );
+                                               ctx->hdr_store_size += pck_size - (u32) vosh_start;
                                        }
-                                       memcpy(ctx->hdr_store + ctx->hdr_store_size, data + vosh_start, (size_t) (pck_size - vosh_start) );
-                                       ctx->hdr_store_size += pck_size - (u32) vosh_start;
                                        gf_filter_pid_drop_packet(ctx->ipid);
                                        return GF_OK;
                                } else if (e != GF_OK) {