avcodec/utils: Clear dimensions in ff_get_buffer() on failure

avcodec/utils: Clear dimensions in ff_get_buffer() on failure

Fixes out of array access
Fixes: 482d8f2fd17c9f532b586458a33f267c/asan_heap-oob_4a52b6_7417_1d08d477736d66cdadd833d146bb8bae.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
[sunweaver] - manually adapted for Debian jessie's libav version which lacks the get_internal_buffer() symbol.

Gbp-Pq: Name CVE-2015-8663.patch

avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_decode*()

avcodec/jpeg2000dwt: Check ndeclevels before calling dwt_decode*()

Fixes out of array access
Fixes: 01859c9a9ac6cd60a008274123275574/asan_heap-oob_1dff571_8250_50d3d1611e294c3519fd1fa82198b69b.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-8662.patch

avcodec/h264_slice: Limit max_contexts when slice_context_count is initialized

avcodec/h264_slice: Limit max_contexts when slice_context_count is initialized

Fixes out of array access
Fixes: 1430e9c43fae47a24c179c7c54f94918/signal_sigsegv_421427_2049_f2192b6829ab6e0eefcb035329c03c60.264
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-8661.patch

avcodec/ivi: Check image dimensions

avcodec/ivi: Check image dimensions

Fixes integer overflow
Fixes: 1e32c6c591d940337c20b197ec1c4d3d/asan_heap-oob_4a52e5_8946_0bb0d9e863def56005e49f1d89bdc94d.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-8364.patch

avcodec/jpeg2000dec: Check for duplicate SIZ marker

avcodec/jpeg2000dec: Check for duplicate SIZ marker

Fixes: 0231a17345734228011c6f35a64e4594/asan_heap-oob_1d92a72_3218_1213809a9e3affec77e4c191fdfdc0a9.mov
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-8363.patch

avcodec/hevc_ps: Check chroma_format_idc

avcodec/hevc_ps: Check chroma_format_idc

Fixes out of array access
Fixes: 24d05e8b84676799c735c9e27d97895e/asan_heap-oob_1b70f6a_2955_7c3652a7f370f9f3ef40642bc2c99bb2.bit
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
[sunweaver] Ported to libav 11.12 in Debian jessie LTS.

Gbp-Pq: Name CVE-2015-8217.patch

avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it

avcodec/mjpegdec: Check index in ljpeg_decode_yuv_scan() before using it

Fixes: 04715144ba237443010554be0d05343f/asan_heap-oob_1eafc76_1737_c685b48041a563461839e4e7ab97abb8.jpg
Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
[sunweaver] Re-based for libav 11.12 in Debian jessie LTS.

Gbp-Pq: Name CVE-2015-8216.patch

avcodec/rv34: Clear pointers in ff_rv34_decode_init_thread_copy()

avcodec/rv34: Clear pointers in ff_rv34_decode_init_thread_copy()

Avoids leaving stale pointers
Fixes: signal_sigabrt_7ffff70eccc9_819_sabtriple.rm with memlimit 536870912
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6826.patch

avcodec/pthread_frame: clear priv_data, avoid stale pointer in error case

avcodec/pthread_frame: clear priv_data, avoid stale pointer in error case

Fixes: b4b47bc2b3fb7ca710bfffe5aa969e37_signal_sigabrt_7ffff70eccc9_744_nc_sample2.avi with memlimit of 4194304
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6825.patch

swscale/utils: Clear pix buffers

swscale/utils: Clear pix buffers

Fixes use of uninitialized memory
Fixes: a96874b9466b6edc660a519c7ad47977_signal_sigsegv_7ffff713351a_744_nc_sample.avi with memlimit 2147483648
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6824.patch

avcodec/alac: Clear pointers in allocate_buffers()

avcodec/alac: Clear pointers in allocate_buffers()

Fixes: 06a4edb39ad8a9883175f9bd428334a2_signal_sigsegv_7ffff713351a_706_mov__alac__ALAC_6ch.mov
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6823.patch

avcodec/sanm: Reset sizes in destroy_buffers()

avcodec/sanm: Reset sizes in destroy_buffers()

Fixes crash in 1288a2fe8e9ae6b00ca40e089d08ca65_signal_sigsegv_7ffff71426a7_354_accident.san with allocation limit 65536

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6822.patch

avcodec/mpegvideo: Clear pointers in ff_mpv_common_init()

avcodec/mpegvideo: Clear pointers in ff_mpv_common_init()

This ensures that no stale pointers leak through on any path

Fixes: signal_sigsegv_c3097a_991_xtrem_e2_m64q15_a32sxx.3gp
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Gbp-Pq: Name CVE-2015-6821.patch

avcodec/aacsbr: check that the element type matches before applying SBR

avcodec/aacsbr: check that the element type matches before applying SBR

Fixes out of array access
Fixes: signal_sigsegv_3670fc0_2818_cov_2307326154_moon.mux
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Gbp-Pq: Name CVE-2015-6820.patch

avcodec/pngdec: Only allow one IHDR chunk

avcodec/pngdec: Only allow one IHDR chunk

Multiple IHDR chunks are forbidden in PNG
Fixes inconsistency and out of array accesses

Fixes: asan_heap-oob_4d5c5a_1738_cov_2638287726_c-m2-8f2b481b7fd9bd745e620b7c01a18df2.png
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Gbp-Pq: Name CVE-2015-6818.patch

avcodec/pngdec: Check IHDR/IDAT order

avcodec/pngdec: Check IHDR/IDAT order

Fixes out of array access
Fixes: asan_heap-oob_20a6c26_2690_cov_3434532168_mail.png
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
[sunweaver] - Port this commit to libav in Debian jessie.

Gbp-Pq: Name CVE-2014-9317.patch

avcodec/vp8: Do not use num_coeff_partitions in thread/buffer setup

avcodec/vp8: Do not use num_coeff_partitions in thread/buffer setup

The variable is not a constant and can lead to race conditions

Fixes: repro.webm (not reproducable with FFmpeg alone)
Found-by: Dale Curtis <dalecurtis@google.com>
Tested-by: Dale Curtis <dalecurtis@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Gbp-Pq: Name CVE-2015-6761.patch

disable-configuration-warnings

Gbp-Pq: Name 03-disable-configuration-warnings.patch

configure-disable-ebx-gcc-4.9

Gbp-Pq: Name 02-configure-disable-ebx-gcc-4.9.patch

libav (6:11.12-1~deb8u3) jessie-security; urgency=medium

  * Non-maintainer upload by the Debian LTS Team.
  * debian/patches:
    + Rename CVE-2015-6822+6823+6824.patch to CVE-2015-6822.patch..
  * CVE-2015-6823: avcodec/alac: Clear pointers in allocate_buffers().
  * CVE-2015-6824: swscale/utils: Clear pix buffers. Fixes use of
    uninitialized memory.

[dgit import unpatched libav 6:11.12-1~deb8u3]

Import libav_11.12-1~deb8u3.debian.tar.xz

[dgit import tarball libav 6:11.12-1~deb8u3 libav_11.12-1~deb8u3.debian.tar.xz]

Import libav_11.12.orig.tar.xz

[dgit import orig libav_11.12.orig.tar.xz]