From 902c3c11a3f3ef5698f6c33d00a6ed6e67827198 Mon Sep 17 00:00:00 2001 From: jeanlf Date: Mon, 30 Aug 2021 15:46:16 +0200 Subject: [PATCH] [PATCH] fixed #1887 Gbp-Pq: Name CVE-2021-40566.patch --- src/filters/dec_xvid.c | 2 +- src/filters/reframe_mpgvid.c | 30 ++++++++++++++++++++---------- 2 files changed, 21 insertions(+), 11 deletions(-) diff --git a/src/filters/dec_xvid.c b/src/filters/dec_xvid.c index dc50121..0d8f40f 100644 --- a/src/filters/dec_xvid.c +++ b/src/filters/dec_xvid.c @@ -179,7 +179,7 @@ static GF_Err xviddec_configure_pid(GF_Filter *filter, GF_FilterPid *pid, Bool i /*decode DSI*/ e = gf_m4v_get_config(p->value.data.ptr, p->value.data.size, &dsi); if (e) return e; - if (!dsi.width || !dsi.height) return GF_NON_COMPLIANT_BITSTREAM; + if (!dsi.width || (dsi.width%2) || !dsi.height) return GF_NON_COMPLIANT_BITSTREAM; memset(&par, 0, sizeof(par)); par.width = dsi.width; diff --git a/src/filters/reframe_mpgvid.c b/src/filters/reframe_mpgvid.c index 3b0430b..7b13500 100644 --- a/src/filters/reframe_mpgvid.c +++ b/src/filters/reframe_mpgvid.c @@ -781,12 +781,17 @@ GF_Err mpgviddmx_process(GF_Filter *filter) //not enough data, accumulate until we can parse the full header if (e==GF_EOS) { if (vosh_start<0) vosh_start = 0; - if (ctx->hdr_store_alloc < ctx->hdr_store_size + pck_size - vosh_start) { - ctx->hdr_store_alloc = (u32) (ctx->hdr_store_size + pck_size - vosh_start); - ctx->hdr_store = gf_realloc(ctx->hdr_store, sizeof(char)*ctx->hdr_store_alloc); + if (data == ctx->hdr_store) { + memmove(ctx->hdr_store, start, remain); + ctx->hdr_store_size = remain; + } else { + if (ctx->hdr_store_alloc < ctx->hdr_store_size + pck_size - vosh_start) { + ctx->hdr_store_alloc = (u32) (ctx->hdr_store_size + pck_size - vosh_start); + ctx->hdr_store = gf_realloc(ctx->hdr_store, sizeof(char)*ctx->hdr_store_alloc); + } + memcpy(ctx->hdr_store + ctx->hdr_store_size, data + vosh_start, (size_t) (pck_size - vosh_start) ); + ctx->hdr_store_size += pck_size - (u32) vosh_start; } - memcpy(ctx->hdr_store + ctx->hdr_store_size, data + vosh_start, (size_t) (pck_size - vosh_start) ); - ctx->hdr_store_size += pck_size - (u32) vosh_start; gf_filter_pid_drop_packet(ctx->ipid); return GF_OK; } else if (e != GF_OK) { @@ -820,12 +825,17 @@ GF_Err mpgviddmx_process(GF_Filter *filter) //not enough data, accumulate until we can parse the full header if (e==GF_EOS) { if (vosh_start<0) vosh_start = 0; - if (ctx->hdr_store_alloc < ctx->hdr_store_size + pck_size - vosh_start) { - ctx->hdr_store_alloc = (u32) (ctx->hdr_store_size + pck_size - (u32) vosh_start); - ctx->hdr_store = gf_realloc(ctx->hdr_store, sizeof(char)*ctx->hdr_store_alloc); + if (data == ctx->hdr_store) { + memmove(ctx->hdr_store, start, remain); + ctx->hdr_store_size = remain; + } else { + if (ctx->hdr_store_alloc < ctx->hdr_store_size + pck_size - vosh_start) { + ctx->hdr_store_alloc = (u32) (ctx->hdr_store_size + pck_size - (u32) vosh_start); + ctx->hdr_store = gf_realloc(ctx->hdr_store, sizeof(char)*ctx->hdr_store_alloc); + } + memcpy(ctx->hdr_store + ctx->hdr_store_size, data + vosh_start, (size_t) (pck_size - vosh_start) ); + ctx->hdr_store_size += pck_size - (u32) vosh_start; } - memcpy(ctx->hdr_store + ctx->hdr_store_size, data + vosh_start, (size_t) (pck_size - vosh_start) ); - ctx->hdr_store_size += pck_size - (u32) vosh_start; gf_filter_pid_drop_packet(ctx->ipid); return GF_OK; } else if (e != GF_OK) { -- 2.30.2