From eb80420f86393e9f94b2a0a5b32e73b175c650b7 Mon Sep 17 00:00:00 2001 From: Reinhard Tartler Date: Sat, 4 Mar 2023 12:43:29 -0500 Subject: [PATCH] Fix inf loop, CVE-2022-1222 --- debian/patches/CVE-2022-1222.patch | 40 ++++++++++++++++++++++++++++++ debian/patches/series | 1 + 2 files changed, 41 insertions(+) create mode 100644 debian/patches/CVE-2022-1222.patch diff --git a/debian/patches/CVE-2022-1222.patch b/debian/patches/CVE-2022-1222.patch new file mode 100644 index 0000000..0589332 --- /dev/null +++ b/debian/patches/CVE-2022-1222.patch @@ -0,0 +1,40 @@ +commit 7f060bbb72966cae80d6fee338d0b07fa3fc06e1 +Author: jeanlf +Date: Thu Mar 31 13:57:05 2022 +0200 + + fixed #2159 + +diff --git a/src/media_tools/avilib.c b/src/media_tools/avilib.c +index 71e751d19..14febb365 100644 +--- a/src/media_tools/avilib.c ++++ b/src/media_tools/avilib.c +@@ -1884,8 +1884,8 @@ avi_t *AVI_open_fd(FILE *fd, int getIndex) + + int avi_parse_input_file(avi_t *AVI, int getIndex) + { +- int i, rate, scale, idx_type; +- s64 n; ++ int rate, scale, idx_type; ++ s64 n, i; + unsigned char *hdrl_data; + u64 header_offset=0; + int hdrl_len=0; +@@ -1939,6 +1939,7 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) + n -= 4; + if(strnicmp(data,"hdrl",4) == 0) + { ++ if (n>0xFFFFFFFF) ERR_EXIT(AVI_ERR_READ) + hdrl_len = (u32) n; + hdrl_data = (unsigned char *) gf_malloc((u32)n); + if(hdrl_data==0) ERR_EXIT(AVI_ERR_NO_MEM); +@@ -2091,8 +2092,10 @@ int avi_parse_input_file(avi_t *AVI, int getIndex) + AVI->compressor2[4] = 0; + + if (n>40) { ++ if (n>0xFFFFFFFF) ERR_EXIT(AVI_ERR_READ) + AVI->extradata_size = (u32) (n - 40); + AVI->extradata = gf_malloc(sizeof(u8)* AVI->extradata_size); ++ if (!AVI->extradata) ERR_EXIT(AVI_ERR_NO_MEM) + memcpy(AVI->extradata, hdrl_data + i + 40, AVI->extradata_size); + } + diff --git a/debian/patches/series b/debian/patches/series index 88f8373..b092b05 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -5,3 +5,4 @@ CVE-2022-29340.patch CVE-2022-30976.patch CVE-2022-1035.patch CVE-2022-1172.patch +CVE-2022-1222.patch -- 2.30.2