From 3ecbffead7406c7ede017bdd46b845fd924b6a91 Mon Sep 17 00:00:00 2001 From: Alessio Sergi Date: Wed, 30 Nov 2016 12:38:40 +0100 Subject: [PATCH] gst-plugins-good1: update to 1.10.2 --- .../patches/CESA-2016-0004.patch | 304 ------------------ srcpkgs/gst-plugins-good1/template | 12 +- 2 files changed, 6 insertions(+), 310 deletions(-) delete mode 100644 srcpkgs/gst-plugins-good1/patches/CESA-2016-0004.patch diff --git a/srcpkgs/gst-plugins-good1/patches/CESA-2016-0004.patch b/srcpkgs/gst-plugins-good1/patches/CESA-2016-0004.patch deleted file mode 100644 index b6d84cbf6cf..00000000000 --- a/srcpkgs/gst-plugins-good1/patches/CESA-2016-0004.patch +++ /dev/null @@ -1,304 +0,0 @@ -From 2e203a79b7d9af4029307c1a845b3c148d5f5e62 Mon Sep 17 00:00:00 2001 -From: Matthew Waters -Date: Tue, 22 Nov 2016 19:05:00 +1100 -Subject: flxdec: add some write bounds checking - -Without checking the bounds of the frame we are writing into, we can -write off the end of the destination buffer. - -https://scarybeastsecurity.blogspot.dk/2016/11/0day-exploit-advancing-exploitation.html - -https://bugzilla.gnome.org/show_bug.cgi?id=774834 - ---- gst/flx/gstflxdec.c.orig Fri Nov 4 18:07:09 2016 -+++ gst/flx/gstflxdec.c Wed Nov 23 12:13:57 2016 -@@ -74,9 +74,9 @@ static gboolean gst_flxdec_src_query_handler (GstPad * - GstQuery * query); - - static void flx_decode_color (GstFlxDec *, guchar *, guchar *, gint); --static void flx_decode_brun (GstFlxDec *, guchar *, guchar *); --static void flx_decode_delta_fli (GstFlxDec *, guchar *, guchar *); --static void flx_decode_delta_flc (GstFlxDec *, guchar *, guchar *); -+static gboolean flx_decode_brun (GstFlxDec *, guchar *, guchar *); -+static gboolean flx_decode_delta_fli (GstFlxDec *, guchar *, guchar *); -+static gboolean flx_decode_delta_flc (GstFlxDec *, guchar *, guchar *); - - #define rndalign(off) ((off) + ((off) & 1)) - -@@ -203,13 +203,14 @@ gst_flxdec_sink_event_handler (GstPad * pad, GstObject - return ret; - } - --static void -+static gboolean - flx_decode_chunks (GstFlxDec * flxdec, gulong count, guchar * data, - guchar * dest) - { - FlxFrameChunk *hdr; -+ gboolean ret = TRUE; - -- g_return_if_fail (data != NULL); -+ g_return_val_if_fail (data != NULL, FALSE); - - while (count--) { - hdr = (FlxFrameChunk *) data; -@@ -228,17 +229,17 @@ flx_decode_chunks (GstFlxDec * flxdec, gulong count, g - break; - - case FLX_BRUN: -- flx_decode_brun (flxdec, data, dest); -+ ret = flx_decode_brun (flxdec, data, dest); - data += rndalign (hdr->size) - FlxFrameChunkSize; - break; - - case FLX_LC: -- flx_decode_delta_fli (flxdec, data, dest); -+ ret = flx_decode_delta_fli (flxdec, data, dest); - data += rndalign (hdr->size) - FlxFrameChunkSize; - break; - - case FLX_SS2: -- flx_decode_delta_flc (flxdec, data, dest); -+ ret = flx_decode_delta_flc (flxdec, data, dest); - data += rndalign (hdr->size) - FlxFrameChunkSize; - break; - -@@ -256,7 +257,12 @@ flx_decode_chunks (GstFlxDec * flxdec, gulong count, g - data += rndalign (hdr->size) - FlxFrameChunkSize; - break; - } -+ -+ if (!ret) -+ break; - } -+ -+ return ret; - } - - -@@ -289,13 +295,13 @@ flx_decode_color (GstFlxDec * flxdec, guchar * data, g - } - } - --static void -+static gboolean - flx_decode_brun (GstFlxDec * flxdec, guchar * data, guchar * dest) - { - gulong count, lines, row; - guchar x; - -- g_return_if_fail (flxdec != NULL); -+ g_return_val_if_fail (flxdec != NULL, FALSE); - - lines = flxdec->hdr.height; - while (lines--) { -@@ -313,12 +319,21 @@ flx_decode_brun (GstFlxDec * flxdec, guchar * data, gu - if (count > 0x7f) { - /* literal run */ - count = 0x100 - count; -+ if ((glong) row - (glong) count < 0) { -+ GST_ERROR_OBJECT (flxdec, "Invalid BRUN packet detected."); -+ return FALSE; -+ } - row -= count; - - while (count--) - *dest++ = *data++; - - } else { -+ if ((glong) row - (glong) count < 0) { -+ GST_ERROR_OBJECT (flxdec, "Invalid BRUN packet detected."); -+ return FALSE; -+ } -+ - /* replicate run */ - row -= count; - x = *data++; -@@ -328,22 +343,28 @@ flx_decode_brun (GstFlxDec * flxdec, guchar * data, gu - } - } - } -+ -+ return TRUE; - } - --static void -+static gboolean - flx_decode_delta_fli (GstFlxDec * flxdec, guchar * data, guchar * dest) - { - gulong count, packets, lines, start_line; - guchar *start_p, x; - -- g_return_if_fail (flxdec != NULL); -- g_return_if_fail (flxdec->delta_data != NULL); -+ g_return_val_if_fail (flxdec != NULL, FALSE); -+ g_return_val_if_fail (flxdec->delta_data != NULL, FALSE); - - /* use last frame for delta */ - memcpy (dest, flxdec->delta_data, flxdec->size); - - start_line = (data[0] + (data[1] << 8)); - lines = (data[2] + (data[3] << 8)); -+ if (start_line + lines > flxdec->hdr.height) { -+ GST_ERROR_OBJECT (flxdec, "Invalid FLI packet detected. too many lines."); -+ return FALSE; -+ } - data += 4; - - /* start position of delta */ -@@ -356,7 +377,8 @@ flx_decode_delta_fli (GstFlxDec * flxdec, guchar * dat - - while (packets--) { - /* skip count */ -- dest += *data++; -+ guchar skip = *data++; -+ dest += skip; - - /* RLE count */ - count = *data++; -@@ -364,12 +386,24 @@ flx_decode_delta_fli (GstFlxDec * flxdec, guchar * dat - if (count > 0x7f) { - /* literal run */ - count = 0x100 - count; -- x = *data++; - -+ if (skip + count > flxdec->hdr.width) { -+ GST_ERROR_OBJECT (flxdec, "Invalid FLI packet detected. " -+ "line too long."); -+ return FALSE; -+ } -+ -+ x = *data++; - while (count--) - *dest++ = x; - - } else { -+ if (skip + count > flxdec->hdr.width) { -+ GST_ERROR_OBJECT (flxdec, "Invalid FLI packet detected. " -+ "line too long."); -+ return FALSE; -+ } -+ - /* replicate run */ - while (count--) - *dest++ = *data++; -@@ -378,21 +412,27 @@ flx_decode_delta_fli (GstFlxDec * flxdec, guchar * dat - start_p += flxdec->hdr.width; - dest = start_p; - } -+ -+ return TRUE; - } - --static void -+static gboolean - flx_decode_delta_flc (GstFlxDec * flxdec, guchar * data, guchar * dest) - { - gulong count, lines, start_l, opcode; - guchar *start_p; - -- g_return_if_fail (flxdec != NULL); -- g_return_if_fail (flxdec->delta_data != NULL); -+ g_return_val_if_fail (flxdec != NULL, FALSE); -+ g_return_val_if_fail (flxdec->delta_data != NULL, FALSE); - - /* use last frame for delta */ - memcpy (dest, flxdec->delta_data, flxdec->size); - - lines = (data[0] + (data[1] << 8)); -+ if (lines > flxdec->hdr.height) { -+ GST_ERROR_OBJECT (flxdec, "Invalid FLC packet detected. too many lines."); -+ return FALSE; -+ } - data += 2; - - start_p = dest; -@@ -405,9 +445,15 @@ flx_decode_delta_flc (GstFlxDec * flxdec, guchar * dat - while ((opcode = (data[0] + (data[1] << 8))) & 0xc000) { - data += 2; - if ((opcode & 0xc000) == 0xc000) { -- /* skip count */ -- start_l += (0x10000 - opcode); -- dest += flxdec->hdr.width * (0x10000 - opcode); -+ /* line skip count */ -+ gulong skip = (0x10000 - opcode); -+ if (skip > flxdec->hdr.height) { -+ GST_ERROR_OBJECT (flxdec, "Invalid FLC packet detected. " -+ "skip line count too big."); -+ return FALSE; -+ } -+ start_l += skip; -+ dest += flxdec->hdr.width * skip; - } else { - /* last pixel */ - dest += flxdec->hdr.width; -@@ -419,7 +465,8 @@ flx_decode_delta_flc (GstFlxDec * flxdec, guchar * dat - /* last opcode is the packet count */ - while (opcode--) { - /* skip count */ -- dest += *data++; -+ guchar skip = *data++; -+ dest += skip; - - /* RLE count */ - count = *data++; -@@ -427,12 +474,25 @@ flx_decode_delta_flc (GstFlxDec * flxdec, guchar * dat - if (count > 0x7f) { - /* replicate word run */ - count = 0x100 - count; -+ -+ if (skip + count > flxdec->hdr.width) { -+ GST_ERROR_OBJECT (flxdec, "Invalid FLC packet detected. " -+ "line too long."); -+ return FALSE; -+ } -+ - while (count--) { - *dest++ = data[0]; - *dest++ = data[1]; - } - data += 2; - } else { -+ if (skip + count > flxdec->hdr.width) { -+ GST_ERROR_OBJECT (flxdec, "Invalid FLC packet detected. " -+ "line too long."); -+ return FALSE; -+ } -+ - /* literal word run */ - while (count--) { - *dest++ = *data++; -@@ -442,6 +502,8 @@ flx_decode_delta_flc (GstFlxDec * flxdec, guchar * dat - } - lines--; - } -+ -+ return TRUE; - } - - static GstFlowReturn -@@ -571,9 +633,13 @@ gst_flxdec_chain (GstPad * pad, GstObject * parent, Gs - out = gst_buffer_new_and_alloc (flxdec->size * 4); - - /* decode chunks */ -- flx_decode_chunks (flxdec, -- ((FlxFrameType *) chunk)->chunks, -- chunk + FlxFrameTypeSize, flxdec->frame_data); -+ if (!flx_decode_chunks (flxdec, -+ ((FlxFrameType *) chunk)->chunks, -+ chunk + FlxFrameTypeSize, flxdec->frame_data)) { -+ GST_ELEMENT_ERROR (flxdec, STREAM, DECODE, -+ ("%s", "Could not decode chunk"), NULL); -+ return GST_FLOW_ERROR; -+ } - - /* save copy of the current frame for possible delta. */ - memcpy (flxdec->delta_data, flxdec->frame_data, flxdec->size); -@@ -611,7 +677,6 @@ wrong_type: - { - GST_ELEMENT_ERROR (flxdec, STREAM, WRONG_TYPE, (NULL), - ("not a flx file (type %x)", flxh->type)); -- gst_object_unref (flxdec); - return GST_FLOW_ERROR; - } - } diff --git a/srcpkgs/gst-plugins-good1/template b/srcpkgs/gst-plugins-good1/template index 9459258a607..04e53adb1e9 100644 --- a/srcpkgs/gst-plugins-good1/template +++ b/srcpkgs/gst-plugins-good1/template @@ -1,9 +1,9 @@ # Template file for 'gst-plugins-good1'. pkgname=gst-plugins-good1 reverts="1:1.4.5_3" -version=1.10.1 -revision=2 -wrksrc="${pkgname/1/}-${version#*:}" +version=1.10.2 +revision=1 +wrksrc="${pkgname/1/}-${version}" lib32disabled=yes build_style=gnu-configure configure_args="--with-gudev --with-libv4l2 --enable-experimental @@ -20,7 +20,7 @@ makedepends=" depends="gst-plugins-base1>=${version}" short_desc="GStreamer set of well-maintained good plug-ins (1.x)" maintainer="Juan RP " -homepage="http://gstreamer.freedesktop.org/" +homepage="https://gstreamer.freedesktop.org/" license="LGPL-2.1" -distfiles="http://gstreamer.freedesktop.org/src/${pkgname/1/}/${pkgname/1/}-${version#*:}.tar.xz" -checksum=a7642ea7e7c17fb67e94d0c17e56757b6577fa7ed244ff8c11031841d3556cc2 +distfiles="${homepage}/src/${pkgname/1/}/${pkgname/1/}-${version}.tar.xz" +checksum=198f325bcce982dce1ebeb36929a5f430b8bf9528e0d519e18df0b29e1d23313