diff options
| author | Marius Bakke <mbakke@fastmail.com> | 2018-12-03 19:15:17 +0100 |
|---|---|---|
| committer | Marius Bakke <mbakke@fastmail.com> | 2018-12-03 19:15:17 +0100 |
| commit | 99f63f011df2aab38e98d7ee4608a8c70bf74c4d (patch) | |
| tree | 3f224028f30c60f2ed7b9846365ad926192fc7e9 /gnu/packages/patches/libvpx-use-after-free-in-postproc.patch | |
| parent | e9a8b603337802a77ff2d68f0d30dc0e67721e3a (diff) | |
| parent | 4f03aa23e805bd653de774e1d74ed2f50826899b (diff) | |
| download | gnu-guix-99f63f011df2aab38e98d7ee4608a8c70bf74c4d.tar gnu-guix-99f63f011df2aab38e98d7ee4608a8c70bf74c4d.tar.gz | |
Merge branch 'master' into staging
Diffstat (limited to 'gnu/packages/patches/libvpx-use-after-free-in-postproc.patch')
| -rw-r--r-- | gnu/packages/patches/libvpx-use-after-free-in-postproc.patch | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/gnu/packages/patches/libvpx-use-after-free-in-postproc.patch b/gnu/packages/patches/libvpx-use-after-free-in-postproc.patch new file mode 100644 index 0000000000..04f2a953b7 --- /dev/null +++ b/gnu/packages/patches/libvpx-use-after-free-in-postproc.patch @@ -0,0 +1,34 @@ +From 52add5896661d186dec284ed646a4b33b607d2c7 Mon Sep 17 00:00:00 2001 +From: Jerome Jiang <jianj@google.com> +Date: Wed, 23 May 2018 15:43:00 -0700 +Subject: [PATCH] VP8: Fix use-after-free in postproc. + +The pointer in vp8 postproc refers to show_frame_mi which is only +updated on show frame. However, when there is a no-show frame which also +changes the size (thus new frame buffers allocated), show_frame_mi is +not updated with new frame buffer memory. + +Change the pointer in postproc to mi which is always updated. + +Bug: 842265 +Change-Id: I33874f2112b39f74562cba528432b5f239e6a7bd +--- + vp8/common/postproc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/vp8/common/postproc.c b/vp8/common/postproc.c +index d67ee8a57..8c292d616 100644 +--- a/vp8/common/postproc.c ++++ b/vp8/common/postproc.c +@@ -65,7 +65,7 @@ void vp8_deblock(VP8_COMMON *cm, YV12_BUFFER_CONFIG *source, + double level = 6.0e-05 * q * q * q - .0067 * q * q + .306 * q + .0065; + int ppl = (int)(level + .5); + +- const MODE_INFO *mode_info_context = cm->show_frame_mi; ++ const MODE_INFO *mode_info_context = cm->mi; + int mbr, mbc; + + /* The pixel thresholds are adjusted according to if or not the macroblock +-- +2.19.0 + |