Author: rathann Update of /cvs/free/rpms/mplayer/devel In directory se02.es.rpmfusion.net:/tmp/cvs-serv20975/devel Modified Files: mplayer.spec Added Files: mplayer-CVE-2008-3827.patch Log Message: - security fix for CVE-2008-3827 - sync with devel for F-9 mplayer-CVE-2008-3827.patch: --- NEW FILE mplayer-CVE-2008-3827.patch --- Index: libmpdemux/demux_real.c =================================================================== --- libmpdemux/demux_real.c (revision 27674) +++ libmpdemux/demux_real.c (revision 27675) @@ -947,6 +947,7 @@ // last fragment! if(dp_hdr->len!=vpkg_length-vpkg_offset) mp_msg(MSGT_DEMUX,MSGL_V,"warning! assembled.len=%d frag.len=%d total.len=%d \n",dp->len,vpkg_offset,vpkg_length-vpkg_offset); + if (vpkg_offset > dp->len - sizeof(dp_hdr_t) - dp_hdr->len) vpkg_offset = dp->len - sizeof(dp_hdr_t) - dp_hdr->len; stream_read(demuxer->stream, dp_data+dp_hdr->len, vpkg_offset); if((dp_data[dp_hdr->len]&0x20) && (sh_video->format==0x30335652)) --dp_hdr->chunks; else dp_hdr->len+=vpkg_offset; @@ -970,6 +971,7 @@ // non-last fragment: if(dp_hdr->len!=vpkg_offset) mp_msg(MSGT_DEMUX,MSGL_V,"warning! assembled.len=%d offset=%d frag.len=%d total.len=%d \n",dp->len,vpkg_offset,len,vpkg_length); + if (len > dp->len - sizeof(dp_hdr_t) - dp_hdr->len) len = dp->len - sizeof(dp_hdr_t) - dp_hdr->len; stream_read(demuxer->stream, dp_data+dp_hdr->len, len); if((dp_data[dp_hdr->len]&0x20) && (sh_video->format==0x30335652)) --dp_hdr->chunks; else dp_hdr->len+=len; @@ -992,6 +994,7 @@ extra[0]=1; extra[1]=0; // offset of the first chunk if(0x00==(vpkg_header&0xc0)){ // first fragment: + if (len > dp->len - sizeof(dp_hdr_t)) len = dp->len - sizeof(dp_hdr_t); dp_hdr->len=len; stream_read(demuxer->stream, dp_data, len); ds->asf_packet=dp; Index: mplayer.spec =================================================================== RCS file: /cvs/free/rpms/mplayer/devel/mplayer.spec,v retrieving revision 1.5 retrieving revision 1.6 diff -u -r1.5 -r1.6 --- mplayer.spec 10 Sep 2008 07:34:42 -0000 1.5 +++ mplayer.spec 12 Oct 2008 20:52:06 -0000 1.6 @@ -6,7 +6,7 @@ Name: mplayer Version: 1.0 -Release: 0.99.%{pre}%{?dist} +Release: 0.100.%{pre}%{?dist} Summary: Movie player playing most video formats and DVDs Group: Applications/Multimedia @@ -25,6 +25,7 @@ Patch8: %{name}-manlinks.patch Patch10: %{name}-qcelp.patch Patch12: %{name}-man-zh_CN.patch +Patch13: %{name}-CVE-2008-3827.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: SDL-devel @@ -145,6 +146,7 @@ %patch8 -p1 -b .manlinks %patch10 -p1 -b .qclp %patch12 -p1 -b .man-zh_CN +%patch13 -p0 -b .cve doconv() { iconv -f $1 -t $2 -o DOCS/man/$3/mplayer.1.utf8 DOCS/man/$3/mplayer.1 && \ @@ -386,6 +388,9 @@ %changelog +* Sun Oct 12 2008 Dominik Mierzejewski <rpm at greysector.net> - 1.0-0.100.20080903svn +- backport the fix for CVE-2008-3827 + * Tue Sep 09 2008 Dominik Mierzejewski <rpm at greysector.net> - 1.0-0.99.20080903svn - updated to 20080903 SVN snapshot - added snapshot creation script