diff options
| author | Martin Wilke <miwi@FreeBSD.org> | 2008-10-01 19:23:57 +0000 |
|---|---|---|
| committer | Martin Wilke <miwi@FreeBSD.org> | 2008-10-01 19:23:57 +0000 |
| commit | 3f07868291f442c297c5ba55d4d204af4e83760f (patch) | |
| tree | ad8aef918b1aba57e5b0435a1a51185800bd7624 /multimedia | |
| parent | b1263ba7413df50d7c0be164b7c00f87e12f0d8f (diff) | |
| download | ports-3f07868291f442c297c5ba55d4d204af4e83760f.tar.gz ports-3f07868291f442c297c5ba55d4d204af4e83760f.zip | |
Notes
Diffstat (limited to 'multimedia')
| -rw-r--r-- | multimedia/mplayer/Makefile | 2 | ||||
| -rw-r--r-- | multimedia/mplayer/files/patch-CVE-2008-3827 | 28 |
2 files changed, 29 insertions, 1 deletions
diff --git a/multimedia/mplayer/Makefile b/multimedia/mplayer/Makefile index 941b7e2a1986..91f680f96568 100644 --- a/multimedia/mplayer/Makefile +++ b/multimedia/mplayer/Makefile @@ -7,7 +7,7 @@ PORTNAME= mplayer PORTVERSION= ${MPLAYER_PORT_VERSION} -PORTREVISION= 6 +PORTREVISION= 7 COMMENT= High performance media player supporting many formats diff --git a/multimedia/mplayer/files/patch-CVE-2008-3827 b/multimedia/mplayer/files/patch-CVE-2008-3827 new file mode 100644 index 000000000000..88566fe0b010 --- /dev/null +++ b/multimedia/mplayer/files/patch-CVE-2008-3827 @@ -0,0 +1,28 @@ +Index: libmpdemux/demux_real.c +=================================================================== +--- libmpdemux/demux_real.c (revision 27605) ++++ libmpdemux/demux_real.c (working copy) +@@ -947,6 +947,7 @@ + // last fragment! + if(dp_hdr->len!=vpkg_length-vpkg_offset) + mp_msg(MSGT_DEMUX,MSGL_V,"warning! assembled.len=%d frag.len=%d total.len=%d \n",dp->len,vpkg_offset,vpkg_length-vpkg_offset); ++ if (vpkg_offset > dp->len - sizeof(dp_hdr_t) - dp_hdr->len) vpkg_offset = dp->len - sizeof(dp_hdr_t) - dp_hdr->len; + stream_read(demuxer->stream, dp_data+dp_hdr->len, vpkg_offset); + if((dp_data[dp_hdr->len]&0x20) && (sh_video->format==0x30335652)) --dp_hdr->chunks; else + dp_hdr->len+=vpkg_offset; +@@ -970,6 +971,7 @@ + // non-last fragment: + if(dp_hdr->len!=vpkg_offset) + mp_msg(MSGT_DEMUX,MSGL_V,"warning! assembled.len=%d offset=%d frag.len=%d total.len=%d \n",dp->len,vpkg_offset,len,vpkg_length); ++ if (len > dp->len - sizeof(dp_hdr_t) - dp_hdr->len) len = dp->len - sizeof(dp_hdr_t) - dp_hdr->len; + stream_read(demuxer->stream, dp_data+dp_hdr->len, len); + if((dp_data[dp_hdr->len]&0x20) && (sh_video->format==0x30335652)) --dp_hdr->chunks; else + dp_hdr->len+=len; +@@ -992,6 +994,7 @@ + extra[0]=1; extra[1]=0; // offset of the first chunk + if(0x00==(vpkg_header&0xc0)){ + // first fragment: ++ if (len > dp->len - sizeof(dp_hdr_t)) len = dp->len - sizeof(dp_hdr_t); + dp_hdr->len=len; + stream_read(demuxer->stream, dp_data, len); + ds->asf_packet=dp; |