3 files changed, 50 insertions, 1 deletions

diff --git a/multimedia/mencoder/Makefile b/multimedia/mencoder/Makefile
index c3ddec07b827..9be704482eb5 100644
--- a/multimedia/mencoder/Makefile
+++ b/multimedia/mencoder/Makefile
@@ -3,6 +3,7 @@
 
 PORTNAME=	mencoder
 PORTVERSION=	${MPLAYER_PORT_VERSION}
+PORTREVISION=	1
 
 COMMENT=	Convenient video file and movie encoder
 
diff --git a/multimedia/mplayer/Makefile b/multimedia/mplayer/Makefile
index f799e030931c..9c4dcbf24716 100644
--- a/multimedia/mplayer/Makefile
+++ b/multimedia/mplayer/Makefile
@@ -3,7 +3,7 @@
 
 PORTNAME=	mplayer
 PORTVERSION=	${MPLAYER_PORT_VERSION}
-PORTREVISION=	2
+PORTREVISION=	3
 
 COMMENT=	High performance media player supporting many formats
 
diff --git a/multimedia/mplayer/files/patch-CVE-2014-4610 b/multimedia/mplayer/files/patch-CVE-2014-4610
new file mode 100644
index 000000000000..83802fc3e648
--- /dev/null
+++ b/multimedia/mplayer/files/patch-CVE-2014-4610
@@ -0,0 +1,48 @@
+--- ffmpeg/libavutil/lzo.c.orig	2013-05-25 19:20:04.000000000 +0200
++++ ffmpeg/libavutil/lzo.c	2014-06-28 12:23:13.517164344 +0200
+@@ -65,8 +65,13 @@
+ {
+     int cnt = x & mask;
+     if (!cnt) {
+-        while (!(x = get_byte(c)))
++        while (!(x = get_byte(c))) {
++            if (cnt >= INT_MAX - 1000) {
++                c->error |= AV_LZO_ERROR;
++                break;
++            }
+             cnt += 255;
++        }
+         cnt += mask + x;
+     }
+     return cnt;
+@@ -80,6 +85,10 @@
+ {
+     register const uint8_t *src = c->in;
+     register uint8_t *dst       = c->out;
++    if (cnt < 0) {
++        c->error |= AV_LZO_ERROR;
++        return;
++    }
+     if (cnt > c->in_end - src) {
+         cnt       = FFMAX(c->in_end - src, 0);
+         c->error |= AV_LZO_INPUT_DEPLETED;
+@@ -103,7 +112,7 @@
+ /**
+  * @brief Copies previously decoded bytes to current position.
+  * @param back how many bytes back we start, must be > 0
+- * @param cnt number of bytes to copy, must be >= 0
++ * @param cnt number of bytes to copy, must be > 0
+  *
+  * cnt > back is valid, this will copy the bytes we just copied,
+  * thus creating a repeating pattern with a period length of back.
+@@ -111,6 +120,10 @@
+ static inline void copy_backptr(LZOContext *c, int back, int cnt)
+ {
+     register uint8_t *dst       = c->out;
++    if (cnt <= 0) {
++        c->error |= AV_LZO_ERROR;
++        return;
++    }
+     if (dst - c->out_start < back) {
+         c->error |= AV_LZO_INVALID_BACKPTR;
+         return;