Skip to content

V
vlc-2-2
Switch branch/tag
  1. 03 Jan, 2015 6 commits
  3. 02 Jan, 2015 4 commits
  5. 31 Dec, 2014 5 commits
  7. 30 Dec, 2014 2 commits
  9. 29 Dec, 2014 1 commit
  11. 19 Dec, 2014 1 commit
  13. 18 Dec, 2014 2 commits
  15. 17 Dec, 2014 10 commits
  17. 13 Dec, 2014 7 commits
  19. 12 Dec, 2014 2 commits
    • Fabian Yamaguchi's avatar
      stream_out: rtp: don't use VLA for user controlled data · 3199c5dd
      Fabian Yamaguchi authored 
      It should fix a possible invalid memory access

When streaming ogg-files via rtp, an ogg-file can trigger an invalid
write access using an overly long 'configuration' string.

The original code attemps to allocate space to hold the string on the stack
and hence, cannot verify if allocation succeeds. Instead, we now allocate the
buffer on the heap and return if allocation fails.

In detail, rtp_packetize_xiph_config allocates a buffer on the stack at (1) where
the size depends on the local variable 'len'. The variable 'len' is
calculated at (0) to be the length of a string contained in a specially
crafted Ogg Vorbis file, and therefore, it is attacker-controlled.
Signed-off-by: default avatarJean-Baptiste Kempf <jb@videolan.org>
(cherry picked from commit 204291467724867b79735c0ee3aeb0dbc2200f97)
Signed-off-by: default avatarJean-Baptiste Kempf <jb@videolan.org>
      3199c5dd
    • Fabian Yamaguchi's avatar
      misc: update: fix buffer overflow in updater · 985d3d78
      Fabian Yamaguchi authored 
      On 32 bit builds, parsing of update status files with a size of
4294967295 or more lead to an integer truncation in a call to malloc
and a subsequent buffer overflow. This happened prior to checking the
files' signature. The commit fixes this by disallowing overly large
status files (above 65k in practice)
Signed-off-by: default avatarJean-Baptiste Kempf <jb@videolan.org>
(cherry picked from commit fbe2837bc80f155c001781041a54c58b5524fc14)
Signed-off-by: default avatarJean-Baptiste Kempf <jb@videolan.org>
      985d3d78