| Index: chromium/patches/ugly/08_enforce_theora_oob.patch
|
| diff --git a/chromium/patches/ugly/08_enforce_theora_oob.patch b/chromium/patches/ugly/08_enforce_theora_oob.patch
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..1be8d098c9860b56871603c50ad67a2540260962
|
| --- /dev/null
|
| +++ b/chromium/patches/ugly/08_enforce_theora_oob.patch
|
| @@ -0,0 +1,43 @@
|
| +diff -wurp -N orig/libavcodec/vp3.c ffmpeg/libavcodec/vp3.c
|
| +--- orig/libavcodec/vp3.c 2011-07-12 20:47:55.102967990 -0700
|
| ++++ ffmpeg/libavcodec/vp3.c 2011-07-12 20:47:55.172931387 -0700
|
| +@@ -866,6 +866,11 @@ static int unpack_vlcs(Vp3DecodeContext
|
| + int num_coeffs = s->num_coded_frags[plane][coeff_index];
|
| + int16_t *dct_tokens = s->dct_tokens[plane][coeff_index];
|
| +
|
| ++#ifdef ALT_BITSTREAM_READER
|
| ++ if (gb->buffer_exhausted && gb->index > gb->size_in_bits)
|
| ++ return 0;
|
| ++#endif
|
| ++
|
| + /* local references to structure members to avoid repeated deferences */
|
| + int *coded_fragment_list = s->coded_fragment_list[plane];
|
| + Vp3Fragment *all_fragments = s->all_fragments;
|
| +@@ -1043,6 +1048,11 @@ static int unpack_dct_coeffs(Vp3DecodeCo
|
| + 2, residual_eob_run);
|
| + }
|
| +
|
| ++#ifdef ALT_BITSTREAM_READER
|
| ++ if (gb->buffer_exhausted && gb->index > gb->size_in_bits)
|
| ++ return 1;
|
| ++#endif
|
| ++
|
| + return 0;
|
| + }
|
| +
|
| +@@ -1836,6 +1846,7 @@ static int vp3_decode_frame(AVCodecConte
|
| + int i;
|
| +
|
| + init_get_bits(&gb, buf, buf_size * 8);
|
| ++ gb.buffer_enforcing = 1;
|
| +
|
| + if (s->theora && get_bits1(&gb))
|
| + {
|
| +@@ -2283,6 +2294,7 @@ static av_cold int theora_decode_init(AV
|
| +
|
| + for(i=0;i<3;i++) {
|
| + init_get_bits(&gb, header_start[i], header_len[i] * 8);
|
| ++ gb.buffer_enforcing = 1;
|
| +
|
| + ptype = get_bits(&gb, 8);
|
| +
|
|
|