| Index: chromium/patches/to_upstream/11b_mkv_buffer_overflow.patch
|
| diff --git a/chromium/patches/to_upstream/11b_mkv_buffer_overflow.patch b/chromium/patches/to_upstream/11b_mkv_buffer_overflow.patch
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..4d9dcc5dbff87f925b446d8c0d06191bb5b1613e
|
| --- /dev/null
|
| +++ b/chromium/patches/to_upstream/11b_mkv_buffer_overflow.patch
|
| @@ -0,0 +1,24 @@
|
| +diff -wurp -N orig/libavformat/matroskadec.c ffmpeg/libavformat/matroskadec.c
|
| +--- orig/libavformat/matroskadec.c 2011-07-12 20:48:14.532933135 -0700
|
| ++++ ffmpeg/libavformat/matroskadec.c 2011-07-12 20:48:14.583029843 -0700
|
| +@@ -672,9 +676,10 @@ static int ebml_read_float(AVIOContext *
|
| + static int ebml_read_ascii(AVIOContext *pb, int size, char **str)
|
| + {
|
| + av_free(*str);
|
| ++ *str = NULL;
|
| + /* EBML strings are usually not 0-terminated, so we allocate one
|
| + * byte more, read the string and NULL-terminate it ourselves. */
|
| +- if (!(*str = av_malloc(size + 1)))
|
| ++ if (size < 0 || !(*str = av_malloc(size + 1)))
|
| + return AVERROR(ENOMEM);
|
| + if (avio_read(pb, (uint8_t *) *str, size) != size) {
|
| + av_freep(str);
|
| +@@ -931,6 +938,8 @@ static int matroska_probe(AVProbeData *p
|
| + * Not fully fool-proof, but good enough. */
|
| + for (i = 0; i < FF_ARRAY_ELEMS(matroska_doctypes); i++) {
|
| + int probelen = strlen(matroska_doctypes[i]);
|
| ++ if (total < probelen)
|
| ++ return 0;
|
| + for (n = 4+size; n <= 4+size+total-probelen; n++)
|
| + if (!memcmp(p->buf+n, matroska_doctypes[i], probelen))
|
| + return AVPROBE_SCORE_MAX;
|
|
|