Blame SOURCES/0002-CVE-2019-9433-VP8-Fix-use-after-free-in-postproc.patch

d88f57
From e8c72275a68e5c566bd780097286522a9cd7f906 Mon Sep 17 00:00:00 2001
d88f57
From: Wim Taymans <wtaymans@redhat.com>
d88f57
Date: Wed, 25 Mar 2020 12:30:32 +0100
d88f57
Subject: [PATCH 2/2] CVE-2019-9433: VP8: Fix use-after-free in postproc.
d88f57
d88f57
The pointer in vp8 postproc refers to show_frame_mi which is only
d88f57
updated on show frame. However, when there is a no-show frame which also
d88f57
changes the size (thus new frame buffers allocated), show_frame_mi is
d88f57
not updated with new frame buffer memory.
d88f57
d88f57
Change the pointer in postproc to mi which is always updated.
d88f57
d88f57
Bug: 842265
d88f57
---
d88f57
 vp8/common/postproc.c | 2 +-
d88f57
 1 file changed, 1 insertion(+), 1 deletion(-)
d88f57
d88f57
diff --git a/vp8/common/postproc.c b/vp8/common/postproc.c
d88f57
index dd998f16e..2693ef017 100644
d88f57
--- a/vp8/common/postproc.c
d88f57
+++ b/vp8/common/postproc.c
d88f57
@@ -334,7 +334,7 @@ void vp8_deblock(VP8_COMMON                 *cm,
d88f57
     double level = 6.0e-05 * q * q * q - .0067 * q * q + .306 * q + .0065;
d88f57
     int ppl = (int)(level + .5);
d88f57
 
d88f57
-    const MODE_INFO *mode_info_context = cm->show_frame_mi;
d88f57
+    const MODE_INFO *mode_info_context = cm->mi;
d88f57
     int mbr, mbc;
d88f57
 
d88f57
     /* The pixel thresholds are adjusted according to if or not the macroblock
d88f57
-- 
d88f57
2.25.1
d88f57