|
 |
9b6b30 |
From d06fa15d1c113edea0d6760ea19af8e8d0af0d94 Mon Sep 17 00:00:00 2001
|
|
|
9b6b30 |
From: James Zern <jzern@google.com>
|
|
|
9b6b30 |
Date: Fri, 7 Jun 2019 15:06:29 -0700
|
|
|
9b6b30 |
Subject: [PATCH 4/4] CVE-2019-2126: update libwebm to
|
|
|
9b6b30 |
libwebm-1.0.0.27-361-g81de00c
|
|
|
9b6b30 |
|
|
|
9b6b30 |
81de00c Check there is only one settings per ContentCompression
|
|
|
9b6b30 |
5623013 Fixes a double free in ContentEncoding
|
|
|
9b6b30 |
93b2ba0 mkvparser: quiet static analysis warnings
|
|
|
9b6b30 |
|
|
|
9b6b30 |
Change-Id: Ieaa562ef2f10075381bd856388e6b29f97ca2746
|
|
|
9b6b30 |
---
|
|
|
9b6b30 |
third_party/libwebm/README.libvpx | 2 +-
|
|
|
9b6b30 |
third_party/libwebm/mkvparser/mkvparser.cc | 9 +++++++++
|
|
|
9b6b30 |
2 files changed, 10 insertions(+), 1 deletion(-)
|
|
|
9b6b30 |
|
|
|
9b6b30 |
diff --git a/third_party/libwebm/README.libvpx b/third_party/libwebm/README.libvpx
|
|
|
9b6b30 |
index 16f17513e..714f5d0eb 100644
|
|
|
9b6b30 |
--- a/third_party/libwebm/README.libvpx
|
|
|
9b6b30 |
+++ b/third_party/libwebm/README.libvpx
|
|
|
9b6b30 |
@@ -1,5 +1,5 @@
|
|
|
9b6b30 |
URL: https://chromium.googlesource.com/webm/libwebm
|
|
|
9b6b30 |
-Version: dbf1d1089756e7cb5b1a04d6752310ef35912347
|
|
|
9b6b30 |
+Version: 81de00c43ea3c087b48a8c20337db7531b9f7612
|
|
|
9b6b30 |
License: BSD
|
|
|
9b6b30 |
License File: LICENSE.txt
|
|
|
9b6b30 |
|
|
|
9b6b30 |
diff --git a/third_party/libwebm/mkvparser/mkvparser.cc b/third_party/libwebm/mkvparser/mkvparser.cc
|
|
|
9b6b30 |
index dcb969dcf..ace65bd59 100644
|
|
|
9b6b30 |
--- a/third_party/libwebm/mkvparser/mkvparser.cc
|
|
|
9b6b30 |
+++ b/third_party/libwebm/mkvparser/mkvparser.cc
|
|
|
9b6b30 |
@@ -4230,6 +4230,7 @@ long ContentEncoding::ParseContentEncodingEntry(long long start, long long size,
|
|
|
9b6b30 |
new (std::nothrow) ContentEncryption*[encryption_count];
|
|
|
9b6b30 |
if (!encryption_entries_) {
|
|
|
9b6b30 |
delete[] compression_entries_;
|
|
|
9b6b30 |
+ compression_entries_ = NULL;
|
|
|
9b6b30 |
return -1;
|
|
|
9b6b30 |
}
|
|
|
9b6b30 |
encryption_entries_end_ = encryption_entries_;
|
|
|
9b6b30 |
@@ -4261,6 +4262,7 @@ long ContentEncoding::ParseContentEncodingEntry(long long start, long long size,
|
|
|
9b6b30 |
delete compression;
|
|
|
9b6b30 |
return status;
|
|
|
9b6b30 |
}
|
|
|
9b6b30 |
+ assert(compression_count > 0);
|
|
|
9b6b30 |
*compression_entries_end_++ = compression;
|
|
|
9b6b30 |
} else if (id == libwebm::kMkvContentEncryption) {
|
|
|
9b6b30 |
ContentEncryption* const encryption =
|
|
|
9b6b30 |
@@ -4273,6 +4275,7 @@ long ContentEncoding::ParseContentEncodingEntry(long long start, long long size,
|
|
|
9b6b30 |
delete encryption;
|
|
|
9b6b30 |
return status;
|
|
|
9b6b30 |
}
|
|
|
9b6b30 |
+ assert(encryption_count > 0);
|
|
|
9b6b30 |
*encryption_entries_end_++ = encryption;
|
|
|
9b6b30 |
}
|
|
|
9b6b30 |
|
|
|
9b6b30 |
@@ -4325,6 +4328,12 @@ long ContentEncoding::ParseCompressionEntry(long long start, long long size,
|
|
|
9b6b30 |
return status;
|
|
|
9b6b30 |
}
|
|
|
9b6b30 |
|
|
|
9b6b30 |
+ // There should be only one settings element per content compression.
|
|
|
9b6b30 |
+ if (compression->settings != NULL) {
|
|
|
9b6b30 |
+ delete[] buf;
|
|
|
9b6b30 |
+ return E_FILE_FORMAT_INVALID;
|
|
|
9b6b30 |
+ }
|
|
|
9b6b30 |
+
|
|
|
9b6b30 |
compression->settings = buf;
|
|
|
9b6b30 |
compression->settings_len = buflen;
|
|
|
9b6b30 |
}
|
|
|
9b6b30 |
--
|
|
|
9b6b30 |
2.25.1
|
|
|
9b6b30 |
|