diff options
author | wiz <wiz@pkgsrc.org> | 2018-07-26 11:30:01 +0000 |
---|---|---|
committer | wiz <wiz@pkgsrc.org> | 2018-07-26 11:30:01 +0000 |
commit | 1471110b2577869acb60720f74b1002194e6c456 (patch) | |
tree | 3f10b590042873b61cb63ebbd9f218c9f451881d /www/seamonkey/patches | |
parent | 555a346ab5e9ee2a5dd01a31506105f4912d401a (diff) | |
download | pkgsrc-1471110b2577869acb60720f74b1002194e6c456.tar.gz |
seamonkey: remove patch that is already included in upstream
Diffstat (limited to 'www/seamonkey/patches')
-rw-r--r-- | www/seamonkey/patches/patch-CVE-2018-5147 | 79 |
1 files changed, 0 insertions, 79 deletions
diff --git a/www/seamonkey/patches/patch-CVE-2018-5147 b/www/seamonkey/patches/patch-CVE-2018-5147 deleted file mode 100644 index 15faed54bdf..00000000000 --- a/www/seamonkey/patches/patch-CVE-2018-5147 +++ /dev/null @@ -1,79 +0,0 @@ -$NetBSD: patch-CVE-2018-5147,v 1.1 2018/03/17 00:06:17 maya Exp $ - -CVE-2018-5147: Prevent out-of-bounds write in codebook decoding. - -Codebooks that are not an exact divisor of the partition size are now -truncated to fit within the partition. - ---- mozilla/media/libtremor/lib/tremor_codebook.c.orig 2018-02-05 11:49:21.000000000 +0000 -+++ mozilla/media/libtremor/lib/tremor_codebook.c -@@ -258,7 +258,7 @@ long vorbis_book_decodevs_add(codebook * - t[i] = book->valuelist+entry[i]*book->dim; - } - for(i=0,o=0;i<book->dim;i++,o+=step) -- for (j=0;j<step;j++) -+ for (j=0;o+j<n && j<step;j++) - a[o+j]+=t[j][i]>>shift; - }else{ - for (i = 0; i < step; i++) { -@@ -267,7 +267,7 @@ long vorbis_book_decodevs_add(codebook * - t[i] = book->valuelist+entry[i]*book->dim; - } - for(i=0,o=0;i<book->dim;i++,o+=step) -- for (j=0;j<step;j++) -+ for (j=0;o+j<n && j<step;j++) - a[o+j]+=t[j][i]<<-shift; - } - } -@@ -287,7 +287,7 @@ long vorbis_book_decodev_add(codebook *b - entry = decode_packed_entry_number(book,b); - if(entry==-1)return(-1); - t = book->valuelist+entry*book->dim; -- for (j=0;j<book->dim;) -+ for (j=0;i<n && j<book->dim;) - a[i++]+=t[j++]>>shift; - } - }else{ -@@ -295,7 +295,7 @@ long vorbis_book_decodev_add(codebook *b - entry = decode_packed_entry_number(book,b); - if(entry==-1)return(-1); - t = book->valuelist+entry*book->dim; -- for (j=0;j<book->dim;) -+ for (j=0;i<n && j<book->dim;) - a[i++]+=t[j++]<<-shift; - } - } -@@ -352,15 +352,15 @@ long vorbis_book_decodevv_add(codebook * - long i,j,entry; - int chptr=0; - int shift=point-book->binarypoint; -- -+ int m=offset+n; - if(shift>=0){ - -- for(i=offset;i<offset+n;){ -+ for(i=offset;i<m;){ - entry = decode_packed_entry_number(book,b); - if(entry==-1)return(-1); - { - const ogg_int32_t *t = book->valuelist+entry*book->dim; -- for (j=0;j<book->dim;j++){ -+ for (j=0;i<m && j<book->dim;j++){ - a[chptr++][i]+=t[j]>>shift; - if(chptr==ch){ - chptr=0; -@@ -371,12 +371,12 @@ long vorbis_book_decodevv_add(codebook * - } - }else{ - -- for(i=offset;i<offset+n;){ -+ for(i=offset;i<m;){ - entry = decode_packed_entry_number(book,b); - if(entry==-1)return(-1); - { - const ogg_int32_t *t = book->valuelist+entry*book->dim; -- for (j=0;j<book->dim;j++){ -+ for (j=0;i<m && j<book->dim;j++){ - a[chptr++][i]+=t[j]<<-shift; - if(chptr==ch){ - chptr=0; |