axs 14/11/05 23:18:28 Added: firefox-31.0-webm-disallow-negative-samples.patch Log: fixed bugs 528062, 527010; moved IUSE=selinux to the eclass (Portage version: 2.2.8-r2/cvs/Linux x86_64, signed Manifest commit with key 2B6559ED)
Revision Changes Path 1.1 www-client/firefox/files/firefox-31.0-webm-disallow-negative-samples.patch file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/www-client/firefox/files/firefox-31.0-webm-disallow-negative-samples.patch?rev=1.1&view=markup plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/www-client/firefox/files/firefox-31.0-webm-disallow-negative-samples.patch?rev=1.1&content-type=text/plain Index: firefox-31.0-webm-disallow-negative-samples.patch =================================================================== --- a/content/media/webm/WebMReader.cpp 2014-10-20 21:59:39.000000000 -0400 +++ b/content/media/webm/WebMReader.cpp 2014-10-28 09:06:51.959665416 -0400 @@ -668,7 +668,15 @@ return true; } int32_t keepFrames = frames - skipFrames; + if (keepFrames < 0) { + NS_WARNING("Int overflow in keepFrames"); + return false; + } int samples = keepFrames * channels; + if (samples < 0) { + NS_WARNING("Int overflow in samples"); + return false; + } nsAutoArrayPtr<AudioDataValue> trimBuffer(new AudioDataValue[samples]); for (int i = 0; i < samples; i++) trimBuffer[i] = buffer[skipFrames*channels + i]; @@ -691,6 +699,10 @@ int32_t keepFrames = frames - discardFrames.value(); if (keepFrames > 0) { int samples = keepFrames * channels; + if (samples < 0) { + NS_WARNING("Int overflow in samples"); + return false; + } nsAutoArrayPtr<AudioDataValue> trimBuffer(new AudioDataValue[samples]); for (int i = 0; i < samples; i++) trimBuffer[i] = buffer[i];
