Bug 966044 - Fix unconditional single byte buffer overflow in EbmlCom…

…poser::generateHeader(). (r=rillian)
Brli · Jan 31, 2014 · ce1df85 · ce1df85
1 parent ff9a54d
commit ce1df85
Show file tree

Hide file tree

Showing 4 changed files with 43 additions and 9 deletions.
diff --git a/content/media/webm/EbmlComposer.cpp b/content/media/webm/EbmlComposer.cpp
@@ -38,17 +38,14 @@ void EbmlComposer::GenerateHeader()
         EbmlLoc trackLoc;
         Ebml_StartSubElement(&ebml, &trackLoc, Tracks);
         {
-          char cid_string[8];
           // Video
           if (mWidth > 0 && mHeight > 0) {
-            strcpy(cid_string, "V_VP8");
-            writeVideoTrack(&ebml, 0x1, 0, cid_string,
+            writeVideoTrack(&ebml, 0x1, 0, "V_VP8",
                             mWidth, mHeight, mFrameRate);
           }
           // Audio
           if (mCodecPrivateData.Length() > 0) {
-            strcpy(cid_string, "A_VORBIS");
-            writeAudioTrack(&ebml, 0x2, 0x0, cid_string, mSampleFreq,
+            writeAudioTrack(&ebml, 0x2, 0x0, "A_VORBIS", mSampleFreq,
                             mChannels, mCodecPrivateData.Elements(),
                             mCodecPrivateData.Length());
           }

diff --git a/media/libmkv/WebMElement.c b/media/libmkv/WebMElement.c
@@ -56,7 +56,7 @@ static UInt64 generateTrackID(unsigned int trackNumber) {
 }
 
 void writeVideoTrack(EbmlGlobal *glob, unsigned int trackNumber, int flagLacing,
-                     char *codecId, unsigned int pixelWidth, unsigned int pixelHeight,
+                     const char *codecId, unsigned int pixelWidth, unsigned int pixelHeight,
                      double frameRate) {
   EbmlLoc start;
   UInt64 trackID;
@@ -79,7 +79,7 @@ void writeVideoTrack(EbmlGlobal *glob, unsigned int trackNumber, int flagLacing,
   Ebml_EndSubElement(glob, &start); // Track Entry
 }
 void writeAudioTrack(EbmlGlobal *glob, unsigned int trackNumber, int flagLacing,
-                     char *codecId, double samplingFrequency, unsigned int channels,
+                     const char *codecId, double samplingFrequency, unsigned int channels,
                      unsigned char *private, unsigned long privateSize) {
   EbmlLoc start;
   UInt64 trackID;

diff --git a/media/libmkv/WebMElement.h b/media/libmkv/WebMElement.h
@@ -20,10 +20,10 @@ void writeHeader(EbmlGlobal *ebml);
 void writeSegmentInformation(EbmlGlobal *ebml, EbmlLoc *startInfo, unsigned long timeCodeScale, double duration);
 // this function is a helper only, it assumes a lot of defaults
 void writeVideoTrack(EbmlGlobal *ebml, unsigned int trackNumber, int flagLacing,
-                     char *codecId, unsigned int pixelWidth, unsigned int pixelHeight,
+                     const char *codecId, unsigned int pixelWidth, unsigned int pixelHeight,
                      double frameRate);
 void writeAudioTrack(EbmlGlobal *glob, unsigned int trackNumber, int flagLacing,
-                     char *codecId, double samplingFrequency, unsigned int channels,
+                     const char *codecId, double samplingFrequency, unsigned int channels,
                      unsigned char *private_, unsigned long privateSize);
 
 void writeSimpleBlock(EbmlGlobal *ebml, unsigned char trackNumber, short timeCode,

diff --git a/media/libmkv/const_fix.patch b/media/libmkv/const_fix.patch
@@ -0,0 +1,37 @@
+diff --git a/WebMElement.c b/WebMElement.c
+--- a/WebMElement.c
++++ b/WebMElement.c
+@@ -56,7 +56,7 @@
+ }
+
+ void writeVideoTrack(EbmlGlobal *glob, unsigned int trackNumber, int flagLacing,
+-                     char *codecId, unsigned int pixelWidth, unsigned int pixelHeight,
++                     const char *codecId, unsigned int pixelWidth, unsigned int pixelHeight,
+                      double frameRate) {
+   EbmlLoc start;
+   UInt64 trackID;
+@@ -79,7 +79,7 @@
+   Ebml_EndSubElement(glob, &start); // Track Entry
+ }
+ void writeAudioTrack(EbmlGlobal *glob, unsigned int trackNumber, int flagLacing,
+-                     char *codecId, double samplingFrequency, unsigned int channels,
++                     const char *codecId, double samplingFrequency, unsigned int channels,
+                      unsigned char *private, unsigned long privateSize) {
+   EbmlLoc start;
+   UInt64 trackID;
+diff --git a/WebMElement.h b/WebMElement.h
+--- a/WebMElement.h
++++ b/WebMElement.h
+@@ -20,10 +20,10 @@
+ void writeSegmentInformation(EbmlGlobal *ebml, EbmlLoc *startInfo, unsigned long timeCodeScale, double duration);
+ // this function is a helper only, it assumes a lot of defaults
+ void writeVideoTrack(EbmlGlobal *ebml, unsigned int trackNumber, int flagLacing,
+-                     char *codecId, unsigned int pixelWidth, unsigned int pixelHeight,
++                     const char *codecId, unsigned int pixelWidth, unsigned int pixelHeight,
+                      double frameRate);
+ void writeAudioTrack(EbmlGlobal *glob, unsigned int trackNumber, int flagLacing,
+-                     char *codecId, double samplingFrequency, unsigned int channels,
++                     const char *codecId, double samplingFrequency, unsigned int channels,
+                      unsigned char *private_, unsigned long privateSize);
+
+ void writeSimpleBlock(EbmlGlobal *ebml, unsigned char trackNumber, short timeCode,