Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 917274 - <media-video/vlc-3.0.20: out of bounds write for mms://
Summary: <media-video/vlc-3.0.20: out of bounds write for mms://
Status: IN_PROGRESS
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [glsa? cleanup]
Keywords:
Depends on: 921386
Blocks:
  Show dependency tree
 
Reported: 2023-11-13 04:38 UTC by Sam James
Modified: 2024-01-06 09:27 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-11-13 04:38:49 UTC 
"""
+Changes between 3.0.19 and 3.0.20:
+----------------------------------
+
+Video Output:
+ - Fix green line in fullscreen in D3D11 video output
+ - Fix crash with some AMD drivers old versions
+ - Fix events propagation issue when double-clicking with mouse wheel
+
+Decoders:
+ - Fix crash when AV1 hardware decoder fails
+
+Interface:
+ - Fix annoying disappearance of the Windows fullscreen controller
+
+Demuxers:
+ - Fix potential security issue (OOB Write) on MMS:// by checking user size bounds
"""
Comment 1 Larry the Git Cow gentoo-dev 2023-11-13 04:45:09 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e531bbb35bd0457360b2f178509dac3ce297eb58

commit e531bbb35bd0457360b2f178509dac3ce297eb58
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-11-13 04:43:19 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-11-13 04:44:10 +0000

    media-video/vlc: add 3.0.20
    
    * Add 3.0.20
    
    * Filter LTO and disable strict aliasing (see bug #861143, very longstanding bug
      upstream)
    
    * Drop obsolete -fcommon passing (obsolete since 3.0.18)
    
    * Pass ESYSROOT for samba workaround
    
    Closes: https://bugs.gentoo.org/861143
    Bug: https://bugs.gentoo.org/917274
    Signed-off-by: Sam James <sam@gentoo.org>

 media-video/vlc/Manifest            |   1 +
 media-video/vlc/vlc-3.0.20.ebuild   | 517 ++++++++++++++++++++++++++++++++++++
 media-video/vlc/vlc-3.0.9999.ebuild |  12 +-
 media-video/vlc/vlc-9999.ebuild     |  12 +-
 4 files changed, 528 insertions(+), 14 deletions(-)