Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 917274 - <media-video/vlc-3.0.20: out of bounds write for mms://
Summary: <media-video/vlc-3.0.20: out of bounds write for mms://
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL:
Whiteboard: B3 [glsa+]
Keywords:
Depends on: 921386
Blocks:
  Show dependency tree
 
Reported: 2023-11-13 04:38 UTC by Sam James
Modified: 2024-09-22 07:59 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-11-13 04:38:49 UTC 
"""
+Changes between 3.0.19 and 3.0.20:
+----------------------------------
+
+Video Output:
+ - Fix green line in fullscreen in D3D11 video output
+ - Fix crash with some AMD drivers old versions
+ - Fix events propagation issue when double-clicking with mouse wheel
+
+Decoders:
+ - Fix crash when AV1 hardware decoder fails
+
+Interface:
+ - Fix annoying disappearance of the Windows fullscreen controller
+
+Demuxers:
+ - Fix potential security issue (OOB Write) on MMS:// by checking user size bounds
"""
Comment 1 Larry the Git Cow gentoo-dev 2023-11-13 04:45:09 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e531bbb35bd0457360b2f178509dac3ce297eb58

commit e531bbb35bd0457360b2f178509dac3ce297eb58
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-11-13 04:43:19 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-11-13 04:44:10 +0000

    media-video/vlc: add 3.0.20
    
    * Add 3.0.20
    
    * Filter LTO and disable strict aliasing (see bug #861143, very longstanding bug
      upstream)
    
    * Drop obsolete -fcommon passing (obsolete since 3.0.18)
    
    * Pass ESYSROOT for samba workaround
    
    Closes: https://bugs.gentoo.org/861143
    Bug: https://bugs.gentoo.org/917274
    Signed-off-by: Sam James <sam@gentoo.org>

 media-video/vlc/Manifest            |   1 +
 media-video/vlc/vlc-3.0.20.ebuild   | 517 ++++++++++++++++++++++++++++++++++++
 media-video/vlc/vlc-3.0.9999.ebuild |  12 +-
 media-video/vlc/vlc-9999.ebuild     |  12 +-
 4 files changed, 528 insertions(+), 14 deletions(-)
Comment 2 Larry the Git Cow gentoo-dev 2024-09-22 07:58:24 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=adf654e272246b70c63a0f741e7f336f235d0fc8

commit adf654e272246b70c63a0f741e7f336f235d0fc8
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2024-09-22 07:58:11 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2024-09-22 07:58:21 +0000

    [ GLSA 202409-17 ] VLC: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/788226
    Bug: https://bugs.gentoo.org/883943
    Bug: https://bugs.gentoo.org/917274
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 glsa-202409-17.xml | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)