Bug#363127: CVE-2006-1664: Malformed MPEG Stream Buffer Overflow Vulnerability

[Darren Salt]

And another patch, prompted by Martin Michlmayr's posting in debian-devel
about gcc 4.1 being the default for etch. Changelog entry addition:

  * Kill some pointer<->int casting warnings on 64-bit architectures.

(All three fixes are in CVS HEAD; I've just committed two of them.)

-- 
| Darren Salt    | linux or ds at              | nr. Ashington, | Toon
| RISC OS, Linux | youmustbejoking,demon,co,uk | Northumberland | Army
| + Burn less waste. Use less packaging. Waste less.     USE FEWER RESOURCES.

"Well! I've often seen a cat without a grin, but a grin without a cat!"

diff -u xine-lib-1.1.1/src/libffmpeg/libavcodec/h264.c 
xine-lib-1.1.1/src/libffmpeg/libavcodec/h264.c
--- xine-lib-1.1.1/src/libffmpeg/libavcodec/h264.c
+++ xine-lib-1.1.1/src/libffmpeg/libavcodec/h264.c
@@ -386,7 +386,7 @@
     w      *= size;
     stride *= size;
     
-    assert((((int)vp)&(FFMIN(w, STRIDE_ALIGN)-1)) == 0);
+    assert((((long)vp)&(FFMIN(w, STRIDE_ALIGN)-1)) == 0);
     assert((stride&(w-1))==0);
 //FIXME check what gcc generates for 64 bit on x86 and possibly write a 32 bit 
ver of it
     if(w==2 && h==2){
--- xine-lib-1.1.1.orig/src/post/goom/goomsl_heap.c
+++ xine-lib-1.1.1/src/post/goom/goomsl_heap.c
@@ -39,7 +39,7 @@
 {
   if ((alignment > 1) && (_this->number_of_arrays>0)) {
     void *last_array = _this->arrays[_this->number_of_arrays - 1];
-    int   last_address = (int)last_array + _this->consumed_in_last_array;
+    long  last_address = (long)last_array + _this->consumed_in_last_array;
     int   decal = (last_address % alignment);
     if (decal != 0) {
       _this->consumed_in_last_array += alignment - decal;
--- xine-lib-1.1.1.orig/src/dxr3/video_out_dxr3.c
+++ xine-lib-1.1.1/src/dxr3/video_out_dxr3.c
@@ -1203,7 +1203,7 @@
     break;
   case XINE_GUI_SEND_VIDEOWIN_VISIBLE:
     {
-      int window_showing = (int)data;
+      long window_showing = (long)data;
       int val;
       if (!window_showing) {
         llprintf(LOG_VID, "Hiding video window and diverting video to TV\n");