Hello community, here is the log from the commit of package vlc for openSUSE:Factory checked in at 2016-02-08 09:47:56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/vlc (Old) and /work/SRC/openSUSE:Factory/.vlc.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "vlc" Changes: -------- --- /work/SRC/openSUSE:Factory/vlc/vlc.changes 2016-01-09 23:13:50.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.vlc.new/vlc.changes 2016-02-08 09:47:57.000000000 +0100 @@ -1,0 +2,6 @@ +Fri Feb 5 09:07:03 UTC 2016 - dims...@opensuse.org + +- Add vlc-CVE-2015-5949.patch: demux: mp4: correctly match release + function (boo#965227, CVE-2015-5949). + +------------------------------------------------------------------- New: ---- vlc-CVE-2015-5949.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ vlc.spec ++++++ --- /var/tmp/diff_new_pack.cxgxd1/_old 2016-02-08 09:47:58.000000000 +0100 +++ /var/tmp/diff_new_pack.cxgxd1/_new 2016-02-08 09:47:58.000000000 +0100 @@ -47,6 +47,8 @@ Patch2: vlc-qt5.5-mousepointer.patch Patch3: 0001-no-return-in-non-void.patch Patch4: vlc-2.2.0-fix_deinterlace_mmx.patch +# PATCH-FIX-UPSTREAM vlc-CVE-2015-5949.patch boo#965227 CVE-2015-5949 dims...@opensuse.org -- demux: mp4: correctly match release function +Patch5: vlc-CVE-2015-5949.patch BuildRequires: Mesa-devel BuildRequires: SDL-devel >= 1.2.10 BuildRequires: aalib-devel @@ -313,6 +315,7 @@ %patch4 %endif %endif +%patch5 -p1 ### Fix up sources for LUA 5.3 if pkg-config --atleast-version 5.3 lua; then ++++++ vlc-CVE-2015-5949.patch ++++++ >From ce91452460a75d7424b165c4dc8db98114c3cbd9 Mon Sep 17 00:00:00 2001 From: Francois Cartegnie <fcarteg...@free.fr> Date: Mon, 3 Aug 2015 15:17:32 +0200 Subject: [PATCH 1/1] demux: mp4: correctly match release function Signed-off-by: Jean-Baptiste Kempf <j...@videolan.org> --- modules/demux/mp4/libmp4.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/demux/mp4/libmp4.c b/modules/demux/mp4/libmp4.c index 331262b..f220e51 100644 --- a/modules/demux/mp4/libmp4.c +++ b/modules/demux/mp4/libmp4.c @@ -3643,6 +3643,11 @@ void MP4_BoxFree( stream_t *s, MP4_Box_t *p_box ) { for( i_index = 0; ; i_index++ ) { + if ( MP4_Box_Function[i_index].i_parent && + p_box->p_father && + p_box->p_father->i_type != MP4_Box_Function[i_index].i_parent ) + continue; + if( ( MP4_Box_Function[i_index].i_type == p_box->i_type )|| ( MP4_Box_Function[i_index].i_type == 0 ) ) { -- 1.7.10.4