84ebf9d464
* MFSA 2012-57/CVE-2012-1970
Miscellaneous memory safety hazards
* MFSA 2012-58/CVE-2012-1972/CVE-2012-1973/CVE-2012-1974/CVE-2012-1975
CVE-2012-1976/CVE-2012-3956/CVE-2012-3957/CVE-2012-3958/CVE-2012-3959
CVE-2012-3960/CVE-2012-3961/CVE-2012-3962/CVE-2012-3963/CVE-2012-3964
Use-after-free issues found using Address Sanitizer
* MFSA 2012-59/CVE-2012-1956 (bmo#756719)
Location object can be shadowed using Object.defineProperty
* MFSA 2012-60/CVE-2012-3965 (bmo#769108)
Escalation of privilege through about:newtab
* MFSA 2012-61/CVE-2012-3966 (bmo#775794, bmo#775793)
Memory corruption with bitmap format images with negative height
* MFSA 2012-62/CVE-2012-3967/CVE-2012-3968
WebGL use-after-free and memory corruption
* MFSA 2012-63/CVE-2012-3969/CVE-2012-3970
SVG buffer overflow and use-after-free issues
* MFSA 2012-64/CVE-2012-3971
Graphite 2 memory corruption
* MFSA 2012-65/CVE-2012-3972 (bmo#746855)
Out-of-bounds read in format-number in XSLT
* MFSA 2012-66/CVE-2012-3973 (bmo#757128)
HTTPMonitor extension allows for remote debugging without explicit
activation
* MFSA 2012-68/CVE-2012-3975 (bmo#770684)
DOMParser loads linked resources in extensions when parsing
text/html
* MFSA 2012-69/CVE-2012-3976 (bmo#768568)
Incorrect site SSL certificate data display
* MFSA 2012-70/CVE-2012-3978 (bmo#770429)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/MozillaFirefox?expand=0&rev=291
77 lines
2.6 KiB
Diff
77 lines
2.6 KiB
Diff
# HG changeset patch
|
|
# Parent a9a49c20c491011f981b6c110aadfa6a01a1431e
|
|
# User Wolfgang Rosenauer <wr@rosenauer.org>
|
|
Bug 761030 - Crash with HTML 5 video with gstreamer enabled (TM: 16)
|
|
|
|
No Bug - use GStreamer _only_ for MP4 (not WebM/OGG)
|
|
|
|
diff --git a/content/html/content/src/nsHTMLMediaElement.cpp b/content/html/content/src/nsHTMLMediaElement.cpp
|
|
--- a/content/html/content/src/nsHTMLMediaElement.cpp
|
|
+++ b/content/html/content/src/nsHTMLMediaElement.cpp
|
|
@@ -2278,21 +2278,17 @@ nsHTMLMediaElement::CreateDecoder(const
|
|
nsRefPtr<nsRawDecoder> decoder = new nsRawDecoder();
|
|
if (decoder->Init(this)) {
|
|
return decoder.forget();
|
|
}
|
|
}
|
|
#endif
|
|
#ifdef MOZ_OGG
|
|
if (IsOggType(aType)) {
|
|
-#ifdef MOZ_GSTREAMER
|
|
- nsRefPtr<nsGStreamerDecoder> decoder = new nsGStreamerDecoder();
|
|
-#else
|
|
nsRefPtr<nsOggDecoder> decoder = new nsOggDecoder();
|
|
-#endif
|
|
if (decoder->Init(this)) {
|
|
return decoder.forget();
|
|
}
|
|
}
|
|
#endif
|
|
#ifdef MOZ_WAVE
|
|
if (IsWaveType(aType)) {
|
|
nsRefPtr<nsWaveDecoder> decoder = new nsWaveDecoder();
|
|
@@ -2306,21 +2302,17 @@ nsHTMLMediaElement::CreateDecoder(const
|
|
nsRefPtr<nsMediaPluginDecoder> decoder = new nsMediaPluginDecoder(aType);
|
|
if (decoder->Init(this)) {
|
|
return decoder.forget();
|
|
}
|
|
}
|
|
#endif
|
|
#ifdef MOZ_WEBM
|
|
if (IsWebMType(aType)) {
|
|
-#ifdef MOZ_GSTREAMER
|
|
- nsRefPtr<nsGStreamerDecoder> decoder = new nsGStreamerDecoder();
|
|
-#else
|
|
nsRefPtr<nsWebMDecoder> decoder = new nsWebMDecoder();
|
|
-#endif
|
|
if (decoder->Init(this)) {
|
|
return decoder.forget();
|
|
}
|
|
}
|
|
#endif
|
|
|
|
#ifdef MOZ_GSTREAMER
|
|
if (IsH264Type(aType)) {
|
|
diff --git a/content/media/gstreamer/nsGStreamerReader.cpp b/content/media/gstreamer/nsGStreamerReader.cpp
|
|
--- a/content/media/gstreamer/nsGStreamerReader.cpp
|
|
+++ b/content/media/gstreamer/nsGStreamerReader.cpp
|
|
@@ -447,16 +447,18 @@ bool nsGStreamerReader::DecodeVideoFrame
|
|
for(int i = 0; i < 3; i++) {
|
|
b.mPlanes[i].mData = data + gst_video_format_get_component_offset(format, i,
|
|
width, height);
|
|
b.mPlanes[i].mStride = gst_video_format_get_row_stride(format, i, width);
|
|
b.mPlanes[i].mHeight = gst_video_format_get_component_height(format,
|
|
i, height);
|
|
b.mPlanes[i].mWidth = gst_video_format_get_component_width(format,
|
|
i, width);
|
|
+ b.mPlanes[i].mOffset = 0;
|
|
+ b.mPlanes[i].mSkip = 0;
|
|
}
|
|
|
|
bool isKeyframe = !GST_BUFFER_FLAG_IS_SET(buffer,
|
|
GST_BUFFER_FLAG_DELTA_UNIT);
|
|
/* XXX ? */
|
|
PRInt64 offset = 0;
|
|
VideoData *video = VideoData::Create(mInfo,
|
|
mDecoder->GetImageContainer(),
|