gistfile1.txt

====================
ALREADY IN MASTER
====================

--------------------------------------------------------------------------------
CVE-2012-2772
cb7190cd2c691fd93e4d3664f3fce6c19ee001dd
master - CommitDate: Fri Mar 23 23:11:55 2012 +0100
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2785
326f7a68bbd429c63fd2f19f4050658982b5b081
master - CommitDate: Thu Mar 22 12:17:14 2012 -0700
d462949974668ffb013467d12dc4934b9106fe19
master - CommitDate: Thu Mar 22 12:17:14 2012 -0700
--------------------------------------------------------------------------------


====================
INDEO
====================

--------------------------------------------------------------------------------
CVE-2012-2776
ba775a54bc2136ec5da85385a923b05ee6fab159
indeo3: fix out of picture write.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2779
229e4c133287955d5f3f837520a3602709b21950
indeo5dec: Make sure we have had a valid gop header.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2787
01bf2ad7351fdaa2e21b6bdf963d22d6ffccb920
indeo4: setup width/height properly.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2791
0846719dd11ab3f7a7caee13e7af71f71d913389
indeo4: check transform size.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2794
5ad7335ebac2b38bb2a1c8df51a500b78461c05a
indeo5: check tile size in decode_mb_info().
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2800
f0bf9e9c2a65e9a2b9d9e4e94f99acb191dc7ae7
indeo: Check allocated tile size in ff_ivi_process_empty_tile()
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2804
4a80ebe491609e04110a1dd540a0ca79d3be3d04
indeo3: Fix reallocation code so that it doesnt become inconsistent.
--------------------------------------------------------------------------------


====================
MISC VIDEO
====================

--------------------------------------------------------------------------------
CVE-2012-2774
59a4b73531428d2f420b4dad545172c8483ced0f
pthread/mpegvideo: detect and block attempts to init frames after setup.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2777
25715064c2ef4978672a91f8c856f3e8809a7c45
cavsdec: check for changing w/h.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2782
9a57a37b7041581c10629c8241260a5d7bfbc1e7
h264: move resolution change check further up.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2783
d85b3c4fff4c4b255232fcc01edbd57f19d60998
vp56dec: avoid freeing the returned frame before returning it.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2784
25715064c2ef4978672a91f8c856f3e8809a7c45
cavsdec: check for changing w/h.

See also CVE-2012-2777
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2786
d1c95d2ce39560e251fdb14f4af91b04fd7b845c
dfa: fix out of array write in decode_wdlt()
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2793
83c7803f55b3231faeb93c1a634399a70fae9480
lagarith: check count before writing zeros.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2796
5e59a77cec804a9b44c60ea22c17beba6453ef23
vc1dec: check that coded slice positions and interlacing match.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2798
72b9537d8886f679494651df517dfed9b420cf1f
dfa: Fix out of array write in decode_dds1()
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2801
1df49142bab1b7bccd11392aa9e819e297d21a6e
avsdec: Set dimensions instead of relying on the demuxer.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2803
951cbea56fdc03ef96d07fbd7e5bed755d42ac8a
mpeg12dec: reset data size after parsing extradata.
--------------------------------------------------------------------------------


====================
WMA
====================

--------------------------------------------------------------------------------
CVE-2012-2789
97a5addfcf0029d0f5538ed70cb38cae4108a618
wmaprodec: check num_vec_coeffs for validity
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2792
d442c4462a2692e27a24e1a9d0eb6f18725c7bd8
wmalosslessdec: Make arrays WMALL_BLOCK_MAX_SIZE big and check samples_per_frame
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2795
a0abefb0af64a311b15141062c77dd577ba590a3
wmalosslessdec: make mclms arrays big enough for whats written into them.

2a7063de547b1d8fb1cef523469390fb59fb2c50
wmalosslessdec: fix a get_bits(0) in decode_ac_filter

b3a43515827f3d22a881c33b87384f01c86786fd
wmalosslessdec: Fix reading too many bits in decode_channel_residues()
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2799
64bd7f8e4db1742e86c5ed02bd530688b74063e3
wmalosslessdec: Reset put bit buffer when num_saved_bits is reset.
--------------------------------------------------------------------------------


====================
MISC AUDIO
====================

--------------------------------------------------------------------------------
CVE-2012-2775
9d3032b960ae03066c008d6e6774f68b17a1d69d
alsdec: check opt_order.

cherry-pick - sent
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2790
2837d8dc276760db1821b81df3f794a90bfa56e6
alsdec: fix number of decoded samples in first sub-block in BGMC mode.

cherry-pick - sent
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2797
cca9528524c7a4b91451f4322bd50849af5d057e
mp3on4: allocate a large enough frame.

looks completely wrong to me
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
CVE-2012-2802
2c22701c371c2f3dea21fcdbb97c981939fb77af
ac3dec: Check number of output channels.

fix differently - set avctx->channels = s->out_channels
--------------------------------------------------------------------------------


====================
LIBAVFORMAT
====================

--------------------------------------------------------------------------------
CVE-2012-2788
c41ac870470c614185e1752c11f892809022248a
avidec: update size when packet is shrunk
--------------------------------------------------------------------------------