[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
02/02: gnu: icecat: Add fixes for several security flaws.
|
From: |
Mark H. Weaver |
|
Subject: |
02/02: gnu: icecat: Add fixes for several security flaws. |
|
Date: |
Thu, 17 Dec 2015 19:12:24 +0000 |
mhw pushed a commit to branch master
in repository guix.
commit 3faf214a0b58c10e9838fcbf59f139172fe4a871
Author: Mark H Weaver <address@hidden>
Date: Thu Dec 17 12:07:13 2015 -0500
gnu: icecat: Add fixes for several security flaws.
* gnu/packages/patches/icecat-CVE-2015-7201-pt1.patch,
gnu/packages/patches/icecat-CVE-2015-7201-pt2.patch,
gnu/packages/patches/icecat-CVE-2015-7201-pt3.patch,
gnu/packages/patches/icecat-CVE-2015-7205.patch,
gnu/packages/patches/icecat-CVE-2015-7210.patch,
gnu/packages/patches/icecat-CVE-2015-7212.patch,
gnu/packages/patches/icecat-CVE-2015-7213-pt1.patch,
gnu/packages/patches/icecat-CVE-2015-7213-pt2.patch,
gnu/packages/patches/icecat-CVE-2015-7214.patch,
gnu/packages/patches/icecat-CVE-2015-7222-pt1.patch,
gnu/packages/patches/icecat-CVE-2015-7222-pt2.patch,
gnu/packages/patches/icecat-CVE-2015-7222-pt3.patch: New files.
* gnu-system.am (dist_patch_DATA): Add them.
* gnu/packages/gnuzilla.scm (icecat)[source]: Add patches.
---
gnu-system.am | 12 +
gnu/packages/gnuzilla.scm | 14 +-
.../patches/icecat-CVE-2015-7201-pt1.patch | 123 +++++++
.../patches/icecat-CVE-2015-7201-pt2.patch | 29 ++
.../patches/icecat-CVE-2015-7201-pt3.patch | 35 ++
gnu/packages/patches/icecat-CVE-2015-7205.patch | 84 +++++
gnu/packages/patches/icecat-CVE-2015-7210.patch | 47 +++
gnu/packages/patches/icecat-CVE-2015-7212.patch | 364 ++++++++++++++++++++
.../patches/icecat-CVE-2015-7213-pt1.patch | 32 ++
.../patches/icecat-CVE-2015-7213-pt2.patch | 27 ++
gnu/packages/patches/icecat-CVE-2015-7214.patch | 47 +++
.../patches/icecat-CVE-2015-7222-pt1.patch | 112 ++++++
.../patches/icecat-CVE-2015-7222-pt2.patch | 34 ++
.../patches/icecat-CVE-2015-7222-pt3.patch | 37 ++
14 files changed, 996 insertions(+), 1 deletions(-)
diff --git a/gnu-system.am b/gnu-system.am
index 0039246..09525da 100644
--- a/gnu-system.am
+++ b/gnu-system.am
@@ -510,6 +510,18 @@ dist_patch_DATA =
\
gnu/packages/patches/hop-linker-flags.patch \
gnu/packages/patches/hydra-automake-1.15.patch \
gnu/packages/patches/hydra-disable-darcs-test.patch \
+ gnu/packages/patches/icecat-CVE-2015-7201-pt1.patch \
+ gnu/packages/patches/icecat-CVE-2015-7201-pt2.patch \
+ gnu/packages/patches/icecat-CVE-2015-7201-pt3.patch \
+ gnu/packages/patches/icecat-CVE-2015-7205.patch \
+ gnu/packages/patches/icecat-CVE-2015-7210.patch \
+ gnu/packages/patches/icecat-CVE-2015-7212.patch \
+ gnu/packages/patches/icecat-CVE-2015-7213-pt1.patch \
+ gnu/packages/patches/icecat-CVE-2015-7213-pt2.patch \
+ gnu/packages/patches/icecat-CVE-2015-7214.patch \
+ gnu/packages/patches/icecat-CVE-2015-7222-pt1.patch \
+ gnu/packages/patches/icecat-CVE-2015-7222-pt2.patch \
+ gnu/packages/patches/icecat-CVE-2015-7222-pt3.patch \
gnu/packages/patches/icecat-avoid-bundled-includes.patch \
gnu/packages/patches/icecat-freetype-2.6.patch \
gnu/packages/patches/icu4c-CVE-2014-6585.patch \
diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
index 6d134a8..8125a26 100644
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@@ -276,7 +276,19 @@ standards.")
(sha256
(base32
"0rcaa19rfgclwd2qvcz8798m57jjzra6kaxg5dniysajvx7qndfp"))
- (patches (map search-patch '("icecat-avoid-bundled-includes.patch"
+ (patches (map search-patch '("icecat-CVE-2015-7210.patch"
+ "icecat-CVE-2015-7205.patch"
+ "icecat-CVE-2015-7201-pt1.patch"
+ "icecat-CVE-2015-7201-pt2.patch"
+ "icecat-CVE-2015-7212.patch"
+ "icecat-CVE-2015-7213-pt1.patch"
+ "icecat-CVE-2015-7213-pt2.patch"
+ "icecat-CVE-2015-7222-pt1.patch"
+ "icecat-CVE-2015-7222-pt2.patch"
+ "icecat-CVE-2015-7222-pt3.patch"
+ "icecat-CVE-2015-7214.patch"
+ "icecat-CVE-2015-7201-pt3.patch"
+ "icecat-avoid-bundled-includes.patch"
"icecat-freetype-2.6.patch")))
(modules '((guix build utils)))
(snippet
diff --git a/gnu/packages/patches/icecat-CVE-2015-7201-pt1.patch
b/gnu/packages/patches/icecat-CVE-2015-7201-pt1.patch
new file mode 100644
index 0000000..0fcfe9b
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7201-pt1.patch
@@ -0,0 +1,123 @@
+From e2bbd632e220be7626efd34acb9a517430d36004 Mon Sep 17 00:00:00 2001
+From: Andrew Comminos <address@hidden>
+Date: Fri, 23 Oct 2015 21:35:16 -0700
+Subject: [PATCH] Bug 1203135 - Terminate linking if maximum vertex attribute
+ count is exceeded on Mesa. r=jgilbert, a=ritu
+
+--HG--
+extra : source : 8021382da9722db0ad97ebd93698b69a74f0d9b0
+extra : intermediate-source : 90eff805d2810e9d9ea88f6869335b0500b1a536
+---
+ dom/canvas/WebGLProgram.cpp | 28 ++++++++++++++++++----------
+ dom/canvas/WebGLShader.cpp | 10 ++++++++++
+ dom/canvas/WebGLShader.h | 1 +
+ dom/canvas/WebGLShaderValidator.cpp | 6 ++++++
+ dom/canvas/WebGLShaderValidator.h | 1 +
+ 5 files changed, 36 insertions(+), 10 deletions(-)
+
+diff --git a/dom/canvas/WebGLProgram.cpp b/dom/canvas/WebGLProgram.cpp
+index 78f7413..0e056e8 100644
+--- a/dom/canvas/WebGLProgram.cpp
++++ b/dom/canvas/WebGLProgram.cpp
+@@ -569,18 +569,26 @@ WebGLProgram::LinkProgram()
+ gl::GLContext* gl = mContext->gl;
+ gl->MakeCurrent();
+
+- // Bug 777028: Mesa can't handle more than 16 samplers per program,
+- // counting each array entry.
+- size_t numSamplerUniforms_upperBound =
mVertShader->CalcNumSamplerUniforms() +
+-
mFragShader->CalcNumSamplerUniforms();
+ if (gl->WorkAroundDriverBugs() &&
+- mContext->mIsMesa &&
+- numSamplerUniforms_upperBound > 16)
++ mContext->mIsMesa)
+ {
+- mLinkLog.AssignLiteral("Programs with more than 16 samplers are
disallowed on"
+- " Mesa drivers to avoid crashing.");
+- mContext->GenerateWarning("linkProgram: %s", mLinkLog.BeginReading());
+- return false;
++ // Bug 777028: Mesa can't handle more than 16 samplers per program,
++ // counting each array entry.
++ size_t numSamplerUniforms_upperBound =
mVertShader->CalcNumSamplerUniforms() +
++
mFragShader->CalcNumSamplerUniforms();
++ if (numSamplerUniforms_upperBound > 16) {
++ mLinkLog.AssignLiteral("Programs with more than 16 samplers are
disallowed on"
++ " Mesa drivers to avoid crashing.");
++ mContext->GenerateWarning("linkProgram: %s",
mLinkLog.BeginReading());
++ return false;
++ }
++
++ // Bug 1203135: Mesa crashes internally if we exceed the reported
maximum attribute count.
++ if (mVertShader->NumAttributes() > mContext->MaxVertexAttribs()) {
++ mLinkLog.AssignLiteral("Number of attributes exceeds Mesa's
reported max attribute count.");
++ mContext->GenerateWarning("linkProgram: %s",
mLinkLog.BeginReading());
++ return false;
++ }
+ }
+
+ // Bind the attrib locations.
+diff --git a/dom/canvas/WebGLShader.cpp b/dom/canvas/WebGLShader.cpp
+index 85a3809..bab4157 100644
+--- a/dom/canvas/WebGLShader.cpp
++++ b/dom/canvas/WebGLShader.cpp
+@@ -299,6 +299,16 @@ WebGLShader::CalcNumSamplerUniforms() const
+ return 0;
+ }
+
++size_t
++WebGLShader::NumAttributes() const
++{
++ if (mValidator)
++ return mValidator->NumAttributes();
++
++ // TODO
++ return 0;
++}
++
+ void
+ WebGLShader::BindAttribLocation(GLuint prog, const nsCString& userName,
+ GLuint index) const
+diff --git a/dom/canvas/WebGLShader.h b/dom/canvas/WebGLShader.h
+index 698e30c..2c80b16a 100644
+--- a/dom/canvas/WebGLShader.h
++++ b/dom/canvas/WebGLShader.h
+@@ -45,6 +45,7 @@ public:
+ // Util funcs
+ bool CanLinkTo(const WebGLShader* prev, nsCString* const out_log) const;
+ size_t CalcNumSamplerUniforms() const;
++ size_t NumAttributes() const;
+ void BindAttribLocation(GLuint prog, const nsCString& userName, GLuint
index) const;
+ bool FindAttribUserNameByMappedName(const nsACString& mappedName,
+ nsDependentCString* const
out_userName) const;
+diff --git a/dom/canvas/WebGLShaderValidator.cpp
b/dom/canvas/WebGLShaderValidator.cpp
+index 80005e2..8bedf88 100644
+--- a/dom/canvas/WebGLShaderValidator.cpp
++++ b/dom/canvas/WebGLShaderValidator.cpp
+@@ -274,6 +274,12 @@ ShaderValidator::CalcNumSamplerUniforms() const
+ return accum;
+ }
+
++size_t
++ShaderValidator::NumAttributes() const
++{
++ return ShGetAttributes(mHandle)->size();
++}
++
+ // Attribs cannot be structs or arrays, and neither can vertex inputs in ES3.
+ // Therefore, attrib names are always simple.
+ bool
+diff --git a/dom/canvas/WebGLShaderValidator.h
b/dom/canvas/WebGLShaderValidator.h
+index 35db2f1..1f794bf0 100644
+--- a/dom/canvas/WebGLShaderValidator.h
++++ b/dom/canvas/WebGLShaderValidator.h
+@@ -41,6 +41,7 @@ public:
+ void GetOutput(nsACString* out) const;
+ bool CanLinkTo(const ShaderValidator* prev, nsCString* const out_log)
const;
+ size_t CalcNumSamplerUniforms() const;
++ size_t NumAttributes() const;
+
+ bool FindAttribUserNameByMappedName(const std::string& mappedName,
+ const std::string** const
out_userName) const;
+--
+2.6.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-7201-pt2.patch
b/gnu/packages/patches/icecat-CVE-2015-7201-pt2.patch
new file mode 100644
index 0000000..3764371
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7201-pt2.patch
@@ -0,0 +1,29 @@
+From f02e3252391f5fa79916e4c8f30b3d8340d06cc7 Mon Sep 17 00:00:00 2001
+From: "Carsten \"Tomcat\" Book" <address@hidden>
+Date: Tue, 8 Dec 2015 12:38:15 +0100
+Subject: [PATCH] Bug 1225250 - fix stride on SourceSurfaceSkia when
+ initialized from GPU texture. r=jmuizelaar, a=lizzard
+
+---
+ gfx/2d/SourceSurfaceSkia.cpp | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/gfx/2d/SourceSurfaceSkia.cpp b/gfx/2d/SourceSurfaceSkia.cpp
+index 4b95bc2..d7e0714 100644
+--- a/gfx/2d/SourceSurfaceSkia.cpp
++++ b/gfx/2d/SourceSurfaceSkia.cpp
+@@ -110,8 +110,10 @@ SourceSurfaceSkia::InitFromTexture(DrawTargetSkia* aOwner,
+ GrTexture *skiaTexture =
aOwner->mGrContext->wrapBackendTexture(skiaTexGlue);
+ SkImageInfo imgInfo = SkImageInfo::Make(aSize.width, aSize.height,
GfxFormatToSkiaColorType(aFormat), kOpaque_SkAlphaType);
+ SkGrPixelRef *texRef = new SkGrPixelRef(imgInfo, skiaTexture, false);
+- mBitmap.setInfo(imgInfo, aSize.width*aSize.height*4);
++ mBitmap.setInfo(imgInfo);
+ mBitmap.setPixelRef(texRef);
++ mFormat = aFormat;
++ mStride = mBitmap.rowBytes();
+
+ mDrawTarget = aOwner;
+ return true;
+--
+2.6.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-7201-pt3.patch
b/gnu/packages/patches/icecat-CVE-2015-7201-pt3.patch
new file mode 100644
index 0000000..022ab5c
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7201-pt3.patch
@@ -0,0 +1,35 @@
+From 567a97b6347ac8c2b93ec788c437b7e9bb23ef75 Mon Sep 17 00:00:00 2001
+From: Edwin Flores <address@hidden>
+Date: Wed, 2 Dec 2015 16:15:29 +0100
+Subject: [PATCH] Bug 1224100 - Initialize padding to 0 in Downscaler. r=seth,
+ a=sledru
+
+---
+ image/src/Downscaler.cpp | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/image/src/Downscaler.cpp b/image/src/Downscaler.cpp
+index 24ecfda..2a7acfd 100644
+--- a/image/src/Downscaler.cpp
++++ b/image/src/Downscaler.cpp
+@@ -86,11 +86,16 @@ Downscaler::BeginFrame(const nsIntSize& aOriginalSize,
+ mTargetSize.height, mYFilter.get());
+
+ // Allocate the buffer, which contains scanlines of the original image.
+- mRowBuffer = MakeUnique<uint8_t[]>(mOriginalSize.width * sizeof(uint32_t));
++ size_t bufferLen = mOriginalSize.width * sizeof(uint32_t);
++ mRowBuffer = MakeUnique<uint8_t[]>(bufferLen);
+ if (MOZ_UNLIKELY(!mRowBuffer)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
++ // Zero buffer to keep valgrind happy.
++ memset(mRowBuffer.get(), 0, bufferLen);
++
++
+ // Allocate the window, which contains horizontally downscaled scanlines.
(We
+ // can store scanlines which are already downscale because our downscaling
+ // filter is separable.)
+--
+2.6.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-7205.patch
b/gnu/packages/patches/icecat-CVE-2015-7205.patch
new file mode 100644
index 0000000..620fa0d
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7205.patch
@@ -0,0 +1,84 @@
+From 20df7b0b3f3e7dd201c9811bbb1e6515da8da359 Mon Sep 17 00:00:00 2001
+From: Randell Jesup <address@hidden>
+Date: Thu, 5 Nov 2015 10:17:29 -0500
+Subject: [PATCH] Bug 1220493 - validate RTP packets against underflows.
+ r=pkerr a=sylvestre
+
+--HG--
+extra : source : 575d3aa376b1c8e7507d94833f7b74bf963127cb
+extra : intermediate-source : 2c1b396ef5c3e2424fb9af56d86ebf6f6551a997
+---
+ .../webrtc/modules/rtp_rtcp/source/rtp_utility.cc | 26 ++++++++++++----------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/media/webrtc/trunk/webrtc/modules/rtp_rtcp/source/rtp_utility.cc
b/media/webrtc/trunk/webrtc/modules/rtp_rtcp/source/rtp_utility.cc
+index 9334b23..80cf55a 100644
+--- a/media/webrtc/trunk/webrtc/modules/rtp_rtcp/source/rtp_utility.cc
++++ b/media/webrtc/trunk/webrtc/modules/rtp_rtcp/source/rtp_utility.cc
+@@ -338,12 +338,6 @@ bool RtpHeaderParser::Parse(RTPHeader& header,
+ return false;
+ }
+
+- const uint8_t CSRCocts = CC * 4;
+-
+- if ((ptr + CSRCocts) > _ptrRTPDataEnd) {
+- return false;
+- }
+-
+ header.markerBit = M;
+ header.payloadType = PT;
+ header.sequenceNumber = sequenceNumber;
+@@ -352,6 +346,14 @@ bool RtpHeaderParser::Parse(RTPHeader& header,
+ header.numCSRCs = CC;
+ header.paddingLength = P ? *(_ptrRTPDataEnd - 1) : 0;
+
++ // 12 == sizeof(RFC rtp header) == kRtpMinParseLength, each CSRC=4 bytes
++ header.headerLength = 12 + (CC * 4);
++ // not a full validation, just safety against underflow. Padding must
++ // start after the header. We can have 0 payload bytes left, note.
++ if (header.paddingLength + header.headerLength > length) {
++ return false;
++ }
++
+ for (unsigned int i = 0; i < CC; ++i) {
+ uint32_t CSRC = *ptr++ << 24;
+ CSRC += *ptr++ << 16;
+@@ -359,8 +361,7 @@ bool RtpHeaderParser::Parse(RTPHeader& header,
+ CSRC += *ptr++;
+ header.arrOfCSRCs[i] = CSRC;
+ }
+-
+- header.headerLength = 12 + CSRCocts;
++ assert((ptr - _ptrRTPDataBegin) == header.headerLength);
+
+ // If in effect, MAY be omitted for those packets for which the offset
+ // is zero.
+@@ -385,8 +386,9 @@ bool RtpHeaderParser::Parse(RTPHeader& header,
+ | header extension |
+ | .... |
+ */
+- const ptrdiff_t remain = _ptrRTPDataEnd - ptr;
+- if (remain < 4) {
++ // earlier test ensures we have at least paddingLength bytes left
++ const ptrdiff_t remain = (_ptrRTPDataEnd - ptr) - header.paddingLength;
++ if (remain < 4) { // minimum header extension length = 32 bits
+ return false;
+ }
+
+@@ -395,11 +397,11 @@ bool RtpHeaderParser::Parse(RTPHeader& header,
+ uint16_t definedByProfile = *ptr++ << 8;
+ definedByProfile += *ptr++;
+
+- uint16_t XLen = *ptr++ << 8;
++ size_t XLen = *ptr++ << 8;
+ XLen += *ptr++; // in 32 bit words
+ XLen *= 4; // in octs
+
+- if (remain < (4 + XLen)) {
++ if (remain < (4 + XLen)) { // we already accounted for padding
+ return false;
+ }
+ if (definedByProfile == kRtpOneByteHeaderExtensionId) {
+--
+2.6.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-7210.patch
b/gnu/packages/patches/icecat-CVE-2015-7210.patch
new file mode 100644
index 0000000..eab5702
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7210.patch
@@ -0,0 +1,47 @@
+From 4e0cd9ba4924869f91be0e7c8cf666182bb75f90 Mon Sep 17 00:00:00 2001
+From: "Byron Campen [:bwc]" <address@hidden>
+Date: Wed, 28 Oct 2015 12:48:17 -0500
+Subject: [PATCH] Bug 1218326 - Prevent datachannel operations on closed
+ PeerConnections. r=jesup a=sylvestre
+
+--HG--
+extra : source : a7637b62d9b5ab73f58e5aa3c663d7d35b624826
+extra : intermediate-source : d8f0412f38f75040064157d8d2b0140df21600e6
+---
+ media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
+index c3d8d26..fe86ff7 100644
+--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
++++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
+@@ -1004,7 +1004,7 @@ PeerConnectionImpl::GetIdentity() const
+ NS_IMETHODIMP
+ PeerConnectionImpl::EnsureDataConnection(uint16_t aNumstreams)
+ {
+- PC_AUTO_ENTER_API_CALL_NO_CHECK();
++ PC_AUTO_ENTER_API_CALL(false);
+
+ #ifdef MOZILLA_INTERNAL_API
+ if (mDataConnection) {
+@@ -1102,7 +1102,7 @@ PeerConnectionImpl::GetDatachannelParameters(
+ nsresult
+ PeerConnectionImpl::InitializeDataChannel()
+ {
+- PC_AUTO_ENTER_API_CALL_NO_CHECK();
++ PC_AUTO_ENTER_API_CALL(false);
+ CSFLogDebug(logTag, "%s", __FUNCTION__);
+
+ const JsepApplicationCodecDescription* codec;
+@@ -1184,7 +1184,7 @@ PeerConnectionImpl::CreateDataChannel(const nsAString&
aLabel,
+ uint16_t aStream,
+ nsDOMDataChannel** aRetval)
+ {
+- PC_AUTO_ENTER_API_CALL_NO_CHECK();
++ PC_AUTO_ENTER_API_CALL(false);
+ MOZ_ASSERT(aRetval);
+
+ #ifdef MOZILLA_INTERNAL_API
+--
+2.6.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-7212.patch
b/gnu/packages/patches/icecat-CVE-2015-7212.patch
new file mode 100644
index 0000000..7bda486
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7212.patch
@@ -0,0 +1,364 @@
+From 595e3a152ff2912a950defd0ef4b5f659135b03a Mon Sep 17 00:00:00 2001
+From: Nicolas Silva <address@hidden>
+Date: Wed, 18 Nov 2015 16:59:11 +0100
+Subject: [PATCH] Bug 1222809 - Don't try to allocate unreasonably large
+ textures. r=Bas, a=sylvestre
+
+---
+ gfx/2d/2D.h | 25 ++++++++++--
+ gfx/2d/Factory.cpp | 67 ++++++++++++++++++++++++++++-----
+ gfx/layers/ImageDataSerializer.cpp | 21 ++++++-----
+ gfx/layers/YCbCrImageDataSerializer.cpp | 7 ++++
+ gfx/layers/client/TextureClient.cpp | 12 ++++++
+ gfx/thebes/gfxPlatform.cpp | 15 ++++++--
+ gfx/thebes/gfxPrefs.h | 3 ++
+ 7 files changed, 124 insertions(+), 26 deletions(-)
+
+diff --git a/gfx/2d/2D.h b/gfx/2d/2D.h
+index cf35bb2..b1e0e3e 100644
+--- a/gfx/2d/2D.h
++++ b/gfx/2d/2D.h
+@@ -1082,22 +1082,41 @@ struct TileSet
+ size_t mTileCount;
+ };
+
++struct Config {
++ LogForwarder* mLogForwarder;
++ int32_t mMaxTextureSize;
++ int32_t mMaxAllocSize;
++
++ Config()
++ : mLogForwarder(nullptr)
++ , mMaxTextureSize(8192)
++ , mMaxAllocSize(52000000)
++ {}
++};
++
+ class GFX2D_API Factory
+ {
+ public:
++ static void Init(const Config& aConfig);
++ static void ShutDown();
++
+ static bool HasSSE2();
+
+ /** Make sure that the given dimensions don't overflow a 32-bit signed int
+ * using 4 bytes per pixel; optionally, make sure that either dimension
+ * doesn't exceed the given limit.
+ */
+- static bool CheckSurfaceSize(const IntSize &sz, int32_t limit = 0);
++ static bool CheckSurfaceSize(const IntSize &sz,
++ int32_t limit = 0,
++ int32_t allocLimit = 0);
+
+ /** Make sure the given dimension satisfies the CheckSurfaceSize and is
+ * within 8k limit. The 8k value is chosen a bit randomly.
+ */
+ static bool ReasonableSurfaceSize(const IntSize &aSize);
+
++ static bool AllowedSurfaceSize(const IntSize &aSize);
++
+ static TemporaryRef<DrawTarget>
CreateDrawTargetForCairoSurface(cairo_surface_t* aSurface, const IntSize&
aSize, SurfaceFormat* aFormat = nullptr);
+
+ static TemporaryRef<DrawTarget>
+@@ -1171,10 +1190,10 @@ public:
+
+ static uint32_t GetMaxSurfaceSize(BackendType aType);
+
+- static LogForwarder* GetLogForwarder() { return mLogForwarder; }
++ static LogForwarder* GetLogForwarder() { return sConfig ?
sConfig->mLogForwarder : nullptr; }
+
+ private:
+- static LogForwarder* mLogForwarder;
++ static Config* sConfig;
+ public:
+
+ #ifdef USE_SKIA_GPU
+diff --git a/gfx/2d/Factory.cpp b/gfx/2d/Factory.cpp
+index 948d3c3..6750c28 100644
+--- a/gfx/2d/Factory.cpp
++++ b/gfx/2d/Factory.cpp
+@@ -188,6 +188,35 @@ ID2D1Device *Factory::mD2D1Device;
+
+ DrawEventRecorder *Factory::mRecorder;
+
++mozilla::gfx::Config* Factory::sConfig = nullptr;
++
++void
++Factory::Init(const Config& aConfig)
++{
++ MOZ_ASSERT(!sConfig);
++ sConfig = new Config(aConfig);
++
++ // Make sure we don't completely break rendering because of a typo in the
++ // pref or whatnot.
++ const int32_t kMinAllocPref = 10000000;
++ const int32_t kMinSizePref = 2048;
++ if (sConfig->mMaxAllocSize < kMinAllocPref) {
++ sConfig->mMaxAllocSize = kMinAllocPref;
++ }
++ if (sConfig->mMaxTextureSize < kMinSizePref) {
++ sConfig->mMaxTextureSize = kMinSizePref;
++ }
++}
++
++void
++Factory::ShutDown()
++{
++ if (sConfig) {
++ delete sConfig;
++ sConfig = nullptr;
++ }
++}
++
+ bool
+ Factory::HasSSE2()
+ {
+@@ -222,11 +251,25 @@ inline int LoggerOptionsBasedOnSize(const IntSize& aSize)
+ bool
+ Factory::ReasonableSurfaceSize(const IntSize &aSize)
+ {
+- return Factory::CheckSurfaceSize(aSize,8192);
++ return Factory::CheckSurfaceSize(aSize, 8192);
++}
++
++bool
++Factory::AllowedSurfaceSize(const IntSize &aSize)
++{
++ if (sConfig) {
++ return Factory::CheckSurfaceSize(aSize,
++ sConfig->mMaxTextureSize,
++ sConfig->mMaxAllocSize);
++ }
++
++ return CheckSurfaceSize(aSize);
+ }
+
+ bool
+-Factory::CheckSurfaceSize(const IntSize &sz, int32_t limit)
++Factory::CheckSurfaceSize(const IntSize &sz,
++ int32_t extentLimit,
++ int32_t allocLimit)
+ {
+ if (sz.width <= 0 || sz.height <= 0) {
+ gfxDebug() << "Surface width or height <= 0!";
+@@ -234,8 +277,8 @@ Factory::CheckSurfaceSize(const IntSize &sz, int32_t limit)
+ }
+
+ // reject images with sides bigger than limit
+- if (limit && (sz.width > limit || sz.height > limit)) {
+- gfxDebug() << "Surface size too large (exceeds caller's limit)!";
++ if (extentLimit && (sz.width > extentLimit || sz.height > extentLimit)) {
++ gfxDebug() << "Surface size too large (exceeds extent limit)!";
+ return false;
+ }
+
+@@ -267,13 +310,18 @@ Factory::CheckSurfaceSize(const IntSize &sz, int32_t
limit)
+ return false;
+ }
+
++ if (allocLimit && allocLimit < numBytes.value()) {
++ gfxDebug() << "Surface size too large (exceeds allocation limit)!";
++ return false;
++ }
++
+ return true;
+ }
+
+ TemporaryRef<DrawTarget>
+ Factory::CreateDrawTarget(BackendType aBackend, const IntSize &aSize,
SurfaceFormat aFormat)
+ {
+- if (!CheckSurfaceSize(aSize)) {
++ if (!AllowedSurfaceSize(aSize)) {
+ gfxCriticalError(LoggerOptionsBasedOnSize(aSize)) << "Failed to allocate
a surface due to invalid size " << aSize;
+ return nullptr;
+ }
+@@ -364,7 +412,7 @@ Factory::CreateDrawTargetForData(BackendType aBackend,
+ SurfaceFormat aFormat)
+ {
+ MOZ_ASSERT(aData);
+- if (!CheckSurfaceSize(aSize)) {
++ if (!AllowedSurfaceSize(aSize)) {
+ gfxCriticalError(LoggerOptionsBasedOnSize(aSize)) << "Failed to allocate
a surface due to invalid size " << aSize;
+ return nullptr;
+ }
+@@ -835,7 +883,7 @@ Factory::CreateDataSourceSurface(const IntSize &aSize,
+ SurfaceFormat aFormat,
+ bool aZero)
+ {
+- if (!CheckSurfaceSize(aSize)) {
++ if (!AllowedSurfaceSize(aSize)) {
+ gfxCriticalError(LoggerOptionsBasedOnSize(aSize)) << "Failed to allocate
a surface due to invalid size " << aSize;
+ return nullptr;
+ }
+@@ -881,14 +929,13 @@ Factory::SetGlobalEventRecorder(DrawEventRecorder
*aRecorder)
+ mRecorder = aRecorder;
+ }
+
+-LogForwarder* Factory::mLogForwarder = nullptr;
+-
+ // static
+ void
+ Factory::SetLogForwarder(LogForwarder* aLogFwd) {
+- mLogForwarder = aLogFwd;
++ sConfig->mLogForwarder = aLogFwd;
+ }
+
++
+ // static
+ void
+ CriticalLogger::OutputMessage(const std::string &aString,
+diff --git a/gfx/layers/ImageDataSerializer.cpp
b/gfx/layers/ImageDataSerializer.cpp
+index 5dd6aca..331dd04 100644
+--- a/gfx/layers/ImageDataSerializer.cpp
++++ b/gfx/layers/ImageDataSerializer.cpp
+@@ -84,21 +84,23 @@ ImageDataSerializerBase::ComputeMinBufferSize(IntSize
aSize,
+ SurfaceFormat aFormat)
+ {
+ MOZ_ASSERT(aSize.height >= 0 && aSize.width >= 0);
+- if (aSize.height <= 0 || aSize.width <= 0) {
+- gfxDebug() << "Non-positive image buffer size request " << aSize.width <<
"x" << aSize.height;
++
++ // This takes care of checking whether there could be overflow
++ // with enough margin for the metadata.
++ if (!gfx::Factory::AllowedSurfaceSize(aSize)) {
+ return 0;
+ }
+
+- CheckedInt<int32_t> bufsize = ComputeStride(aFormat, aSize.width);
+- bufsize *= aSize.height;
++ int32_t bufsize = GetAlignedStride<16>(ComputeStride(aFormat, aSize.width)
++ * aSize.height)
++ + SurfaceBufferInfo::GetOffset();
+
+- if (!bufsize.isValid() || bufsize.value() <= 0) {
+- gfxDebug() << "Buffer size overflow " << aSize.width << "x" <<
aSize.height;
++ if (bufsize < 0) {
++ // This should not be possible thanks to Factory::AllowedSurfaceSize
+ return 0;
+ }
+
+- return SurfaceBufferInfo::GetOffset()
+- + GetAlignedStride<16>(bufsize.value());
++ return bufsize;
+ }
+
+ void
+@@ -114,7 +116,8 @@ ImageDataSerializerBase::Validate()
+ }
+ size_t requiredSize =
+ ComputeMinBufferSize(IntSize(info->width, info->height),
info->format);
+- mIsValid = requiredSize <= mDataSize;
++
++ mIsValid = !!requiredSize && requiredSize <= mDataSize;
+ }
+
+ uint8_t*
+diff --git a/gfx/layers/YCbCrImageDataSerializer.cpp
b/gfx/layers/YCbCrImageDataSerializer.cpp
+index c8e148d..05f5ab2 100644
+--- a/gfx/layers/YCbCrImageDataSerializer.cpp
++++ b/gfx/layers/YCbCrImageDataSerializer.cpp
+@@ -150,6 +150,13 @@
YCbCrImageDataDeserializerBase::ComputeMinBufferSize(const gfx::IntSize& aYSize,
+ gfxDebug() << "Non-positive YCbCr buffer size request " << aYSize.height
<< "x" << aYSize.width << ", " << aCbCrSize.height << "x" << aCbCrSize.width;
+ return 0;
+ }
++
++ if (!gfx::Factory::AllowedSurfaceSize(aYSize) ||
++ aCbCrSize.width > aYSize.width ||
++ aCbCrSize.height > aYSize.height) {
++ return 0;
++ }
++
+ return ComputeOffset(aYSize.height, aYStride)
+ + 2 * ComputeOffset(aCbCrSize.height, aCbCrStride)
+ + MOZ_ALIGN_WORD(sizeof(YCbCrBufferInfo));
+diff --git a/gfx/layers/client/TextureClient.cpp
b/gfx/layers/client/TextureClient.cpp
+index 9b45ca0..6ae7cbf 100644
+--- a/gfx/layers/client/TextureClient.cpp
++++ b/gfx/layers/client/TextureClient.cpp
+@@ -315,6 +315,10 @@ TextureClient::CreateForDrawing(ISurfaceAllocator*
aAllocator,
+ aMoz2DBackend = gfxPlatform::GetPlatform()->GetContentBackend();
+ }
+
++ if (!gfx::Factory::AllowedSurfaceSize(aSize)) {
++ return nullptr;
++ }
++
+ RefPtr<TextureClient> texture;
+
+ #if defined(MOZ_WIDGET_GONK) || defined(XP_WIN)
+@@ -415,6 +419,10 @@
TextureClient::CreateForRawBufferAccess(ISurfaceAllocator* aAllocator,
+ TextureFlags aTextureFlags,
+ TextureAllocationFlags aAllocFlags)
+ {
++ if (!gfx::Factory::AllowedSurfaceSize(aSize)) {
++ return nullptr;
++ }
++
+ RefPtr<BufferTextureClient> texture =
+ CreateBufferTextureClient(aAllocator, aFormat,
+ aTextureFlags, aMoz2DBackend);
+@@ -434,6 +442,10 @@ TextureClient::CreateForYCbCr(ISurfaceAllocator*
aAllocator,
+ StereoMode aStereoMode,
+ TextureFlags aTextureFlags)
+ {
++ if (!gfx::Factory::AllowedSurfaceSize(aYSize)) {
++ return nullptr;
++ }
++
+ RefPtr<BufferTextureClient> texture;
+ if (aAllocator->IsSameProcess()) {
+ texture = new MemoryTextureClient(aAllocator, gfx::SurfaceFormat::YUV,
+diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
+index 41e4b0c..209a0a8 100644
+--- a/gfx/thebes/gfxPlatform.cpp
++++ b/gfx/thebes/gfxPlatform.cpp
+@@ -458,13 +458,18 @@ gfxPlatform::Init()
+ }
+ gEverInitialized = true;
+
+- CrashStatsLogForwarder* logForwarder = new
CrashStatsLogForwarder("GraphicsCriticalError");
+- mozilla::gfx::Factory::SetLogForwarder(logForwarder);
+-
+ // Initialize the preferences by creating the singleton.
+ gfxPrefs::GetSingleton();
+
+- logForwarder->SetCircularBufferSize(gfxPrefs::GfxLoggingCrashLength());
++ auto fwd = new CrashStatsLogForwarder("GraphicsCriticalError");
++ fwd->SetCircularBufferSize(gfxPrefs::GfxLoggingCrashLength());
++
++ mozilla::gfx::Config cfg;
++ cfg.mLogForwarder = fwd;
++ cfg.mMaxTextureSize = gfxPrefs::MaxTextureSize();
++ cfg.mMaxAllocSize = gfxPrefs::MaxAllocSize();
++
++ gfx::Factory::Init(cfg);
+
+ gGfxPlatformPrefsLock = new Mutex("gfxPlatform::gGfxPlatformPrefsLock");
+
+@@ -641,6 +646,8 @@ gfxPlatform::Shutdown()
+ delete mozilla::gfx::Factory::GetLogForwarder();
+ mozilla::gfx::Factory::SetLogForwarder(nullptr);
+
++ gfx::Factory::ShutDown();
++
+ delete gGfxPlatformPrefsLock;
+
+ gfxPrefs::DestroySingleton();
+diff --git a/gfx/thebes/gfxPrefs.h b/gfx/thebes/gfxPrefs.h
+index b7a5fb9..038e1ff 100644
+--- a/gfx/thebes/gfxPrefs.h
++++ b/gfx/thebes/gfxPrefs.h
+@@ -209,6 +209,9 @@ private:
+ DECL_GFX_PREF(Live, "gfx.layerscope.port",
LayerScopePort, int32_t, 23456);
+ // Note that "gfx.logging.level" is defined in Logging.h
+ DECL_GFX_PREF(Once, "gfx.logging.crash.length",
GfxLoggingCrashLength, uint32_t, 6);
++ // The maximums here are quite conservative, we can tighten them if
problems show up.
++ DECL_GFX_PREF(Once, "gfx.max-alloc-size", MaxAllocSize,
int32_t, (int32_t)500000000);
++ DECL_GFX_PREF(Once, "gfx.max-texture-size",
MaxTextureSize, int32_t, (int32_t)32767);
+ DECL_GFX_PREF(Live, "gfx.perf-warnings.enabled", PerfWarnings,
bool, false);
+ DECL_GFX_PREF(Once, "gfx.work-around-driver-bugs",
WorkAroundDriverBugs, bool, true);
+
+--
+2.6.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-7213-pt1.patch
b/gnu/packages/patches/icecat-CVE-2015-7213-pt1.patch
new file mode 100644
index 0000000..854c91b
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7213-pt1.patch
@@ -0,0 +1,32 @@
+From 3f31bf9e243fb3de26e36d6be0bb0153f51c5b2a Mon Sep 17 00:00:00 2001
+From: Jean-Yves Avenard <address@hidden>
+Date: Wed, 9 Dec 2015 09:54:58 +0100
+Subject: [PATCH] Bug 1206211 - P1. Ensure operation can't overflow.
+ r=kentuckyfriedtakahe, a=sylvestre
+
+---
+ .../frameworks/av/media/libstagefright/MPEG4Extractor.cpp | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git
a/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
b/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
+index 22163fa..318152a 100644
+---
a/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
++++
b/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
+@@ -508,10 +508,13 @@ status_t MPEG4Extractor::readMetaData() {
+ CHECK_NE(err, (status_t)NO_INIT);
+
+ // copy pssh data into file metadata
+- int psshsize = 0;
++ uint64_t psshsize = 0;
+ for (size_t i = 0; i < mPssh.size(); i++) {
+ psshsize += 20 + mPssh[i].datalen;
+ }
++ if (psshsize > kMAX_ALLOCATION) {
++ return ERROR_MALFORMED;
++ }
+ if (psshsize) {
+ char *buf = (char*)malloc(psshsize);
+ char *ptr = buf;
+--
+2.6.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-7213-pt2.patch
b/gnu/packages/patches/icecat-CVE-2015-7213-pt2.patch
new file mode 100644
index 0000000..20bbd36
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7213-pt2.patch
@@ -0,0 +1,27 @@
+From bb6870bd6dc3acb183f44360c7cc6488656f47ea Mon Sep 17 00:00:00 2001
+From: Jean-Yves Avenard <address@hidden>
+Date: Wed, 9 Dec 2015 09:55:16 +0100
+Subject: [PATCH] Bug 1206211 - P2. Abort on OOM. r=kentuckyfriedtakahe,
+ a=sylvestre
+
+---
+ .../frameworks/av/media/libstagefright/MPEG4Extractor.cpp | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git
a/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
b/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
+index 318152a..c6aaf1d 100644
+---
a/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
++++
b/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
+@@ -517,6 +517,9 @@ status_t MPEG4Extractor::readMetaData() {
+ }
+ if (psshsize) {
+ char *buf = (char*)malloc(psshsize);
++ if (!buf) {
++ return ERROR_MALFORMED;
++ }
+ char *ptr = buf;
+ for (size_t i = 0; i < mPssh.size(); i++) {
+ memcpy(ptr, mPssh[i].uuid, 20); // uuid + length
+--
+2.6.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-7214.patch
b/gnu/packages/patches/icecat-CVE-2015-7214.patch
new file mode 100644
index 0000000..3a56d3d
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7214.patch
@@ -0,0 +1,47 @@
+From 487799700b0b676c2c6b95ad33c8afb8dbd329d8 Mon Sep 17 00:00:00 2001
+From: Bobby Holley <address@hidden>
+Date: Mon, 14 Dec 2015 15:36:20 -0500
+Subject: [PATCH] Bug 1228950 - Disallow scheme sets on nsHostObjectURI. r=bz,
+ a=lizzard
+
+---
+ dom/base/nsHostObjectURI.cpp | 9 +++++++++
+ dom/base/nsHostObjectURI.h | 2 ++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/dom/base/nsHostObjectURI.cpp b/dom/base/nsHostObjectURI.cpp
+index 94b02ff..57b0209 100644
+--- a/dom/base/nsHostObjectURI.cpp
++++ b/dom/base/nsHostObjectURI.cpp
+@@ -81,6 +81,15 @@ nsHostObjectURI::Write(nsIObjectOutputStream* aStream)
+ true);
+ }
+
++NS_IMETHODIMP
++nsHostObjectURI::SetScheme(const nsACString& aScheme)
++{
++ // Disallow setting the scheme, since that could cause us to be associated
++ // with a different protocol handler that doesn't expect us to be carrying
++ // around a principal with nsIURIWithPrincipal.
++ return NS_ERROR_FAILURE;
++}
++
+ // nsIURI methods:
+ nsresult
+ nsHostObjectURI::CloneInternal(nsSimpleURI::RefHandlingEnum aRefHandlingMode,
+diff --git a/dom/base/nsHostObjectURI.h b/dom/base/nsHostObjectURI.h
+index b468d5d..23ff7ab 100644
+--- a/dom/base/nsHostObjectURI.h
++++ b/dom/base/nsHostObjectURI.h
+@@ -34,6 +34,8 @@ public:
+ NS_DECL_NSISERIALIZABLE
+ NS_DECL_NSICLASSINFO
+
++ NS_IMETHOD SetScheme(const nsACString &aProtocol) override;
++
+ // Override CloneInternal() and EqualsInternal()
+ virtual nsresult CloneInternal(RefHandlingEnum aRefHandlingMode,
+ nsIURI** aClone) override;
+--
+2.6.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-7222-pt1.patch
b/gnu/packages/patches/icecat-CVE-2015-7222-pt1.patch
new file mode 100644
index 0000000..c5d0e4a
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7222-pt1.patch
@@ -0,0 +1,112 @@
+From 76e6db3e514350fd146cb04425e669d63b59f889 Mon Sep 17 00:00:00 2001
+From: Gerald Squelart <address@hidden>
+Date: Wed, 9 Dec 2015 09:59:37 +0100
+Subject: [PATCH] Bug 1216748 - p2. Handle failed malloc in Metadata storage -
+ r=rillian, a=sylvestre
+
+---
+ .../av/include/media/stagefright/MetaData.h | 2 +-
+ .../av/media/libstagefright/MetaData.cpp | 35 ++++++++++++++--------
+ 2 files changed, 24 insertions(+), 13 deletions(-)
+
+diff --git
a/media/libstagefright/frameworks/av/include/media/stagefright/MetaData.h
b/media/libstagefright/frameworks/av/include/media/stagefright/MetaData.h
+index 30d969d..0a8ff77 100644
+--- a/media/libstagefright/frameworks/av/include/media/stagefright/MetaData.h
++++ b/media/libstagefright/frameworks/av/include/media/stagefright/MetaData.h
+@@ -248,7 +248,7 @@ private:
+ return mSize <= sizeof(u.reservoir);
+ }
+
+- void allocateStorage(size_t size);
++ bool allocateStorage(size_t size);
+ void freeStorage();
+
+ void *storage() {
+diff --git
a/media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp
b/media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp
+index c832c96..cba324d 100644
+--- a/media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp
++++ b/media/libstagefright/frameworks/av/media/libstagefright/MetaData.cpp
+@@ -220,7 +220,7 @@ bool MetaData::findData(uint32_t key, uint32_t *type,
+ }
+
+ MetaData::typed_data::typed_data()
+- : mType(0),
++ : mType(TYPE_NONE),
+ mSize(0) {
+ }
+
+@@ -231,17 +231,19 @@ MetaData::typed_data::~typed_data() {
+ MetaData::typed_data::typed_data(const typed_data &from)
+ : mType(from.mType),
+ mSize(0) {
+- allocateStorage(from.mSize);
+- memcpy(storage(), from.storage(), mSize);
++ if (allocateStorage(from.mSize)) {
++ memcpy(storage(), from.storage(), mSize);
++ }
+ }
+
+ MetaData::typed_data &MetaData::typed_data::operator=(
+ const MetaData::typed_data &from) {
+ if (this != &from) {
+ clear();
+- mType = from.mType;
+- allocateStorage(from.mSize);
+- memcpy(storage(), from.storage(), mSize);
++ if (allocateStorage(from.mSize)) {
++ mType = from.mType;
++ memcpy(storage(), from.storage(), mSize);
++ }
+ }
+
+ return *this;
+@@ -250,16 +252,17 @@ MetaData::typed_data &MetaData::typed_data::operator=(
+ void MetaData::typed_data::clear() {
+ freeStorage();
+
+- mType = 0;
++ mType = TYPE_NONE;
+ }
+
+ void MetaData::typed_data::setData(
+ uint32_t type, const void *data, size_t size) {
+ clear();
+
+- mType = type;
+- allocateStorage(size);
+- memcpy(storage(), data, size);
++ if (allocateStorage(size)) {
++ mType = type;
++ memcpy(storage(), data, size);
++ }
+ }
+
+ void MetaData::typed_data::getData(
+@@ -269,14 +272,22 @@ void MetaData::typed_data::getData(
+ *data = storage();
+ }
+
+-void MetaData::typed_data::allocateStorage(size_t size) {
++bool MetaData::typed_data::allocateStorage(size_t size) {
++ // Update mSize now, as it is needed by usesReservoir() below.
++ // (mSize will be reset if the allocation fails further below.)
+ mSize = size;
+
+ if (usesReservoir()) {
+- return;
++ return true;
+ }
+
+ u.ext_data = malloc(mSize);
++ if (!u.ext_data) {
++ mType = TYPE_NONE;
++ mSize = 0;
++ return false;
++ }
++ return true;
+ }
+
+ void MetaData::typed_data::freeStorage() {
+--
+2.6.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-7222-pt2.patch
b/gnu/packages/patches/icecat-CVE-2015-7222-pt2.patch
new file mode 100644
index 0000000..688d7f9
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7222-pt2.patch
@@ -0,0 +1,34 @@
+From 63c353cf8ec6b787936f602532026bd9923a16e4 Mon Sep 17 00:00:00 2001
+From: Gerald Squelart <address@hidden>
+Date: Wed, 9 Dec 2015 10:00:13 +0100
+Subject: [PATCH] Bug 1216748 - p3. Ensure 'covr' data size cannot create
+ underflow - r=rillian, a=sylvestre
+
+---
+ .../frameworks/av/media/libstagefright/MPEG4Extractor.cpp | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git
a/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
b/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
+index c6aaf1d..a69fc14 100644
+---
a/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
++++
b/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
+@@ -1889,12 +1889,15 @@ status_t MPEG4Extractor::parseChunk(off64_t *offset,
int depth) {
+ if (mFileMetaData != NULL) {
+ ALOGV("chunk_data_size = %lld and data_offset = %lld",
+ chunk_data_size, data_offset);
++ const int kSkipBytesOfDataBox = 16;
++ if (chunk_data_size <= kSkipBytesOfDataBox) {
++ return ERROR_MALFORMED;
++ }
+ sp<ABuffer> buffer = new ABuffer(chunk_data_size + 1);
+ if (mDataSource->readAt(
+ data_offset, buffer->data(), chunk_data_size) !=
(ssize_t)chunk_data_size) {
+ return ERROR_IO;
+ }
+- const int kSkipBytesOfDataBox = 16;
+ mFileMetaData->setData(
+ kKeyAlbumArt, MetaData::TYPE_NONE,
+ buffer->data() + kSkipBytesOfDataBox, chunk_data_size -
kSkipBytesOfDataBox);
+--
+2.6.3
+
diff --git a/gnu/packages/patches/icecat-CVE-2015-7222-pt3.patch
b/gnu/packages/patches/icecat-CVE-2015-7222-pt3.patch
new file mode 100644
index 0000000..2f3c956
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2015-7222-pt3.patch
@@ -0,0 +1,37 @@
+From 0221ef0c389bff196ff59fa18232467d3648b926 Mon Sep 17 00:00:00 2001
+From: Gerald Squelart <address@hidden>
+Date: Wed, 9 Dec 2015 10:00:32 +0100
+Subject: [PATCH] Bug 1216748 - p4. Check other Metadata::setData uses -
+ r=rillian, a=sylvestre
+
+Found only one other use that needed better checks: the size of the pssh
+data was only checked after all items were added up; so it would be
+possible to create a set of big items such that they create an overflow,
+but the final sum looks reasonable.
+Instead each item size should be checked, and the sum should also be
+checked at each step.
+---
+ .../frameworks/av/media/libstagefright/MPEG4Extractor.cpp | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git
a/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
b/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
+index a69fc14..413a495 100644
+---
a/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
++++
b/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp
+@@ -511,9 +511,10 @@ status_t MPEG4Extractor::readMetaData() {
+ uint64_t psshsize = 0;
+ for (size_t i = 0; i < mPssh.size(); i++) {
+ psshsize += 20 + mPssh[i].datalen;
+- }
+- if (psshsize > kMAX_ALLOCATION) {
+- return ERROR_MALFORMED;
++ if (mPssh[i].datalen > kMAX_ALLOCATION - 20 ||
++ psshsize > kMAX_ALLOCATION) {
++ return ERROR_MALFORMED;
++ }
+ }
+ if (psshsize) {
+ char *buf = (char*)malloc(psshsize);
+--
+2.6.3
+