GitLab

This patch is in response to the following security vulnerabilities
(CVEs) reported to NVIDIA against libvdpau:

CVE-2015-5198
CVE-2015-5199
CVE-2015-5200

To address these CVEs, this patch:

- replaces all uses of getenv(3) with secure_getenv(3);
- uses secure_getenv(3) when available, with a fallback option;
- protects VDPAU_DRIVER against directory traversal by checking for '/'

On platforms where secure_getenv(3) is not available, the C preprocessor
will print a warning at compile time. Then, a preprocessor macro will
replace secure_getenv(3) with our getenv_wrapper(), which utilizes the check:

  getuid() == geteuid() && getgid() == getegid()

See getuid(2) and getgid(2) for further details.
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Florian Weimer <fweimer@redhat.com>

Reviewed-by: Aaron Plattner <aplattner@nvidia.com>
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>

Signed-off-by: James Le Cuirot <chewi@aura-online.co.uk>
Reviewed-by: Robert Morell <rmorell@nvidia.com>
Reviewed-by: Aaron Plattner <aplattner@nvidia.com>
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>

Implement two workarounds:

1) Swap U and V planes to VdpVideoSurfacePutBitsYCbCr to fix blue-tinged
   videos.

2) Disable VdpPresentationQueueSetBackgroundColor, so that Flash doesn't
   set the background to pure black or pure white, which would cause the
   VDPAU image to bleed through to other parts of the desktop with those
   very common colors.

These workarounds are only enabled when running under Flash player, and
may be individually controlled via /etc/vdpau_wrapper.cfg, should they
ever need to be disabled.

Note that this code stores the VDPAU backend function pointers as global
variables, which is technically incorrect. However, the likelihood of
any known VDPAU implementation ever returning different values for these
pointers within a single process is zero. If this becomes a problem, a
hash table of VdpDevice to the stored pointers should be implemented.
Signed-off-by: Stephen Warren <swarren@wwwdotorg.org>
Reviewed-by: Aaron Plattner <aplattner@nvidia.com>
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
[aplattner@nvidia.com: fixed distcheck by changing it to dist_libvdpausysconf_DATA]

If the VDPAU_DRIVER environment variable is not set, use DRI2Connect to query
the VDPAU driver name from the X server.
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Stephen Warren <swarren@nvidia.com>

* Add a --with-module-dir configure parameter.

* Pass the moduledir into the wrapper.  Use it to construct the path to search
  for drivers.  Require drivers to end in a ".1" version, in case we ever want
  to rev. the interface between the wrapper and the drivers.

* If no driver is found in the new module dir, look for one in the default
  search paths.  This is intended to find libvdpau_nvidia.so for drivers that
  predate the change to move it, and can be removed in the future.

* Stash the moduledir into vdpau.pc.  Drivers can find this with
  `pkg-config --variable=moduledir vdpau`.

* Add a version to libvdpau_trace.so in case the interface between it and
  libvdpau.so ever changes.

* Install libvdpau_trace.so.1 to moduledir instead of libdir.
Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Acked-by: Stephen Warren <swarren@nvidia.com>

Signed-off-by: Nicolas Chauvet <kwizart@gmail.com>