Sync from SUSE:SLFO:1.1 dav1d revision 5ad4157ecdeef85d4ce6e1146c7e896b

dav1d-CVE-2024-1580.patch

@@ -0,0 +1,63 @@
+From 2b475307dc11be9a1c3cc4358102c76a7f386a51 Mon Sep 17 00:00:00 2001
+From: Henrik Gramner <gramner@twoorioles.com>
+Date: Tue, 21 Nov 2023 20:47:50 +0100
+Subject: [PATCH] Fix tile_start_off calculations for extremely large frame
+ sizes
+
+The tile start offset, in pixels, can exceed the range of a signed int.
+---
+ src/decode.c   | 13 +++++++------
+ src/internal.h |  2 +-
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/src/decode.c b/src/decode.c
+index fdf5a6b..eed9dfb 100644
+--- a/src/decode.c
++++ b/src/decode.c
+@@ -2470,7 +2470,7 @@ static void setup_tile(Dav1dTileState *const ts,
+                        const Dav1dFrameContext *const f,
+                        const uint8_t *const data, const size_t sz,
+                        const int tile_row, const int tile_col,
+-                       const int tile_start_off)
++                       const unsigned tile_start_off)
+ {
+     const int col_sb_start = f->frame_hdr->tiling.col_start_sb[tile_col];
+     const int col_sb128_start = col_sb_start >> !f->seq_hdr->sb128;
+@@ -2843,15 +2843,16 @@ int dav1d_decode_frame_init(Dav1dFrameContext *const f) {
+     const uint8_t *const size_mul = ss_size_mul[f->cur.p.layout];
+     const int hbd = !!f->seq_hdr->hbd;
+     if (c->n_fc > 1) {
++        const unsigned sb_step4 = f->sb_step * 4;
+         int tile_idx = 0;
+         for (int tile_row = 0; tile_row < f->frame_hdr->tiling.rows; tile_row++) {
+-            int row_off = f->frame_hdr->tiling.row_start_sb[tile_row] *
+-                          f->sb_step * 4 * f->sb128w * 128;
+-            int b_diff = (f->frame_hdr->tiling.row_start_sb[tile_row + 1] -
+-                          f->frame_hdr->tiling.row_start_sb[tile_row]) * f->sb_step * 4;
++            const unsigned row_off = f->frame_hdr->tiling.row_start_sb[tile_row] *
++                                     sb_step4 * f->sb128w * 128;
++            const unsigned b_diff = (f->frame_hdr->tiling.row_start_sb[tile_row + 1] -
++                                     f->frame_hdr->tiling.row_start_sb[tile_row]) * sb_step4;
+             for (int tile_col = 0; tile_col < f->frame_hdr->tiling.cols; tile_col++) {
+                 f->frame_thread.tile_start_off[tile_idx++] = row_off + b_diff *
+-                    f->frame_hdr->tiling.col_start_sb[tile_col] * f->sb_step * 4;
++                    f->frame_hdr->tiling.col_start_sb[tile_col] * sb_step4;
+             }
+         }
+ 
+diff --git a/src/internal.h b/src/internal.h
+index 631c5a8..72f6560 100644
+--- a/src/internal.h
++++ b/src/internal.h
+@@ -289,7 +289,7 @@ struct Dav1dFrameContext {
+         int prog_sz;
+         int cbi_sz, pal_sz, pal_idx_sz, cf_sz;
+         // start offsets per tile
+-        int *tile_start_off;
++        unsigned *tile_start_off;
+     } frame_thread;
+ 
+     // loopfilter
+-- 
+2.43.0
+

dav1d.changes

@@ -1,87 +1,8 @@
 -------------------------------------------------------------------
-Mon Jan 20 06:17:10 UTC 2025 - Luigi Baldoni <aloisio@gmx.com>
+Wed Feb 21 19:45:40 UTC 2024 - Michael Gorse <mgorse@suse.com>
 
-- Update to version 1.5.1
+- Add dav1d-CVE-2024-1580.patch: fix tile_start_off calculations
-  * Rewrite of the looprestoration (SGR, wiener) to reduce stack
+  for extremely large frame sizes (bsc#1220100 CVE-2024-1580).
-    usage
-  * Rewrite of {put,prep}_scaled functions
-  * Improvements on the SSSE3 SGR
-  * Improvements on ARM32/ARM64 looprestoration optimizations
-  * RISC-V: blend optimizations for high bitdepth
-  * Power9: blend optimizations for 8bpc
-  * Port RISC-V to POSIX/non-Linux OS
-  * AArch64: Add Neon implementation of load_tmvs
-  * Fix a rare, but possible deadlock, in flush()
-
--------------------------------------------------------------------
-Fri Oct 18 06:59:35 UTC 2024 - Luigi Baldoni <aloisio@gmx.com>
-
-- Update to version 1.5.0
-  * WARNING: we removed some of the SSE2 optimizations, so if
-    you care about systems without SSSE3, you should be careful
-    when updating!
-  * Optimize index offset calculations for decode_coefs
-  * picture: copy HDR10+ and T35 metadata only to visible frames
-  * SSSE3 new optimizations for 6-tap (8bit and hbd)
-  * AArch64/SVE: Add HBD subpel filters using 128-bit SVE2
-  * AArch64: Add USMMLA implempentation for 6-tap H/HV
-  * AArch64: Optimize Armv8.0 NEON for HBD horizontal filters
-    and 6-tap filters
-  * Power9: Optimized ITX till 16x4.
-  * Loongarch: numerous optimizations
-  * RISC-V optimizations for pal, cdef_filter, ipred, mc_blend,
-    mc_bdir, itx
-  * Allow playing videos in full-screen mode in dav1dplay
-
--------------------------------------------------------------------
-Wed Jun 12 15:13:55 UTC 2024 - Luigi Baldoni <aloisio@gmx.com>
-
-- Update to version 1.4.3
-  * AArch64: Fix potential out of bounds access in DotProd H/HV
-    filters
-  * cli: Prevent buffer over-read
-
--------------------------------------------------------------------
-Sat May 25 09:12:12 UTC 2024 - Luigi Baldoni <aloisio@gmx.com>
-
-- Update to version 1.4.2
-  * AVX2 optimizations for 8-tap and new variants for 6-tap
-  * AVX-512 optimizations for 8-tap and new variants for 6-tap
-  * Improve entropy decoding on ARM64
-  * New ARM64 optimizations for convolutions based on DotProd
-    extension
-  * New ARM64 optimizations for convolutions based on i8mm
-    extension
-  * New ARM64 optimizations for subpel and prep filters for i8mm
-  * Misc improvements on existing ARM64 optimizations, notably
-    for put/prep
-  * New PowerPC9 optimizations for loopfilter
-  * Support for macOS kperf API for benchmarking
-
--------------------------------------------------------------------
-Fri Mar 15 07:49:30 UTC 2024 - Luigi Baldoni <aloisio@gmx.com>
-
-- Update to version 1.4.1
-  * Optimizations for 6tap filters for NEON (ARM)
-  * More RISC-V optimizations for itx (4x8, 8x4, 4x16, 16x4,
-    8x16, 16x8)
-  * Reduction of binary size on ARM64, ARM32 and RISC-V
-  * Fix out-of-bounds read in 8bpc SSE2/SSSE3 wiener_filter
-  * Msac optimizations
-
--------------------------------------------------------------------
-Wed Feb 14 20:10:15 UTC 2024 - Luigi Baldoni <aloisio@gmx.com>
-
-- Update to version 1.4.0
-  * AVX-512 optimizations for z1, z2, z3 in 8bit and
-    high-bitdepth
-  * New architecture supported: loongarch
-  * Loongarch optimizations for 8bit
-  * New architecture supported: RISC-V
-  * RISC-V optimizations for itx
-  * Misc improvements in threading and in reducing binary size
-  * Fix potential integer overflow with extremely large frame
-    sizes (bsc#1220105, CVE-2024-1580)
 
 -------------------------------------------------------------------
 Wed Oct  4 04:17:53 UTC 2023 - Luigi Baldoni <aloisio@gmx.com>
@@ -135,8 +56,6 @@ Wed May  3 06:27:24 UTC 2023 - Luigi Baldoni <aloisio@gmx.com>
   * AVX-512 optimizations for high bit-depth itx (16x64, 32x64,
     64x16, 64x32, 64x64)
   * AVX2 optimizations for 12bpc for 16x32, 32x16, 32x32 itx
-  * Includes fix for possible crash when decoding a frame
-    (bsc#1211262 CVE-2023-32570).
 
 -------------------------------------------------------------------
 Tue Mar  7 19:40:24 UTC 2023 - Michael Gorse <mgorse@suse.com>

dav1d.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package dav1d
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2023 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -19,7 +19,7 @@
 %define sover   7
 
 Name:           dav1d
-Version:        1.5.1
+Version:        1.3.0
 Release:        0
 Summary:        An AV1 decoder
 License:        BSD-2-Clause
@@ -27,6 +27,8 @@ Group:          Productivity/Multimedia/Video/Editors and Convertors
 URL:            https://code.videolan.org/videolan/dav1d
 Source:         %{url}/-/archive/%{version}/dav1d-%{version}.tar.gz
 Source99:       baselibs.conf
+# PATCH-FIX-UPSTREAM dav1d-CVE-2024-1580.patch bsc#1220100 mgorse@suse.com -- fix tile_start_off calculations for extremely large frame sizes.
+Patch0:         dav1d-CVE-2024-1580.patch
 
 BuildRequires:  meson >= 0.49.0
 BuildRequires:  nasm >= 2.14