jengelh/ffmpeg-4
SHA256
1
0
Fork 2
forked from pool/ffmpeg-4
Code Pull Requests 1 Activity

Accepting request 729720 from multimedia:libs

Browse Source 
- Add 0001-avcodec-h2645_parse-zero-initialize-the-rbsp-buffer.patch
  [boo#1149839, CVE-2019-15942]

OBS-URL: https://build.opensuse.org/request/show/729720
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/ffmpeg-4?expand=0&rev=19
This commit is contained in:
Yuchen Lin 2019-09-19 13:47:08 +00:00 committed by Git OBS Bridge
commit 1b0f0aee4b
4 changed files with 65 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
0001-avcodec-h2645_parse-zero-initialize-the-rbsp-buffer.patch Normal file
View File

@ -0,0 +1,49 @@
From af70bfbeadc0c9b9215cf045ff2a6a31e8ac3a71 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Mon, 26 Aug 2019 00:54:20 -0300
Subject: [PATCH] avcodec/h2645_parse: zero initialize the rbsp buffer
Fixes ticket #8093
Reviewed-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavcodec/h2645_parse.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/libavcodec/h2645_parse.c b/libavcodec/h2645_parse.c
index 24658b3dfa..307e8643e6 100644
--- a/libavcodec/h2645_parse.c
+++ b/libavcodec/h2645_parse.c
@@ -345,13 +345,18 @@ static int find_next_start_code(const uint8_t *buf, const uint8_t *next_avc)
static void alloc_rbsp_buffer(H2645RBSP *rbsp, unsigned int size, int use_ref)
{
+ int min_size = size;
+
if (size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE)
goto fail;
size += AV_INPUT_BUFFER_PADDING_SIZE;
if (rbsp->rbsp_buffer_alloc_size >= size &&
- (!rbsp->rbsp_buffer_ref || av_buffer_is_writable(rbsp->rbsp_buffer_ref)))
+ (!rbsp->rbsp_buffer_ref || av_buffer_is_writable(rbsp->rbsp_buffer_ref))) {
+ av_assert0(rbsp->rbsp_buffer);
+ memset(rbsp->rbsp_buffer + min_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
return;
+ }
size = FFMIN(size + size / 16 + 32, INT_MAX);
@@ -360,7 +365,7 @@ static void alloc_rbsp_buffer(H2645RBSP *rbsp, unsigned int size, int use_ref)
else
av_free(rbsp->rbsp_buffer);
- rbsp->rbsp_buffer = av_malloc(size);
+ rbsp->rbsp_buffer = av_mallocz(size);
if (!rbsp->rbsp_buffer)
goto fail;
rbsp->rbsp_buffer_alloc_size = size;
--
2.23.0

3
ffmpeg-4.2-dlopen-fdk_aac.patch
View File

@ -30,7 +30,7 @@ Index: ffmpeg-4.2/libavcodec/dlopen.h
===================================================================
--- /dev/null
+++ ffmpeg-4.2/libavcodec/dlopen.h
@@ -0,0 +1,13 @@
@@ -0,0 +1,12 @@
+#ifndef LOCALINC_DLOPEN_H
+#define LOCALINC_DLOPEN_H
+#include <dlfcn.h>
@ -38,7 +38,6 @@ Index: ffmpeg-4.2/libavcodec/dlopen.h
+#define str(x) #x
+
+#define dl_sym(func, args, lib) \
+ fprintf(stderr, "dlsym " #func "\n"); \
+ dl_##func = args dlsym(lib, #func); \
+ if ((err = dlerror())) \
+ goto error;

11
ffmpeg-4.changes
View File

@ -1,3 +1,14 @@
-------------------------------------------------------------------
Tue Sep 10 08:30:36 UTC 2019 - Jan Engelhardt <jengelh@inai.de>
- Add 0001-avcodec-h2645_parse-zero-initialize-the-rbsp-buffer.patch
[boo#1149839, CVE-2019-15942]
-------------------------------------------------------------------
Wed Sep 4 12:05:35 UTC 2019 - Ismail Dönmez <idonmez@suse.com>
- Make ffmpeg-4.2-dlopen-fdk_aac.patch less verbose
-------------------------------------------------------------------
Thu Aug 22 08:45:17 UTC 2019 - Ismail Dönmez <idonmez@suse.com>

1
ffmpeg-4.spec
View File

@ -122,6 +122,7 @@ Patch6: ffmpeg-4.2-dlopen-fdk_aac.patch
# https://trac.ffmpeg.org/ticket/7861
Patch7: ffmpeg4_swscale_replace_illegal_vector_keyword.patch
Patch8: ffmpeg4_swscale_fix_altivec_vsx_recent_gcc.patch
Patch9: 0001-avcodec-h2645_parse-zero-initialize-the-rbsp-buffer.patch
BuildRequires: ladspa-devel
BuildRequires: libgsm-devel
BuildRequires: libmp3lame-devel