Accepting request 1170215 from multimedia:libs

(CVE-2023-51793 bsc#1223272)
  (CVE-2023-49502 bsc#1223235)
  boo#1223304/CVE-2023-51798

OBS-URL: https://build.opensuse.org/request/show/1170215
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/ffmpeg-4?expand=0&rev=65

0001-avfilter-vf_minterpolate-Check-pts-before-division.patch

@@ -0,0 +1,40 @@
+From 68146f06f852078866b3ef1564556e3a272920c7 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michael@niedermayer.cc>
+Date: Sat, 30 Dec 2023 02:51:32 +0100
+Subject: [PATCH] avfilter/vf_minterpolate: Check pts before division
+References: https://bugzilla.opensuse.org/1223304
+References: CVE-2023-51798
+
+Fixes: FPE
+Fixes: tickets/10758/poc20ffmpeg
+
+Discovered by Zeng Yunxiang
+
+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
+---
+ libavfilter/vf_minterpolate.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/libavfilter/vf_minterpolate.c b/libavfilter/vf_minterpolate.c
+index 9920210ece..b2242a15ee 100644
+--- a/libavfilter/vf_minterpolate.c
++++ b/libavfilter/vf_minterpolate.c
+@@ -1075,8 +1075,13 @@ static void interpolate(AVFilterLink *inlink, AVFrame *avf_out)
+     pts = av_rescale(avf_out->pts, (int64_t) ALPHA_MAX * outlink->time_base.num * inlink->time_base.den,
+                                    (int64_t)             outlink->time_base.den * inlink->time_base.num);
+ 
+-    alpha = (pts - mi_ctx->frames[1].avf->pts * ALPHA_MAX) / (mi_ctx->frames[2].avf->pts - mi_ctx->frames[1].avf->pts);
+-    alpha = av_clip(alpha, 0, ALPHA_MAX);
++    if (mi_ctx->frames[2].avf->pts > mi_ctx->frames[1].avf->pts) {
++        alpha = (pts - mi_ctx->frames[1].avf->pts * ALPHA_MAX) / (mi_ctx->frames[2].avf->pts - mi_ctx->frames[1].avf->pts);
++        alpha = av_clip(alpha, 0, ALPHA_MAX);
++    } else {
++        av_log(ctx, AV_LOG_DEBUG, "duplicate input PTS detected\n");
++        alpha = 0;
++    }
+ 
+     if (alpha == 0 || alpha == ALPHA_MAX) {
+         av_frame_copy(avf_out, alpha ? mi_ctx->frames[2].avf : mi_ctx->frames[1].avf);
+-- 
+2.44.0
+

ffmpeg-4.changes

@@ -1,3 +1,24 @@
+-------------------------------------------------------------------
+Thu Apr 23 16:14:18 UTC 2024 - Cliff Zhao <qzhao@suse.com>
+
+- Add ffmpeg-CVE-2023-51793.patch:
+  Backporting 0ecc1f0e from upstream, Fix odd height handling.
+  (CVE-2023-51793 bsc#1223272)
+
+-------------------------------------------------------------------
+Thu Apr 23 15:35:32 UTC 2024 - Cliff Zhao <qzhao@suse.com>
+
+- Add ffmpeg-CVE-2023-49502.patch:
+  Backporting 737ede40 from upstream, account for chroma sub-sampling
+  in min size calculation.
+  (CVE-2023-49502 bsc#1223235)
+
+-------------------------------------------------------------------
+Tue Apr 23 14:25:53 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
+
+- Address boo#1223304/CVE-2023-51798: add patch
+  0001-avfilter-vf_minterpolate-Check-pts-before-division.patch
+
 -------------------------------------------------------------------
 Mon Apr 22 12:41:55 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
 

ffmpeg-4.spec

@@ -126,6 +126,9 @@ Patch12:        0001-avcodec-libsvtav1-remove-compressed_ten_bit_format-a.patch
 Patch13:        0001-avcodec-x86-mathops-clip-constants-used-with-shift-i.patch
 Patch14:        ffmpeg-glslang-cxx17.patch
 Patch15:        0001-avutil-hwcontext-Don-t-assume-frames_uninit-is-reent.patch
+Patch16:        0001-avfilter-vf_minterpolate-Check-pts-before-division.patch
+Patch17:        ffmpeg-CVE-2023-49502.patch
+Patch18:        ffmpeg-CVE-2023-51793.patch
 BuildRequires:  ladspa-devel
 BuildRequires:  libgsm-devel
 BuildRequires:  libmp3lame-devel

ffmpeg-CVE-2023-49502.patch

@@ -0,0 +1,43 @@
+From 737ede405b11a37fdd61d19cf25df296a0cb0b75
+From: Cosmin Stejerean <cosmin@cosmin.at>
+Date: Wed Dec 6 18:39:32 2023 +0800
+Subject: avfilter/bwdif: account for chroma sub-sampling in min size calculation
+References: https://bugzilla.opensuse.org/1223235
+References: CVE-2023-49502
+
+The current logic for detecting frames that are too small for the
+algorithm does not account for chroma sub-sampling, and so a sample
+where the luma plane is large enough, but the chroma planes are not
+will not be rejected. In that event, a heap overflow will occur.
+
+This change adjusts the logic to consider the chroma planes and makes
+the change to all three bwdif implementations.
+
+Fixes #10688
+
+Signed-off-by: Cosmin Stejerean <cosmin@cosmin.at>
+Reviewed-by: Thomas Mundt <tmundt75@gmail.com>
+Signed-off-by: Philip Langdale <philipl@overt.org>
+
+diff -Nura ffmpeg-4.4.4/libavfilter/vf_bwdif.c ffmpeg-4.4.4_new/libavfilter/vf_bwdif.c
+--- ffmpeg-4.4.4/libavfilter/vf_bwdif.c	2023-04-13 02:01:50.000000000 +0800
++++ ffmpeg-4.4.4_new/libavfilter/vf_bwdif.c	2024-04-26 02:21:48.162806014 +0800
+@@ -343,13 +343,14 @@
+     if(yadif->mode&1)
+         link->frame_rate = av_mul_q(link->src->inputs[0]->frame_rate, (AVRational){2,1});
+ 
+-    if (link->w < 3 || link->h < 4) {
+-        av_log(ctx, AV_LOG_ERROR, "Video of less than 3 columns or 4 lines is not supported\n");
++    yadif->csp = av_pix_fmt_desc_get(link->format);
++    yadif->filter = filter;
++
++    if (AV_CEIL_RSHIFT(link->w, yadif->csp->log2_chroma_w) < 3 || AV_CEIL_RSHIFT(link->h, yadif->csp->log2_chroma_h) < 4) {
++        av_log(ctx, AV_LOG_ERROR, "Video with planes less than 3 columns or 4 lines is not supported\n");
+         return AVERROR(EINVAL);
+     }
+ 
+-    yadif->csp = av_pix_fmt_desc_get(link->format);
+-    yadif->filter = filter;
+     if (yadif->csp->comp[0].depth > 8) {
+         s->filter_intra = filter_intra_16bit;
+         s->filter_line  = filter_line_c_16bit;

ffmpeg-CVE-2023-51793.patch

@@ -0,0 +1,57 @@
+From 0ecc1f0e48930723d7a467761b66850811c23e62
+From: Michael Niedermayer <michael@niedermayer.cc>
+Date: Fri Dec 22 12:31:35 2023 +0100
+Subject: avfilter/vf_weave: Fix odd height handling
+References: https://bugzilla.opensuse.org/1223272
+References: CVE-2023-51793
+    
+Fixes: out of array access
+Fixes: tickets/10743/poc10ffmpeg
+    
+Found-by: Zeng Yunxiang and Li Zeyuan
+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
+
+diff -Nura ffmpeg-4.4.4/libavfilter/vf_weave.c ffmpeg-4.4.4_new/libavfilter/vf_weave.c
+--- ffmpeg-4.4.4/libavfilter/vf_weave.c	2023-04-13 02:01:50.000000000 +0800
++++ ffmpeg-4.4.4_new/libavfilter/vf_weave.c	2024-04-26 02:30:07.113807721 +0800
+@@ -30,6 +30,7 @@
+     int double_weave;
+     int nb_planes;
+     int planeheight[4];
++    int outheight[4];
+     int linesize[4];
+ 
+     AVFrame *prev;
+@@ -85,6 +86,9 @@
+     s->planeheight[1] = s->planeheight[2] = AV_CEIL_RSHIFT(inlink->h, desc->log2_chroma_h);
+     s->planeheight[0] = s->planeheight[3] = inlink->h;
+ 
++    s->outheight[1] = s->outheight[2] = AV_CEIL_RSHIFT(2*inlink->h, desc->log2_chroma_h);
++    s->outheight[0] = s->outheight[3] = 2*inlink->h;
++
+     s->nb_planes = av_pix_fmt_count_planes(inlink->format);
+ 
+     return 0;
+@@ -110,19 +114,20 @@
+         const int height = s->planeheight[i];
+         const int start = (height * jobnr) / nb_jobs;
+         const int end = (height * (jobnr+1)) / nb_jobs;
++        const int compensation = 2*end > s->outheight[i];
+ 
+         av_image_copy_plane(out->data[i] + out->linesize[i] * field1 +
+                             out->linesize[i] * start * 2,
+                             out->linesize[i] * 2,
+                             in->data[i] + start * in->linesize[i],
+                             in->linesize[i],
+-                            s->linesize[i], end - start);
++                            s->linesize[i], end - start - compensation * field1);
+         av_image_copy_plane(out->data[i] + out->linesize[i] * field2 +
+                             out->linesize[i] * start * 2,
+                             out->linesize[i] * 2,
+                             s->prev->data[i] + start * s->prev->linesize[i],
+                             s->prev->linesize[i],
+-                            s->linesize[i], end - start);
++                            s->linesize[i], end - start - compensation * field2);
+     }
+ 
+     return 0;