- Add 0001-avformat-vividas-improve-extradata-packing-checks-in.patch [boo#1180519]

OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/ffmpeg-4?expand=0&rev=150

0001-avformat-vividas-improve-extradata-packing-checks-in.patch

@@ -0,0 +1,71 @@
+From 27a99e2c7d450fef15594671eef4465c8a166bd7 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michael@niedermayer.cc>
+Date: Wed, 28 Oct 2020 20:11:54 +0100
+Subject: [PATCH] avformat/vividas: improve extradata packing checks in
+ track_header()
+
+Fixes: out of array accesses
+Fixes: 26622/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6581200338288640
+
+Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
+---
+ libavformat/vividas.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git libavformat/vividas.c libavformat/vividas.c
+index 83d0ed1167..46c66bf9a0 100644
+--- a/libavformat/vividas.c
++++ a/libavformat/vividas.c
+@@ -28,6 +28,7 @@
+  * @sa http://wiki.multimedia.cx/index.php?title=Vividas_VIV
+  */
+ 
++#include "libavutil/avassert.h"
+ #include "libavutil/intreadwrite.h"
+ #include "avio_internal.h"
+ #include "avformat.h"
+@@ -379,7 +380,7 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s,  uint8_t *
+ 
+         if (avio_tell(pb) < off) {
+             int num_data;
+-            int xd_size = 0;
++            int xd_size = 1;
+             int data_len[256];
+             int offset = 1;
+             uint8_t *p;
+@@ -393,10 +394,10 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s,  uint8_t *
+                     return AVERROR_INVALIDDATA;
+                 }
+                 data_len[j] = len;
+-                xd_size += len;
++                xd_size += len + 1 + len/255;
+             }
+ 
+-            ret = ff_alloc_extradata(st->codecpar, 64 + xd_size + xd_size / 255);
++            ret = ff_alloc_extradata(st->codecpar, xd_size);
+             if (ret < 0)
+                 return ret;
+ 
+@@ -405,9 +406,7 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s,  uint8_t *
+ 
+             for (j = 0; j < num_data - 1; j++) {
+                 unsigned delta = av_xiphlacing(&p[offset], data_len[j]);
+-                if (delta > data_len[j]) {
+-                    return AVERROR_INVALIDDATA;
+-                }
++                av_assert0(delta <= xd_size - offset);
+                 offset += delta;
+             }
+ 
+@@ -418,6 +417,7 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s,  uint8_t *
+                     av_freep(&st->codecpar->extradata);
+                     break;
+                 }
++                av_assert0(data_len[j] <= xd_size - offset);
+                 offset += data_len[j];
+             }
+ 
+-- 
+2.30.0
+

ffmpeg-4.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Fri Feb  5 21:10:43 UTC 2021 - Jan Engelhardt <jengelh@inai.de>
+
+- Add 0001-avformat-vividas-improve-extradata-packing-checks-in.patch
+  [boo#1180519]
+
 -------------------------------------------------------------------
 Sun Jan 24 11:22:02 UTC 2021 - Dirk Müller <dmueller@suse.com>
 

ffmpeg-4.spec

@@ -118,6 +118,7 @@ Patch6:         ffmpeg.git-ba3e771a42c29ee02c34e7769cfc1b2dbc5c760a.patch
 Patch7:         0001-lavf-srt-fix-build-fail-when-used-the-libsrt-1.4.1.patch
 Patch8:         vmaf-trim-usr-local.patch
 Patch9:         ffmpeg_altivec_yuv2rgb_novsx.patch
+Patch10:        0001-avformat-vividas-improve-extradata-packing-checks-in.patch
 BuildRequires:  ladspa-devel
 BuildRequires:  libgsm-devel
 BuildRequires:  libmp3lame-devel
@@ -579,8 +580,7 @@ from libav should depend on these private headers which are expected to
 break compatibility without any notice.
 
 %prep
-%setup -q -n %_name-%version
+%autosetup -p1 -n %_name-%version
-%autopatch -p1
 
 %build
 %ifarch %ix86 %arm