Accepting request 1170205 from home:qzhao:branches:multimedia:libs

Add ffmpeg-CVE-2023-49502.patch ffmpeg-CVE-2023-51793.patch to fix CVE bugs.

OBS-URL: https://build.opensuse.org/request/show/1170205
OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/ffmpeg-4?expand=0&rev=213

ffmpeg-4.changes

@@ -1,3 +1,18 @@
+-------------------------------------------------------------------
+Thu Apr 23 16:14:18 UTC 2024 - Cliff Zhao <qzhao@suse.com>
+
+- Add ffmpeg-CVE-2023-51793.patch:
+  Backporting 0ecc1f0e from upstream, Fix odd height handling.
+  (CVE-2023-51793 bsc#1223272)
+
+-------------------------------------------------------------------
+Thu Apr 23 15:35:32 UTC 2024 - Cliff Zhao <qzhao@suse.com>
+
+- Add ffmpeg-CVE-2023-49502.patch:
+  Backporting 737ede40 from upstream, account for chroma sub-sampling
+  in min size calculation.
+  (CVE-2023-49502 bsc#1223235)
+
 -------------------------------------------------------------------
 Tue Apr 23 14:25:53 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
 

ffmpeg-4.spec

@@ -127,6 +127,10 @@ Patch13:        0001-avcodec-x86-mathops-clip-constants-used-with-shift-i.patch
 Patch14:        ffmpeg-glslang-cxx17.patch
 Patch15:        0001-avutil-hwcontext-Don-t-assume-frames_uninit-is-reent.patch
 Patch16:        0001-avfilter-vf_minterpolate-Check-pts-before-division.patch
+# PATCH-FIX-UPSTREAM ffmpeg-CVE-2023-49502.patch CVE-2023-49502 bsc#1223235 qzhao@suse.com -- Account for chroma sub-sampling in min size calculation.
+Patch17:        ffmpeg-CVE-2023-49502.patch
+# PATCH-FIX-UPSTREAM ffmpeg-CVE-2023-51793.patch CVE-2023-51793 bsc#1223272 qzhao@suse.com -- Fix odd height handling.
+Patch18:        ffmpeg-CVE-2023-51793.patch
 BuildRequires:  ladspa-devel
 BuildRequires:  libgsm-devel
 BuildRequires:  libmp3lame-devel

ffmpeg-CVE-2023-49502.patch

@@ -0,0 +1,42 @@
+commit 737ede405b11a37fdd61d19cf25df296a0cb0b75
+Author: Cosmin Stejerean <cosmin@cosmin.at>
+Date:   Wed Dec 6 18:39:32 2023 +0800
+
+    avfilter/bwdif: account for chroma sub-sampling in min size calculation
+    
+    The current logic for detecting frames that are too small for the
+    algorithm does not account for chroma sub-sampling, and so a sample
+    where the luma plane is large enough, but the chroma planes are not
+    will not be rejected. In that event, a heap overflow will occur.
+    
+    This change adjusts the logic to consider the chroma planes and makes
+    the change to all three bwdif implementations.
+    
+    Fixes #10688
+    
+    Signed-off-by: Cosmin Stejerean <cosmin@cosmin.at>
+    Reviewed-by: Thomas Mundt <tmundt75@gmail.com>
+    Signed-off-by: Philip Langdale <philipl@overt.org>
+
+diff -Nura ffmpeg-4.4.4/libavfilter/vf_bwdif.c ffmpeg-4.4.4_new/libavfilter/vf_bwdif.c
+--- ffmpeg-4.4.4/libavfilter/vf_bwdif.c	2023-04-13 02:01:50.000000000 +0800
++++ ffmpeg-4.4.4_new/libavfilter/vf_bwdif.c	2024-04-26 02:21:48.162806014 +0800
+@@ -343,13 +343,14 @@
+     if(yadif->mode&1)
+         link->frame_rate = av_mul_q(link->src->inputs[0]->frame_rate, (AVRational){2,1});
+ 
+-    if (link->w < 3 || link->h < 4) {
+-        av_log(ctx, AV_LOG_ERROR, "Video of less than 3 columns or 4 lines is not supported\n");
++    yadif->csp = av_pix_fmt_desc_get(link->format);
++    yadif->filter = filter;
++
++    if (AV_CEIL_RSHIFT(link->w, yadif->csp->log2_chroma_w) < 3 || AV_CEIL_RSHIFT(link->h, yadif->csp->log2_chroma_h) < 4) {
++        av_log(ctx, AV_LOG_ERROR, "Video with planes less than 3 columns or 4 lines is not supported\n");
+         return AVERROR(EINVAL);
+     }
+ 
+-    yadif->csp = av_pix_fmt_desc_get(link->format);
+-    yadif->filter = filter;
+     if (yadif->csp->comp[0].depth > 8) {
+         s->filter_intra = filter_intra_16bit;
+         s->filter_line  = filter_line_c_16bit;

ffmpeg-CVE-2023-51793.patch

@@ -0,0 +1,56 @@
+commit 0ecc1f0e48930723d7a467761b66850811c23e62
+Author: Michael Niedermayer <michael@niedermayer.cc>
+Date:   Fri Dec 22 12:31:35 2023 +0100
+
+    avfilter/vf_weave: Fix odd height handling
+    
+    Fixes: out of array access
+    Fixes: tickets/10743/poc10ffmpeg
+    
+    Found-by: Zeng Yunxiang and Li Zeyuan
+    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
+
+diff -Nura ffmpeg-4.4.4/libavfilter/vf_weave.c ffmpeg-4.4.4_new/libavfilter/vf_weave.c
+--- ffmpeg-4.4.4/libavfilter/vf_weave.c	2023-04-13 02:01:50.000000000 +0800
++++ ffmpeg-4.4.4_new/libavfilter/vf_weave.c	2024-04-26 02:30:07.113807721 +0800
+@@ -30,6 +30,7 @@
+     int double_weave;
+     int nb_planes;
+     int planeheight[4];
++    int outheight[4];
+     int linesize[4];
+ 
+     AVFrame *prev;
+@@ -85,6 +86,9 @@
+     s->planeheight[1] = s->planeheight[2] = AV_CEIL_RSHIFT(inlink->h, desc->log2_chroma_h);
+     s->planeheight[0] = s->planeheight[3] = inlink->h;
+ 
++    s->outheight[1] = s->outheight[2] = AV_CEIL_RSHIFT(2*inlink->h, desc->log2_chroma_h);
++    s->outheight[0] = s->outheight[3] = 2*inlink->h;
++
+     s->nb_planes = av_pix_fmt_count_planes(inlink->format);
+ 
+     return 0;
+@@ -110,19 +114,20 @@
+         const int height = s->planeheight[i];
+         const int start = (height * jobnr) / nb_jobs;
+         const int end = (height * (jobnr+1)) / nb_jobs;
++        const int compensation = 2*end > s->outheight[i];
+ 
+         av_image_copy_plane(out->data[i] + out->linesize[i] * field1 +
+                             out->linesize[i] * start * 2,
+                             out->linesize[i] * 2,
+                             in->data[i] + start * in->linesize[i],
+                             in->linesize[i],
+-                            s->linesize[i], end - start);
++                            s->linesize[i], end - start - compensation * field1);
+         av_image_copy_plane(out->data[i] + out->linesize[i] * field2 +
+                             out->linesize[i] * start * 2,
+                             out->linesize[i] * 2,
+                             s->prev->data[i] + start * s->prev->linesize[i],
+                             s->prev->linesize[i],
+-                            s->linesize[i], end - start);
++                            s->linesize[i], end - start - compensation * field2);
+     }
+ 
+     return 0;