From f5b32b2276023754723d17c3dff8126cbce902f6fc6421f96e07eaac2f01d08b Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Tue, 10 Aug 2021 09:50:29 +0000 Subject: [PATCH] Accepting request 911224 from home:AZhou:branches:multimedia:libs - Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix the return value of the init_vlc function is not checked (bsc#1189142). OBS-URL: https://build.opensuse.org/request/show/911224 OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/ffmpeg-4?expand=0&rev=168 --- ffmpeg-4.changes | 7 +++++ ffmpeg-4.spec | 1 + ffmpeg-CVE-2021-38114.patch | 63 +++++++++++++++++++++++++++++++++++++ 3 files changed, 71 insertions(+) create mode 100644 ffmpeg-CVE-2021-38114.patch diff --git a/ffmpeg-4.changes b/ffmpeg-4.changes index de26636..5039d09 100644 --- a/ffmpeg-4.changes +++ b/ffmpeg-4.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Tue Aug 10 09:38:39 UTC 2021 - Alynx Zhou + +- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix + the return value of the init_vlc function is not checked + (bsc#1189142). + ------------------------------------------------------------------- Sat Jul 10 10:11:32 UTC 2021 - Hans-Peter Jansen diff --git a/ffmpeg-4.spec b/ffmpeg-4.spec index b30dd13..503a1a2 100644 --- a/ffmpeg-4.spec +++ b/ffmpeg-4.spec @@ -119,6 +119,7 @@ Patch5: soversion.patch Patch8: vmaf-trim-usr-local.patch Patch9: ffmpeg-4.4-CVE-2020-22046.patch Patch10: ffmpeg-CVE-2021-33815.patch +Patch11: ffmpeg-CVE-2021-38114.patch BuildRequires: ladspa-devel BuildRequires: libgsm-devel BuildRequires: libmp3lame-devel diff --git a/ffmpeg-CVE-2021-38114.patch b/ffmpeg-CVE-2021-38114.patch new file mode 100644 index 0000000..4b5ee8e --- /dev/null +++ b/ffmpeg-CVE-2021-38114.patch @@ -0,0 +1,63 @@ +From 7150f9575671f898382c370acae35f9087a30ba1 Mon Sep 17 00:00:00 2001 +From: maryam ebr +Date: Tue, 3 Aug 2021 01:05:47 -0400 +Subject: [PATCH] avcodec/dnxhddec: check and propagate function return value + +Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed. +crafted DNxHD data can cause unspecified impact. + +Reviewed-by: Paul B Mahol +Signed-off-by: James Almer +--- + libavcodec/dnxhddec.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +diff --git a/libavcodec/dnxhddec.c b/libavcodec/dnxhddec.c +index c3eca7becf..41c72cdce6 100644 +--- a/libavcodec/dnxhddec.c ++++ b/libavcodec/dnxhddec.c +@@ -112,6 +112,7 @@ static av_cold int dnxhd_decode_init(AVCodecContext *avctx) + + static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth) + { ++ int ret; + if (cid != ctx->cid) { + const CIDEntry *cid_table = ff_dnxhd_get_cid_table(cid); + +@@ -132,19 +133,26 @@ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth) + ff_free_vlc(&ctx->dc_vlc); + ff_free_vlc(&ctx->run_vlc); + +- init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257, ++ if ((ret = init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257, + ctx->cid_table->ac_bits, 1, 1, +- ctx->cid_table->ac_codes, 2, 2, 0); +- init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12, ++ ctx->cid_table->ac_codes, 2, 2, 0)) < 0) ++ goto out; ++ if ((ret = init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12, + ctx->cid_table->dc_bits, 1, 1, +- ctx->cid_table->dc_codes, 1, 1, 0); +- init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62, ++ ctx->cid_table->dc_codes, 1, 1, 0)) < 0) ++ goto out; ++ if ((ret = init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62, + ctx->cid_table->run_bits, 1, 1, +- ctx->cid_table->run_codes, 2, 2, 0); ++ ctx->cid_table->run_codes, 2, 2, 0)) < 0) ++ goto out; + + ctx->cid = cid; + } +- return 0; ++ ret = 0; ++out: ++ if (ret < 0) ++ av_log(ctx->avctx, AV_LOG_ERROR, "init_vlc failed\n"); ++ return ret; + } + + static int dnxhd_get_profile(int cid) +-- +2.32.0 +