Accepting request 1311467 from multimedia:libs

- Add ffmpeg-4-CVE-2025-59728.patch: avformat/dashdec: Allocate
  space for appended "/" (bsc#1251137, CVE-2025-59728).

OBS-URL: https://build.opensuse.org/request/show/1311467
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/ffmpeg-4?expand=0&rev=89

0001-libavcodec-arm-mlpdsp_armv5te-fix-label-format-to-wo.patch

@@ -1,58 +0,0 @@
-From 654bd47716c4f36719fb0f3f7fd8386d5ed0b916 Mon Sep 17 00:00:00 2001
-From: Ross Burton <ross.burton@arm.com>
-Date: Fri, 9 Aug 2024 11:32:00 +0100
-Subject: [PATCH] libavcodec/arm/mlpdsp_armv5te: fix label format to work with
- binutils 2.43
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-binutils 2.43 has stricter validation for labels[1] and results in errors
-when building ffmpeg for armv5:
-
-src/libavcodec/arm/mlpdsp_armv5te.S:232: Error: junk at end of line, first unrecognized character is `0'
-
-Remove the leading zero in the "01" label to resolve this error.
-
-[1] https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=226749d5a6ff0d5c607d6428d6c81e1e7e7a994b
-
-Signed-off-by: Ross Burton <ross.burton@arm.com>
-Signed-off-by: Martin Storsjö <martin@martin.st>
----
- libavcodec/arm/mlpdsp_armv5te.S | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/libavcodec/arm/mlpdsp_armv5te.S b/libavcodec/arm/mlpdsp_armv5te.S
-index 4f9aa485fd..d31568611c 100644
---- a/libavcodec/arm/mlpdsp_armv5te.S
-+++ b/libavcodec/arm/mlpdsp_armv5te.S
-@@ -229,7 +229,7 @@ A .endif
-   .endif
- 
-         // Begin loop
--01:
-+1:
-   .if TOTAL_TAPS == 0
-         // Things simplify a lot in this case
-         // In fact this could be pipelined further if it's worth it...
-@@ -241,7 +241,7 @@ A .endif
-         str     ST0, [PST, #-4]!
-         str     ST0, [PST, #4 * (MAX_BLOCKSIZE + MAX_FIR_ORDER)]
-         str     ST0, [PSAMP], #4 * MAX_CHANNELS
--        bne     01b
-+        bne     1b
-   .else
-     .if \fir_taps & 1
-       .set LOAD_REG, 1
-@@ -333,7 +333,7 @@ T       orr     AC0, AC0, AC1
-         str     ST3, [PST, #-4]!
-         str     ST2, [PST, #4 * (MAX_BLOCKSIZE + MAX_FIR_ORDER)]
-         str     ST3, [PSAMP], #4 * MAX_CHANNELS
--        bne     01b
-+        bne     1b
-   .endif
-         b       99f
- 
--- 
-2.46.0
-

_scmsync.obsinfo

@@ -0,0 +1,4 @@
+mtime: 1760495051
+commit: 0cacb49da48ff116c5cdfb43b3550578dc885e4023f39c1b49ac9ed044f4826f
+url: https://src.opensuse.org/jengelh/ffmpeg-4
+revision: master

build.specials.obscpio

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:54bc21216667c7495f880e7b6c30fbb614b1435601485e86cced1fe4848ed11e
+size 256

ffmpeg-4-CVE-2024-36618.patch

@@ -0,0 +1,23 @@
+commit 7a089ed8e049e3bfcb22de1250b86f2106060857
+Author: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
+Date:   Tue Mar 12 23:23:17 2024 +0100
+
+    avformat/avidec: Fix integer overflow iff ULONG_MAX < INT64_MAX
+    
+    Affects many FATE-tests, see
+    https://fate.ffmpeg.org/report.cgi?time=20240312011016&slot=ppc-linux-gcc-13.2-ubsan-altivec-qemu
+    
+    Reviewed-by: James Almer <jamrial@gmail.com>
+    Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
+
+--- a/libavformat/avidec.c
++++ b/libavformat/avidec.c
+@@ -1694,7 +1694,7 @@
+     int *idx = av_mallocz_array(s->nb_streams, sizeof(*idx));
+     if (!idx)
+         return AVERROR(ENOMEM);
+-    for (min_pos = pos = 0; min_pos != INT64_MAX; pos = min_pos + 1LU) {
++    for (min_pos = pos = 0; min_pos != INT64_MAX; pos = min_pos + 1ULL) {
+         int64_t max_dts = INT64_MIN / 2;
+         int64_t min_dts = INT64_MAX / 2;
+         int64_t max_buffer = 0;

ffmpeg-4-CVE-2025-0518.patch

@@ -1,29 +0,0 @@
-From b5b6391d64807578ab872dc58fb8aa621dcfc38a Mon Sep 17 00:00:00 2001
-From: Michael Niedermayer <michael@niedermayer.cc>
-Date: Mon, 6 Jan 2025 22:01:39 +0100
-Subject: [PATCH] avfilter/af_pan: Fix sscanf() use
-
-Fixes: Memory Data Leak
-
-Found-by: Simcha Kosman <simcha.kosman@cyberark.com>
-Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
----
- libavfilter/af_pan.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libavfilter/af_pan.c b/libavfilter/af_pan.c
-index 0d20b0307b..5feb2439c7 100644
---- a/libavfilter/af_pan.c
-+++ b/libavfilter/af_pan.c
-@@ -196,7 +196,7 @@ static av_cold int init(AVFilterContext *ctx)
-         sign = 1;
-         while (1) {
-             gain = 1;
--            if (sscanf(arg, "%lf%n *%n", &gain, &len, &len))
-+            if (sscanf(arg, "%lf%n *%n", &gain, &len, &len) >= 1)
-                 arg += len;
-             if (parse_channel_name(&arg, &in_ch_id, &named)){
-                 av_log(ctx, AV_LOG_ERROR,
--- 
-2.44.0
-

ffmpeg-4-CVE-2025-22919.patch

@@ -1,29 +0,0 @@
-From 1446e37d3d032e1452844778b3e6ba2c20f0c322 Mon Sep 17 00:00:00 2001
-From: James Almer <jamrial@gmail.com>
-Date: Mon, 30 Dec 2024 00:25:41 -0300
-Subject: [PATCH] avfilter/buffersrc: check for valid sample rate
-
-A sample rate <= 0 is invalid.
-
-Fixes an assert in ffmpeg_enc.c that assumed a valid sample rate would be set.
-Fixes ticket #11385.
-
-Signed-off-by: James Almer <jamrial@gmail.com>
----
- libavfilter/buffersrc.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/libavfilter/buffersrc.c
-+++ b/libavfilter/buffersrc.c
-@@ -337,6 +337,11 @@
-         return AVERROR(EINVAL);
-     }
- 
-+    if (s->sample_rate <= 0) {
-+        av_log(ctx, AV_LOG_ERROR, "Sample rate not set\n");
-+        return AVERROR(EINVAL);
-+    }
-+
-     if (!s->time_base.num)
-         s->time_base = (AVRational){1, s->sample_rate};
- 

ffmpeg-4-CVE-2025-59728.patch

@@ -0,0 +1,38 @@
+Index: ffmpeg-4.4.6/libavformat/dashdec.c
+===================================================================
+--- ffmpeg-4.4.6.orig/libavformat/dashdec.c
++++ ffmpeg-4.4.6/libavformat/dashdec.c
+@@ -730,7 +730,7 @@ static int resolve_content_path(AVFormat
+     }
+ 
+     tmp_max_url_size = aligned(tmp_max_url_size);
+-    text = av_mallocz(tmp_max_url_size);
++    text = av_mallocz(tmp_max_url_size + 1);
+     if (!text) {
+         updated = AVERROR(ENOMEM);
+         goto end;
+@@ -742,7 +742,7 @@ static int resolve_content_path(AVFormat
+     }
+     av_free(text);
+ 
+-    path = av_mallocz(tmp_max_url_size);
++    path = av_mallocz(tmp_max_url_size + 2);
+     tmp_str = av_mallocz(tmp_max_url_size);
+     if (!tmp_str || !path) {
+         updated = AVERROR(ENOMEM);
+@@ -764,6 +764,15 @@ static int resolve_content_path(AVFormat
+ 
+     node = baseurl_nodes[rootId];
+     baseurl = xmlNodeGetContent(node);
++    if (baseurl) {
++        size_t len = xmlStrlen(baseurl)+2;
++        char *tmp = xmlRealloc(baseurl, len);
++        if (!tmp) {
++            updated = AVERROR(ENOMEM);
++            goto end;
++        }
++        baseurl = tmp;
++    }
+     root_url = (av_strcasecmp(baseurl, "")) ? baseurl : path;
+     if (node) {
+         xmlNodeSetContent(node, root_url);

ffmpeg-4-CVE-2025-7700.patch

@@ -0,0 +1,40 @@
+From 35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07 Mon Sep 17 00:00:00 2001
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Date: Thu, 10 Jul 2025 16:26:39 +0000
+Subject: [PATCH] libavcodec/alsdec.c: Add check for av_malloc_array() and
+ av_calloc()
+
+Add check for the return value of av_malloc_array() and av_calloc()
+to avoid potential NULL pointer dereference.
+
+Fixes: dcfd24b10c ("avcodec/alsdec: Implement floating point sample data decoding")
+
+[Remodeled for ffmpeg-4.x - sckang@suse.com]
+
+Index: ffmpeg-4.4.6/libavcodec/alsdec.c
+===================================================================
+--- ffmpeg-4.4.6.orig/libavcodec/alsdec.c
++++ ffmpeg-4.4.6/libavcodec/alsdec.c
+@@ -2116,8 +2116,8 @@ static av_cold int decode_init(AVCodecCo
+         ctx->nbits  = av_malloc_array(ctx->cur_frame_length, sizeof(*ctx->nbits));
+         ctx->mlz    = av_mallocz(sizeof(*ctx->mlz));
+ 
+-        if (!ctx->mlz || !ctx->acf || !ctx->shift_value || !ctx->last_shift_value
+-            || !ctx->last_acf_mantissa || !ctx->raw_mantissa) {
++        if (!ctx->larray || !ctx->nbits || !ctx->mlz || !ctx->acf || !ctx->shift_value
++            || !ctx->last_shift_value || !ctx->last_acf_mantissa || !ctx->raw_mantissa) {
+             av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n");
+             ret = AVERROR(ENOMEM);
+             goto fail;
+@@ -2128,6 +2128,11 @@ static av_cold int decode_init(AVCodecCo
+ 
+         for (c = 0; c < avctx->channels; ++c) {
+             ctx->raw_mantissa[c] = av_mallocz_array(ctx->cur_frame_length, sizeof(**ctx->raw_mantissa));
++            if (!ctx->raw_mantissa[c]) {
++                av_log(avctx, AV_LOG_ERROR, "Allocating buffer memory failed.\n");
++                ret = AVERROR(ENOMEM);
++                goto fail;
++            }
+         }
+     }
+ 

ffmpeg-4.4.5.tar.xz.asc

@@ -1,11 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQFMBAABCgA2FiEE/PmG6hXm4pOlZE8QtDIvBNZ2WNgFAmamzJUYHGZmbXBlZy1k
-ZXZlbEBmZm1wZWcub3JnAAoJELQyLwTWdljYZP8H/27rVRh4/NOvhP5JN2FhhWfo
-BmAYgHWLag3a8P4yShGGgxhLjnd7LKOdSTIOb67Q7CgqzsQCV7c+VgUp068uhCod
-J0TgnefWzw+iR3zupKEVRoFEsy/3A5RWXVWx42B7WTpkkShQWXaPHvUdH9ELwwfK
-mq3TQMygmjjzDIa677i3uNUrb2CGyxdUXqGzmatUfrtXm0/mqUtz41neS5tuLQn5
-xXcpmtsElkLK4ZaQWRC8w6emEyx49MqyRw7tTjIh/lPN+KTBUtcrYgDeCJt25H9s
-2Hm9Obax0z2fPi71eP7GkbVXrGmwL1DcSegFW+TCW5CniWkWaWKe4+qDMepPtIo=
-=byXw
------END PGP SIGNATURE-----

ffmpeg-4.4.6.tar.xz.asc

@@ -0,0 +1,11 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQFMBAABCgA2FiEE/PmG6hXm4pOlZE8QtDIvBNZ2WNgFAmgom1oYHGZmbXBlZy1k
+ZXZlbEBmZm1wZWcub3JnAAoJELQyLwTWdljYtS0H/3h3yGALOlSSjBmZq/+wfw0k
+QrgDVTSzILA2xnhPq4d9b6JxcaiJFX2wweid0/JxTwOE8Ky0cU+ErArlmyB1OpNl
+KNzy0MXgPHV3X39Tnzgytl8nQSei2aAtg1asOscV6Lwp4e76VQOu2atLHenXq7n7
+xSxCqJG65opWi2yRvS89F7PmdF3VDeYNJGaukF4Lunq4OsOa/sybe45pfd/uhC/F
+aAh/64/U2mhGzl2q1rdv6WIeTxtRpT+umLuUU93g20gk8Y4L3fmwbWx9UxIjUw0X
+A16PQgDw7LmmTxS4NE9cHcTwCGtUvv7ajJs6oj2fPVGScLCLInLc1KkGGkSIqqE=
+=sHXx
+-----END PGP SIGNATURE-----

ffmpeg-4.changes

@@ -1,3 +1,49 @@
+-------------------------------------------------------------------
+Wed Oct 15 02:12:04 UTC 2025 - SongChuan Kang <sckang@suse.com>
+
+- Add ffmpeg-4-CVE-2025-59728.patch: avformat/dashdec: Allocate
+  space for appended "/" (bsc#1251137, CVE-2025-59728).
+
+-------------------------------------------------------------------
+Tue Oct  7 12:34:56 UTC 2025 - olaf@aepfle.de
+
+- add missing closing brace to ffmpeg-4-CVE-2025-7700.patch 
+
+-------------------------------------------------------------------
+Mon Sep 29 07:25:31 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
+
+- Add glslang16.patch to resolve FTBFS
+
+-------------------------------------------------------------------
+Wed Jul 23 07:01:22 UTC 2025 - SongChuan Kang <sckang@suse.com>
+
+- Add ffmpeg-4-CVE-2025-7700.patch: Add check for the return value
+  of av_malloc_array() and av_calloc() to avoid potential NULL
+  pointer dereference(CVE-2025-7700, bsc#1246790).
+
+-------------------------------------------------------------------
+Fri May 30 14:28:05 UTC 2025 - Cliff Zhao <qzhao@suse.com>
+
+- Add ffmpeg-4-CVE-2024-36618.patch:
+  Backport 7a089ed8 from upstream, avformat/avidec: Fix integer
+  overflow iff ULONG_MAX < INT64_MAX.
+  (CVE-2024-36618, bsc#1234020)
+
+-------------------------------------------------------------------
+Thu May 29 20:43:43 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 4.4.6
+  * lavc/libx265: unbreak build for X265_BUILD >= 210
+  * ARM: vp9mc: Load only 12 pixels in the 4 pixel wide
+    horizontal filter
+  * rtmpproto: Avoid rare crashes in the `fail:` codepath in
+    rtmp_open
+  * avcodec/snow: Fix off by 1 error in run_buffer
+  * avcodec/mpegvideo_enc: Check FLV1 resolution limits
+- Delete ffmpeg-CVE-2023-49502.patch,
+  0001-libavcodec-arm-mlpdsp_armv5te-fix-label-format-to-wo.patch,
+  ffmpeg-4-CVE-2025-0518.patch, ffmpeg-4-CVE-2025-22919.patch (merged)
+
 -------------------------------------------------------------------
 Wed Mar  5 09:46:09 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
 
@@ -8,7 +54,7 @@ Wed Mar  5 09:46:09 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
 Fri Feb 19 05:17:22 UTC 2025 - Cliff Zhao <qzhao@suse.com>
 
 - Add ffmpeg-4-CVE-2025-22921.patch:
-  Backporting 7f9c7f98 from upstream, clear array length when
+  Backport 7f9c7f98 from upstream, clear array length when
   freeing it.
   (CVE-2025-22921, bsc#1237382)
 
@@ -16,7 +62,7 @@ Fri Feb 19 05:17:22 UTC 2025 - Cliff Zhao <qzhao@suse.com>
 Fri Feb 19 04:27:06 UTC 2025 - Cliff Zhao <qzhao@suse.com>
 
 - Add ffmpeg-4-CVE-2025-25473.patch:
-  Backporting c08d3004 from upstream, clear FFFormatContext packet.
+  Backport c08d3004 from upstream, clear FFFormatContext packet.
   When packet_buffer is used in mux.c, and if a muxing process fails
   at a point where packets remained in said queue.
   (CVE-2025-25473, bsc#1237351)
@@ -25,7 +71,7 @@ Fri Feb 19 04:27:06 UTC 2025 - Cliff Zhao <qzhao@suse.com>
 Fri Feb 19 03:18:02 UTC 2025 - Cliff Zhao <qzhao@suse.com>
 
 - Add ffmpeg-4-CVE-2025-0518.patch:
-  Backporting b5b6391d from upstream, fixes memory data leak when
+  Backport b5b6391d from upstream, fixes memory data leak when
   use sscanf().
   (CVE-2025-0518, bsc#1236007)
 
@@ -33,7 +79,7 @@ Fri Feb 19 03:18:02 UTC 2025 - Cliff Zhao <qzhao@suse.com>
 Fri Feb 19 02:58:01 UTC 2025 - Cliff Zhao <qzhao@suse.com>
 
 - Add ffmpeg-4-CVE-2025-22919.patch:
-  Backporting 1446e37d from upstream, check for valid sample rate
+  Backport 1446e37d from upstream, check for valid sample rate
   As the sample rate <= 0 is invalid.
   (CVE-2025-22919, bsc#1237371)
 
@@ -41,7 +87,7 @@ Fri Feb 19 02:58:01 UTC 2025 - Cliff Zhao <qzhao@suse.com>
 Fri Feb 19 01:48:22 UTC 2025 - Cliff Zhao <qzhao@suse.com>
 
 - Add ffmpeg-4-CVE-2024-12361.patch:
-  Backporting 4065ff69 from upstream, add check for av_packet_new_side_data()
+  Backport 4065ff69 from upstream, add check for av_packet_new_side_data()
   to avoid null pointer dereference if allocation fails.
   (CVE-2024-12361, bsc#1237358)
 
@@ -49,7 +95,7 @@ Fri Feb 19 01:48:22 UTC 2025 - Cliff Zhao <qzhao@suse.com>
 Fri Feb 19 01:11:17 UTC 2025 - Cliff Zhao <qzhao@suse.com>
 
 - Add ffmpeg-4-CVE-2024-35368.patch:
-  Backporting 45133009 from upstream, After having created the
+  Backport 45133009 from upstream, After having created the
   AVBuffer that is put into frame->buf[0], ownership of several
   objects Fix double-free on the AVFrame is unreferenced.
   (CVE-2024-35368, bsc#1234028)
@@ -62,6 +108,8 @@ Mon Jan  6 11:53:32 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
   Fixes: 51896/clusterfuzz-testcase-minimized-ffmpeg_dem_DXA_fuzzer-5730576523198464
   Fixes: signed integer overflow: 2147483566 + 82 cannot be represented in type 'int'
   (CVE-2024-36613, bsc#1235092)
+  avformat/cafdec: dont seek beyond 64bit (CVE-2024-36617, bsc#1234019).
+  avformat/westwood_vqa: Fix 2g packets (CVE-2024-36616, bsc#1234018).
 - Delete
   0001-avcodec-libsvtav1-remove-compressed_ten_bit_format-a.patch
   0001-avcodec-x86-mathops-clip-constants-used-with-shift-i.patch
@@ -72,6 +120,7 @@ Mon Jan  6 11:53:32 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
   ffmpeg-CVE-2023-50010.patch
   ffmpeg-4-CVE-2024-32230.patch
   ffmpeg-4-CVE-2024-7055.patch (all merged)
+  (CVE-2023-51798, bsc#1223304)
 
 -------------------------------------------------------------------
 Tue Oct 15 08:18:54 UTC 2024 - Antonio Larrosa <alarrosa@suse.com>
@@ -82,7 +131,7 @@ Tue Oct 15 08:18:54 UTC 2024 - Antonio Larrosa <alarrosa@suse.com>
 Fri Sep  6 15:06:21 UTC 2024 - Cliff Zhao <qzhao@suse.com>
 
 - Add ffmpeg-4-CVE-2024-7055.patch:
-  Backporting 3faadbe2 from upstream, Use 64bit for input size check,
+  Backport 3faadbe2 from upstream, Use 64bit for input size check,
   Fixes: out of array read, Fixes: poc3.
   (CVE-2024-7055, bsc#1229026)
 
@@ -102,15 +151,15 @@ Fri Jul 26 13:19:42 UTC 2024 - Filip Kastl <filip.kastl@suse.com>
 Tue Jul  2 12:26:28 UTC 2024 - Cliff Zhao <qzhao@suse.com>
 
 - Add ffmpeg-4-CVE-2024-32230.patch:
-  Backporting 96449cfe from upstream, Fix 1 line and one column images.
+  Backport 96449cfe from upstream, Fix 1 line and one column images.
   (CVE-2024-32230, bsc#1227296)
 
 -------------------------------------------------------------------
 Tue Apr 27 11:38:35 UTC 2024 - Cliff Zhao <qzhao@suse.com>
 
 - Add ffmpeg-CVE-2023-50010.patch:
-  Backporting e4d2666b from upstream, fixes the out of array access.
-  (CVE-2023-a50010, bsc#1223256)
+  Backport e4d2666b from upstream, fixes the out of array access.
+  (CVE-2023-50010, bsc#1223256)
 
 -------------------------------------------------------------------
 Fri Apr 26 22:16:48 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
@@ -122,34 +171,53 @@ Fri Apr 26 22:16:48 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
 Thu Apr 23 16:14:18 UTC 2024 - Cliff Zhao <qzhao@suse.com>
 
 - Add ffmpeg-CVE-2023-51793.patch:
-  Backporting 0ecc1f0e from upstream, Fix odd height handling.
+  Backport 0ecc1f0e from upstream, Fix odd height handling.
   (CVE-2023-51793, bsc#1223272)
 
 -------------------------------------------------------------------
 Thu Apr 23 15:35:32 UTC 2024 - Cliff Zhao <qzhao@suse.com>
 
 - Add ffmpeg-CVE-2023-49502.patch:
-  Backporting 737ede40 from upstream, account for chroma sub-sampling
+  Backport 737ede40 from upstream, account for chroma sub-sampling
   in min size calculation.
   (CVE-2023-49502, bsc#1223235)
 
 -------------------------------------------------------------------
 Tue Apr 23 14:25:53 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
 
-- Address boo#1223304/CVE-2023-51798: add patch
-  0001-avfilter-vf_minterpolate-Check-pts-before-division.patch
+- Add 0001-avfilter-vf_minterpolate-Check-pts-before-division.patch:
+  Backport 68146f06 from upstream, Check pts before division.
+  (CVE-2023-51798, bsc#1223304)
 
 -------------------------------------------------------------------
 Mon Apr 22 12:41:55 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
 
-- Address boo#1223070/CVE-2024-31578: add patch
-  0001-avutil-hwcontext-Don-t-assume-frames_uninit-is-reent.patch
+- Add 0001-avutil-hwcontext-Don-t-assume-frames_uninit-is-reent.patch:
+  Backport 76a48e85 from upstream, Check length.
+  (CVE-2024-31578, bsc#1223070)
+
+-------------------------------------------------------------------
+Mon Feb 12 18:23:41 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
+
+- ffmpeg-avcodec-libdav1d-don-t-repeatedly-parse-the-same-seq.patch
+  * fixes build against dav1d, which has been updated in
+    SUSE:SLE-15-SP5:Update (where apparently no rebuild of ffmpeg-4
+    had been triggered)
 
 -------------------------------------------------------------------
 Fri Feb  2 09:34:15 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
 
-- drop support for libmfx, which is no longer supported upstream
-  at all (boo#1219494)
+- no longer build against libmfx; build also 15.5 against libvpl
+ (boo#1230983, boo#1219494)
+
+- dropping support for libmfx below covers:
+  * libmfx: improper input validation (CVE-2023-48368, bsc#1226897)
+  * libmfx: improper buffer restrictions (CVE-2023-45221, bsc#1226898)
+  * libmfx: out-of-bounds read (CVE-2023-22656, bsc#1226899)
+  * libmfx: out-of-bounds write (CVE-2023-47282, bsc#1226900)
+  * libmfx: improper buffer restrictions (CVE-2023-47169, bsc#1226901)
+  * Multiple vulnerabilities in the Intel Media SDK (libmfx1) (bsc#1226892)
+  * Drop libmfx dependency from our product (jira #PED-10024)
 
 -------------------------------------------------------------------
 Tue Dec 26 13:36:38 UTC 2023 - Jan Engelhardt <jengelh@inai.de>
@@ -167,9 +235,9 @@ Wed Dec  6 08:50:00 UTC 2023 - Jan Engelhardt <jengelh@inai.de>
 Fri Nov  3 08:17:13 UTC 2023 - Marcus Meissner <meissner@suse.com>
 
 - Add ffmpeg-fix-new-binutils.patch:
-  Backporting 01fc3034 from upstream, Fix build with new binutils
+  Backport 01fc3034 from upstream, Fix build with new binutils
   (bsc#1215309)
- 
+
 -------------------------------------------------------------------
 Mon Oct 30 11:16:43 UTC 2023 - Jan Engelhardt <jengelh@inai.de>
 
@@ -298,6 +366,7 @@ Mon Oct 10 11:18:30 UTC 2022 - Bjørn Lie <bjorn.lie@gmail.com>
 
 - Update to version 4.4.3:
   * Stable bug fix release, mainly codecs, filter and format fixes.
+  * configure: extend SDL check to accept all 2.x versions (boo#1226308).
 - Drop ffmpeg-sdl2-detection.patch: Fixed upstream.
 - Refresh patches with quilt:
   * ffmpeg-libglslang-detection.patch
@@ -550,7 +619,7 @@ Fri Mar 31 00:41:22 UTC 2020 - Ismail Dönmez <idonmez@suse.com>
 - Add Samba support for Factory (as this needs a fix in Samba itself)
   Add --enable-libsmbclient to configure, add BR on pkgconfig(smbclient)
 - License is now GPLv3+ by default (--enable-version3)
- 
+
 -------------------------------------------------------------------
 Mon Mar 30 07:14:39 UTC 2020 - Tomáš Chvátal <tchvatal@suse.com>
 
@@ -679,6 +748,7 @@ Tue Aug  6 15:35:35 UTC 2019 - Ismail Dönmez <idonmez@suse.com>
   * mov muxer writes tracks with unspecified language instead
     of English by default
   * added support for using clang to compile CUDA kernels
+  * avcodec/g729_parser: Check channels (CVE-2022-1475, bsc#1198898)
 - Drop ffmpeg-avcodec-libdav1d-AV1-decoder-wrapper.patch, merged
   upstream.
 - Rebase and rename
@@ -883,7 +953,6 @@ Tue Nov 06 01:39:11 UTC 2018 - sean@suspend.net
   remove cve-2017-17555.diff (fixed upstream).
 
 -------------------------------------------------------------------
-
 Sat Nov 03 14:48:35 UTC 2018 - sean@suspend.net
 
 - Remove 0001-avformat-fivenc-Check-audio-packet-size.patch (fixed upstream (bsc#8591d16)

ffmpeg-4.spec

@@ -108,7 +108,7 @@
 %define _major_version 4
 %define _major_expected 5
 Name:           ffmpeg-4
-Version:        4.4.5
+Version:        4.4.6
 Release:        0
 Summary:        Set of libraries for working with various multimedia formats
 License:        GPL-3.0-or-later
@@ -135,15 +135,16 @@ Patch11:        ffmpeg-libglslang-detection.patch
 Patch14:        ffmpeg-glslang-cxx17.patch
 Patch15:        0001-avutil-hwcontext-Don-t-assume-frames_uninit-is-reent.patch
 Patch16:        0001-avcodec-libsvtav1-unbreak-build-with-latest-svtav1.patch
-Patch17:        ffmpeg-CVE-2023-49502.patch
 Patch22:        ffmpeg-c99.patch
-Patch23:        0001-libavcodec-arm-mlpdsp_armv5te-fix-label-format-to-wo.patch
 Patch24:        ffmpeg-4-CVE-2024-35368.patch
 Patch25:        ffmpeg-4-CVE-2024-12361.patch
-Patch26:        ffmpeg-4-CVE-2025-22919.patch
-Patch27:        ffmpeg-4-CVE-2025-0518.patch
 Patch28:        ffmpeg-4-CVE-2025-25473.patch
 Patch29:        ffmpeg-4-CVE-2025-22921.patch
+Patch30:        ffmpeg-avcodec-libdav1d-don-t-repeatedly-parse-the-same-seq.patch
+Patch31:        ffmpeg-4-CVE-2024-36618.patch
+Patch32:        ffmpeg-4-CVE-2025-7700.patch
+Patch33:        glslang16.patch
+Patch34:        ffmpeg-4-CVE-2025-59728.patch
 BuildRequires:  ladspa-devel
 BuildRequires:  libgsm-devel
 BuildRequires:  libmp3lame-devel

ffmpeg-CVE-2023-49502.patch

@@ -1,43 +0,0 @@
-From 737ede405b11a37fdd61d19cf25df296a0cb0b75
-From: Cosmin Stejerean <cosmin@cosmin.at>
-Date: Wed Dec 6 18:39:32 2023 +0800
-Subject: avfilter/bwdif: account for chroma sub-sampling in min size calculation
-References: https://bugzilla.opensuse.org/1223235
-References: CVE-2023-49502
-
-The current logic for detecting frames that are too small for the
-algorithm does not account for chroma sub-sampling, and so a sample
-where the luma plane is large enough, but the chroma planes are not
-will not be rejected. In that event, a heap overflow will occur.
-
-This change adjusts the logic to consider the chroma planes and makes
-the change to all three bwdif implementations.
-
-Fixes #10688
-
-Signed-off-by: Cosmin Stejerean <cosmin@cosmin.at>
-Reviewed-by: Thomas Mundt <tmundt75@gmail.com>
-Signed-off-by: Philip Langdale <philipl@overt.org>
-
-diff -Nura ffmpeg-4.4.4/libavfilter/vf_bwdif.c ffmpeg-4.4.4_new/libavfilter/vf_bwdif.c
---- ffmpeg-4.4.4/libavfilter/vf_bwdif.c	2023-04-13 02:01:50.000000000 +0800
-+++ ffmpeg-4.4.4_new/libavfilter/vf_bwdif.c	2024-04-26 02:21:48.162806014 +0800
-@@ -343,13 +343,14 @@
-     if(yadif->mode&1)
-         link->frame_rate = av_mul_q(link->src->inputs[0]->frame_rate, (AVRational){2,1});
- 
--    if (link->w < 3 || link->h < 4) {
--        av_log(ctx, AV_LOG_ERROR, "Video of less than 3 columns or 4 lines is not supported\n");
-+    yadif->csp = av_pix_fmt_desc_get(link->format);
-+    yadif->filter = filter;
-+
-+    if (AV_CEIL_RSHIFT(link->w, yadif->csp->log2_chroma_w) < 3 || AV_CEIL_RSHIFT(link->h, yadif->csp->log2_chroma_h) < 4) {
-+        av_log(ctx, AV_LOG_ERROR, "Video with planes less than 3 columns or 4 lines is not supported\n");
-         return AVERROR(EINVAL);
-     }
- 
--    yadif->csp = av_pix_fmt_desc_get(link->format);
--    yadif->filter = filter;
-     if (yadif->csp->comp[0].depth > 8) {
-         s->filter_intra = filter_intra_16bit;
-         s->filter_line  = filter_line_c_16bit;

ffmpeg-avcodec-libdav1d-don-t-repeatedly-parse-the-same-seq.patch

@@ -0,0 +1,36 @@
+commit e204846ec16c1ab34c7f3a681734cf5190433018
+Author: James Almer <jamrial@gmail.com>
+Date:   Fri Sep 3 13:50:32 2021 -0300
+
+    avcodec/libdav1d: fix compilation after recent libdav1d API changes
+
+    They were done in preparation for an upcoming 1.0 release.
+    Keep supporting previous releases for the time being.
+
+    Reviewed-by: BBB
+    Signed-off-by: James Almer <jamrial@gmail.com>
+
+--- a/libavcodec/libdav1d.c
++++ b/libavcodec/libdav1d.c
+@@ -202,6 +202,9 @@
+     Libdav1dContext *dav1d = c->priv_data;
+     Dav1dData *data = &dav1d->data;
+     Dav1dPicture pic = { 0 }, *p = &pic;
++#if FF_DAV1D_VERSION_AT_LEAST(5,1)
++    enum Dav1dEventFlags event_flags = 0;
++#endif
+     int res;
+
+     if (!data->sz) {
+@@ -280,6 +283,11 @@
+     frame->linesize[1] = p->stride[1];
+     frame->linesize[2] = p->stride[1];
+
++#if FF_DAV1D_VERSION_AT_LEAST(5,1)
++    dav1d_get_event_flags(dav1d->c, &event_flags);
++    if (c->pix_fmt == AV_PIX_FMT_NONE ||
++        event_flags & DAV1D_EVENT_FLAG_NEW_SEQUENCE)
++#endif
+     c->profile = p->seq_hdr->profile;
+     c->level = ((p->seq_hdr->operating_points[0].major_level - 2) << 2)
+                | p->seq_hdr->operating_points[0].minor_level;

glslang16.patch

@@ -0,0 +1,25 @@
+From: <ej@inai.de>
+Date: 2025-09-29 09:24:26.262746656 +0200
+
+ffmpeg never used the remapper so... so why link it in the first place?!
+---
+ configure |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+Index: ffmpeg-4.4.6/configure
+===================================================================
+--- ffmpeg-4.4.6.orig/configure
++++ ffmpeg-4.4.6/configure
+@@ -6391,10 +6391,10 @@ enabled libfreetype       && require_pkg
+ enabled libfribidi        && require_pkg_config libfribidi fribidi fribidi.h fribidi_version_info
+ enabled libglslang && { check_lib libglslang glslang/Include/glslang_c_interface.h glslang_initialize_process \
+                             -lglslang -lMachineIndependent -lOSDependent -lHLSL -lOGLCompiler -lGenericCodeGen \
+-                            -lSPVRemapper -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lpthread -lstdc++ -lm ||
++                            -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lpthread -lstdc++ -lm ||
+                         require libglslang glslang/Include/glslang_c_interface.h glslang_initialize_process \
+                             -lglslang -lOSDependent -lHLSL -lOGLCompiler \
+-                            -lSPVRemapper -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lpthread -lstdc++ -lm; }
++                            -lSPIRV -lSPIRV-Tools-opt -lSPIRV-Tools -lpthread -lstdc++ -lm; }
+ enabled libgme            && { check_pkg_config libgme libgme gme/gme.h gme_new_emu ||
+                                require libgme gme/gme.h gme_new_emu -lgme -lstdc++; }
+ enabled libgsm            && { for gsm_hdr in "gsm.h" "gsm/gsm.h"; do