Accepting request 1170215 from multimedia:libs
(CVE-2023-51793 bsc#1223272) (CVE-2023-49502 bsc#1223235) boo#1223304/CVE-2023-51798 OBS-URL: https://build.opensuse.org/request/show/1170215 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/ffmpeg-4?expand=0&rev=65
This commit is contained in:
commit
1f434e8d0b
@ -0,0 +1,40 @@
|
|||||||
|
From 68146f06f852078866b3ef1564556e3a272920c7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Michael Niedermayer <michael@niedermayer.cc>
|
||||||
|
Date: Sat, 30 Dec 2023 02:51:32 +0100
|
||||||
|
Subject: [PATCH] avfilter/vf_minterpolate: Check pts before division
|
||||||
|
References: https://bugzilla.opensuse.org/1223304
|
||||||
|
References: CVE-2023-51798
|
||||||
|
|
||||||
|
Fixes: FPE
|
||||||
|
Fixes: tickets/10758/poc20ffmpeg
|
||||||
|
|
||||||
|
Discovered by Zeng Yunxiang
|
||||||
|
|
||||||
|
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
|
||||||
|
---
|
||||||
|
libavfilter/vf_minterpolate.c | 9 +++++++--
|
||||||
|
1 file changed, 7 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/libavfilter/vf_minterpolate.c b/libavfilter/vf_minterpolate.c
|
||||||
|
index 9920210ece..b2242a15ee 100644
|
||||||
|
--- a/libavfilter/vf_minterpolate.c
|
||||||
|
+++ b/libavfilter/vf_minterpolate.c
|
||||||
|
@@ -1075,8 +1075,13 @@ static void interpolate(AVFilterLink *inlink, AVFrame *avf_out)
|
||||||
|
pts = av_rescale(avf_out->pts, (int64_t) ALPHA_MAX * outlink->time_base.num * inlink->time_base.den,
|
||||||
|
(int64_t) outlink->time_base.den * inlink->time_base.num);
|
||||||
|
|
||||||
|
- alpha = (pts - mi_ctx->frames[1].avf->pts * ALPHA_MAX) / (mi_ctx->frames[2].avf->pts - mi_ctx->frames[1].avf->pts);
|
||||||
|
- alpha = av_clip(alpha, 0, ALPHA_MAX);
|
||||||
|
+ if (mi_ctx->frames[2].avf->pts > mi_ctx->frames[1].avf->pts) {
|
||||||
|
+ alpha = (pts - mi_ctx->frames[1].avf->pts * ALPHA_MAX) / (mi_ctx->frames[2].avf->pts - mi_ctx->frames[1].avf->pts);
|
||||||
|
+ alpha = av_clip(alpha, 0, ALPHA_MAX);
|
||||||
|
+ } else {
|
||||||
|
+ av_log(ctx, AV_LOG_DEBUG, "duplicate input PTS detected\n");
|
||||||
|
+ alpha = 0;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
if (alpha == 0 || alpha == ALPHA_MAX) {
|
||||||
|
av_frame_copy(avf_out, alpha ? mi_ctx->frames[2].avf : mi_ctx->frames[1].avf);
|
||||||
|
--
|
||||||
|
2.44.0
|
||||||
|
|
@ -1,3 +1,24 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Apr 23 16:14:18 UTC 2024 - Cliff Zhao <qzhao@suse.com>
|
||||||
|
|
||||||
|
- Add ffmpeg-CVE-2023-51793.patch:
|
||||||
|
Backporting 0ecc1f0e from upstream, Fix odd height handling.
|
||||||
|
(CVE-2023-51793 bsc#1223272)
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Apr 23 15:35:32 UTC 2024 - Cliff Zhao <qzhao@suse.com>
|
||||||
|
|
||||||
|
- Add ffmpeg-CVE-2023-49502.patch:
|
||||||
|
Backporting 737ede40 from upstream, account for chroma sub-sampling
|
||||||
|
in min size calculation.
|
||||||
|
(CVE-2023-49502 bsc#1223235)
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue Apr 23 14:25:53 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
|
||||||
|
|
||||||
|
- Address boo#1223304/CVE-2023-51798: add patch
|
||||||
|
0001-avfilter-vf_minterpolate-Check-pts-before-division.patch
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Mon Apr 22 12:41:55 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
|
Mon Apr 22 12:41:55 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
|
||||||
|
|
||||||
|
@ -126,6 +126,9 @@ Patch12: 0001-avcodec-libsvtav1-remove-compressed_ten_bit_format-a.patch
|
|||||||
Patch13: 0001-avcodec-x86-mathops-clip-constants-used-with-shift-i.patch
|
Patch13: 0001-avcodec-x86-mathops-clip-constants-used-with-shift-i.patch
|
||||||
Patch14: ffmpeg-glslang-cxx17.patch
|
Patch14: ffmpeg-glslang-cxx17.patch
|
||||||
Patch15: 0001-avutil-hwcontext-Don-t-assume-frames_uninit-is-reent.patch
|
Patch15: 0001-avutil-hwcontext-Don-t-assume-frames_uninit-is-reent.patch
|
||||||
|
Patch16: 0001-avfilter-vf_minterpolate-Check-pts-before-division.patch
|
||||||
|
Patch17: ffmpeg-CVE-2023-49502.patch
|
||||||
|
Patch18: ffmpeg-CVE-2023-51793.patch
|
||||||
BuildRequires: ladspa-devel
|
BuildRequires: ladspa-devel
|
||||||
BuildRequires: libgsm-devel
|
BuildRequires: libgsm-devel
|
||||||
BuildRequires: libmp3lame-devel
|
BuildRequires: libmp3lame-devel
|
||||||
|
43
ffmpeg-CVE-2023-49502.patch
Normal file
43
ffmpeg-CVE-2023-49502.patch
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
From 737ede405b11a37fdd61d19cf25df296a0cb0b75
|
||||||
|
From: Cosmin Stejerean <cosmin@cosmin.at>
|
||||||
|
Date: Wed Dec 6 18:39:32 2023 +0800
|
||||||
|
Subject: avfilter/bwdif: account for chroma sub-sampling in min size calculation
|
||||||
|
References: https://bugzilla.opensuse.org/1223235
|
||||||
|
References: CVE-2023-49502
|
||||||
|
|
||||||
|
The current logic for detecting frames that are too small for the
|
||||||
|
algorithm does not account for chroma sub-sampling, and so a sample
|
||||||
|
where the luma plane is large enough, but the chroma planes are not
|
||||||
|
will not be rejected. In that event, a heap overflow will occur.
|
||||||
|
|
||||||
|
This change adjusts the logic to consider the chroma planes and makes
|
||||||
|
the change to all three bwdif implementations.
|
||||||
|
|
||||||
|
Fixes #10688
|
||||||
|
|
||||||
|
Signed-off-by: Cosmin Stejerean <cosmin@cosmin.at>
|
||||||
|
Reviewed-by: Thomas Mundt <tmundt75@gmail.com>
|
||||||
|
Signed-off-by: Philip Langdale <philipl@overt.org>
|
||||||
|
|
||||||
|
diff -Nura ffmpeg-4.4.4/libavfilter/vf_bwdif.c ffmpeg-4.4.4_new/libavfilter/vf_bwdif.c
|
||||||
|
--- ffmpeg-4.4.4/libavfilter/vf_bwdif.c 2023-04-13 02:01:50.000000000 +0800
|
||||||
|
+++ ffmpeg-4.4.4_new/libavfilter/vf_bwdif.c 2024-04-26 02:21:48.162806014 +0800
|
||||||
|
@@ -343,13 +343,14 @@
|
||||||
|
if(yadif->mode&1)
|
||||||
|
link->frame_rate = av_mul_q(link->src->inputs[0]->frame_rate, (AVRational){2,1});
|
||||||
|
|
||||||
|
- if (link->w < 3 || link->h < 4) {
|
||||||
|
- av_log(ctx, AV_LOG_ERROR, "Video of less than 3 columns or 4 lines is not supported\n");
|
||||||
|
+ yadif->csp = av_pix_fmt_desc_get(link->format);
|
||||||
|
+ yadif->filter = filter;
|
||||||
|
+
|
||||||
|
+ if (AV_CEIL_RSHIFT(link->w, yadif->csp->log2_chroma_w) < 3 || AV_CEIL_RSHIFT(link->h, yadif->csp->log2_chroma_h) < 4) {
|
||||||
|
+ av_log(ctx, AV_LOG_ERROR, "Video with planes less than 3 columns or 4 lines is not supported\n");
|
||||||
|
return AVERROR(EINVAL);
|
||||||
|
}
|
||||||
|
|
||||||
|
- yadif->csp = av_pix_fmt_desc_get(link->format);
|
||||||
|
- yadif->filter = filter;
|
||||||
|
if (yadif->csp->comp[0].depth > 8) {
|
||||||
|
s->filter_intra = filter_intra_16bit;
|
||||||
|
s->filter_line = filter_line_c_16bit;
|
57
ffmpeg-CVE-2023-51793.patch
Normal file
57
ffmpeg-CVE-2023-51793.patch
Normal file
@ -0,0 +1,57 @@
|
|||||||
|
From 0ecc1f0e48930723d7a467761b66850811c23e62
|
||||||
|
From: Michael Niedermayer <michael@niedermayer.cc>
|
||||||
|
Date: Fri Dec 22 12:31:35 2023 +0100
|
||||||
|
Subject: avfilter/vf_weave: Fix odd height handling
|
||||||
|
References: https://bugzilla.opensuse.org/1223272
|
||||||
|
References: CVE-2023-51793
|
||||||
|
|
||||||
|
Fixes: out of array access
|
||||||
|
Fixes: tickets/10743/poc10ffmpeg
|
||||||
|
|
||||||
|
Found-by: Zeng Yunxiang and Li Zeyuan
|
||||||
|
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
|
||||||
|
|
||||||
|
diff -Nura ffmpeg-4.4.4/libavfilter/vf_weave.c ffmpeg-4.4.4_new/libavfilter/vf_weave.c
|
||||||
|
--- ffmpeg-4.4.4/libavfilter/vf_weave.c 2023-04-13 02:01:50.000000000 +0800
|
||||||
|
+++ ffmpeg-4.4.4_new/libavfilter/vf_weave.c 2024-04-26 02:30:07.113807721 +0800
|
||||||
|
@@ -30,6 +30,7 @@
|
||||||
|
int double_weave;
|
||||||
|
int nb_planes;
|
||||||
|
int planeheight[4];
|
||||||
|
+ int outheight[4];
|
||||||
|
int linesize[4];
|
||||||
|
|
||||||
|
AVFrame *prev;
|
||||||
|
@@ -85,6 +86,9 @@
|
||||||
|
s->planeheight[1] = s->planeheight[2] = AV_CEIL_RSHIFT(inlink->h, desc->log2_chroma_h);
|
||||||
|
s->planeheight[0] = s->planeheight[3] = inlink->h;
|
||||||
|
|
||||||
|
+ s->outheight[1] = s->outheight[2] = AV_CEIL_RSHIFT(2*inlink->h, desc->log2_chroma_h);
|
||||||
|
+ s->outheight[0] = s->outheight[3] = 2*inlink->h;
|
||||||
|
+
|
||||||
|
s->nb_planes = av_pix_fmt_count_planes(inlink->format);
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
@@ -110,19 +114,20 @@
|
||||||
|
const int height = s->planeheight[i];
|
||||||
|
const int start = (height * jobnr) / nb_jobs;
|
||||||
|
const int end = (height * (jobnr+1)) / nb_jobs;
|
||||||
|
+ const int compensation = 2*end > s->outheight[i];
|
||||||
|
|
||||||
|
av_image_copy_plane(out->data[i] + out->linesize[i] * field1 +
|
||||||
|
out->linesize[i] * start * 2,
|
||||||
|
out->linesize[i] * 2,
|
||||||
|
in->data[i] + start * in->linesize[i],
|
||||||
|
in->linesize[i],
|
||||||
|
- s->linesize[i], end - start);
|
||||||
|
+ s->linesize[i], end - start - compensation * field1);
|
||||||
|
av_image_copy_plane(out->data[i] + out->linesize[i] * field2 +
|
||||||
|
out->linesize[i] * start * 2,
|
||||||
|
out->linesize[i] * 2,
|
||||||
|
s->prev->data[i] + start * s->prev->linesize[i],
|
||||||
|
s->prev->linesize[i],
|
||||||
|
- s->linesize[i], end - start);
|
||||||
|
+ s->linesize[i], end - start - compensation * field2);
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
Loading…
Reference in New Issue
Block a user