qzhao/ffmpeg-4
SHA256
1
0
Fork 0
forked from jengelh/ffmpeg-4
Code Pull Requests Activity

Accepting request 1170205 from home:qzhao:branches:multimedia:libs

Browse Source 
Add ffmpeg-CVE-2023-49502.patch ffmpeg-CVE-2023-51793.patch to fix CVE bugs.

OBS-URL: https://build.opensuse.org/request/show/1170205
OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/ffmpeg-4?expand=0&rev=213
This commit is contained in:
Jan Engelhardt 2024-04-25 21:43:06 +00:00 committed by Git OBS Bridge
parent 6e1ca12e6b
commit c72074a6f9
4 changed files with 117 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
ffmpeg-4.changes
View File

@ -1,3 +1,18 @@
-------------------------------------------------------------------
Thu Apr 23 16:14:18 UTC 2024 - Cliff Zhao <qzhao@suse.com>
- Add ffmpeg-CVE-2023-51793.patch:
Backporting 0ecc1f0e from upstream, Fix odd height handling.
(CVE-2023-51793 bsc#1223272)
-------------------------------------------------------------------
Thu Apr 23 15:35:32 UTC 2024 - Cliff Zhao <qzhao@suse.com>
- Add ffmpeg-CVE-2023-49502.patch:
Backporting 737ede40 from upstream, account for chroma sub-sampling
in min size calculation.
(CVE-2023-49502 bsc#1223235)
-------------------------------------------------------------------
Tue Apr 23 14:25:53 UTC 2024 - Jan Engelhardt <jengelh@inai.de>

4
ffmpeg-4.spec
View File

@ -127,6 +127,10 @@ Patch13: 0001-avcodec-x86-mathops-clip-constants-used-with-shift-i.patch
Patch14: ffmpeg-glslang-cxx17.patch
Patch15: 0001-avutil-hwcontext-Don-t-assume-frames_uninit-is-reent.patch
Patch16: 0001-avfilter-vf_minterpolate-Check-pts-before-division.patch
# PATCH-FIX-UPSTREAM ffmpeg-CVE-2023-49502.patch CVE-2023-49502 bsc#1223235 qzhao@suse.com -- Account for chroma sub-sampling in min size calculation.
Patch17: ffmpeg-CVE-2023-49502.patch
# PATCH-FIX-UPSTREAM ffmpeg-CVE-2023-51793.patch CVE-2023-51793 bsc#1223272 qzhao@suse.com -- Fix odd height handling.
Patch18: ffmpeg-CVE-2023-51793.patch
BuildRequires: ladspa-devel
BuildRequires: libgsm-devel
BuildRequires: libmp3lame-devel

42
ffmpeg-CVE-2023-49502.patch Normal file
View File

@ -0,0 +1,42 @@
commit 737ede405b11a37fdd61d19cf25df296a0cb0b75
Author: Cosmin Stejerean <cosmin@cosmin.at>
Date: Wed Dec 6 18:39:32 2023 +0800
avfilter/bwdif: account for chroma sub-sampling in min size calculation
The current logic for detecting frames that are too small for the
algorithm does not account for chroma sub-sampling, and so a sample
where the luma plane is large enough, but the chroma planes are not
will not be rejected. In that event, a heap overflow will occur.
This change adjusts the logic to consider the chroma planes and makes
the change to all three bwdif implementations.
Fixes #10688
Signed-off-by: Cosmin Stejerean <cosmin@cosmin.at>
Reviewed-by: Thomas Mundt <tmundt75@gmail.com>
Signed-off-by: Philip Langdale <philipl@overt.org>
diff -Nura ffmpeg-4.4.4/libavfilter/vf_bwdif.c ffmpeg-4.4.4_new/libavfilter/vf_bwdif.c
--- ffmpeg-4.4.4/libavfilter/vf_bwdif.c 2023-04-13 02:01:50.000000000 +0800
+++ ffmpeg-4.4.4_new/libavfilter/vf_bwdif.c 2024-04-26 02:21:48.162806014 +0800
@@ -343,13 +343,14 @@
if(yadif->mode&1)
link->frame_rate = av_mul_q(link->src->inputs[0]->frame_rate, (AVRational){2,1});
- if (link->w < 3 || link->h < 4) {
- av_log(ctx, AV_LOG_ERROR, "Video of less than 3 columns or 4 lines is not supported\n");
+ yadif->csp = av_pix_fmt_desc_get(link->format);
+ yadif->filter = filter;
+
+ if (AV_CEIL_RSHIFT(link->w, yadif->csp->log2_chroma_w) < 3 || AV_CEIL_RSHIFT(link->h, yadif->csp->log2_chroma_h) < 4) {
+ av_log(ctx, AV_LOG_ERROR, "Video with planes less than 3 columns or 4 lines is not supported\n");
return AVERROR(EINVAL);
}
- yadif->csp = av_pix_fmt_desc_get(link->format);
- yadif->filter = filter;
if (yadif->csp->comp[0].depth > 8) {
s->filter_intra = filter_intra_16bit;
s->filter_line = filter_line_c_16bit;

56
ffmpeg-CVE-2023-51793.patch Normal file
View File

@ -0,0 +1,56 @@
commit 0ecc1f0e48930723d7a467761b66850811c23e62
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri Dec 22 12:31:35 2023 +0100
avfilter/vf_weave: Fix odd height handling
Fixes: out of array access
Fixes: tickets/10743/poc10ffmpeg
Found-by: Zeng Yunxiang and Li Zeyuan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
diff -Nura ffmpeg-4.4.4/libavfilter/vf_weave.c ffmpeg-4.4.4_new/libavfilter/vf_weave.c
--- ffmpeg-4.4.4/libavfilter/vf_weave.c 2023-04-13 02:01:50.000000000 +0800
+++ ffmpeg-4.4.4_new/libavfilter/vf_weave.c 2024-04-26 02:30:07.113807721 +0800
@@ -30,6 +30,7 @@
int double_weave;
int nb_planes;
int planeheight[4];
+ int outheight[4];
int linesize[4];
AVFrame *prev;
@@ -85,6 +86,9 @@
s->planeheight[1] = s->planeheight[2] = AV_CEIL_RSHIFT(inlink->h, desc->log2_chroma_h);
s->planeheight[0] = s->planeheight[3] = inlink->h;
+ s->outheight[1] = s->outheight[2] = AV_CEIL_RSHIFT(2*inlink->h, desc->log2_chroma_h);
+ s->outheight[0] = s->outheight[3] = 2*inlink->h;
+
s->nb_planes = av_pix_fmt_count_planes(inlink->format);
return 0;
@@ -110,19 +114,20 @@
const int height = s->planeheight[i];
const int start = (height * jobnr) / nb_jobs;
const int end = (height * (jobnr+1)) / nb_jobs;
+ const int compensation = 2*end > s->outheight[i];
av_image_copy_plane(out->data[i] + out->linesize[i] * field1 +
out->linesize[i] * start * 2,
out->linesize[i] * 2,
in->data[i] + start * in->linesize[i],
in->linesize[i],
- s->linesize[i], end - start);
+ s->linesize[i], end - start - compensation * field1);
av_image_copy_plane(out->data[i] + out->linesize[i] * field2 +
out->linesize[i] * start * 2,
out->linesize[i] * 2,
s->prev->data[i] + start * s->prev->linesize[i],
s->prev->linesize[i],
- s->linesize[i], end - start);
+ s->linesize[i], end - start - compensation * field2);
}
return 0;