qzhao/ffmpeg-4
SHA256
1
0
Fork 0
forked from jengelh/ffmpeg-4
Code Pull Requests Activity

Accepting request 1059895 from home:AZhou:branches:multimedia:libs

Browse Source 
- Add ffmpeg-CVE-2022-3341.patch: Backport from upstream to fix
  null pointer dereference in decode_main_header() in
  libavformat/nutdec.c (bsc#1206778).

OBS-URL: https://build.opensuse.org/request/show/1059895
OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/ffmpeg-4?expand=0&rev=192
This commit is contained in:
Jan Engelhardt 2023-01-22 15:23:18 +00:00 committed by Git OBS Bridge
parent 10330b2059
commit eb61ca7811
3 changed files with 53 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ffmpeg-4.changes
View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Fri Jan 20 07:22:58 UTC 2023 - Alynx Zhou <alynx.zhou@suse.com>
- Add ffmpeg-CVE-2022-3341.patch: Backport from upstream to fix
null pointer dereference in decode_main_header() in
libavformat/nutdec.c (bsc#1206778).
------------------------------------------------------------------- -------------------------------------------------------------------
Fri Dec 23 08:09:25 UTC 2022 - Alynx Zhou <alynx.zhou@suse.com> Fri Dec 23 08:09:25 UTC 2022 - Alynx Zhou <alynx.zhou@suse.com>

3
ffmpeg-4.spec
View File

@ -1,7 +1,7 @@
# #
# spec file for package ffmpeg-4 # spec file for package ffmpeg-4
# #
# Copyright (c) 2022 SUSE LLC # Copyright (c) 2023 SUSE LLC
# #
# All modifications and additions to the file contributed by third parties # All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed # remain the property of their copyright owners, unless otherwise agreed
@ -122,6 +122,7 @@ Patch10: ffmpeg-chromium.patch
Patch11: ffmpeg-libglslang-detection.patch Patch11: ffmpeg-libglslang-detection.patch
Patch12: ffmpeg-CVE-2022-3964.patch Patch12: ffmpeg-CVE-2022-3964.patch
Patch13: ffmpeg-CVE-2022-3109.patch Patch13: ffmpeg-CVE-2022-3109.patch
Patch14: ffmpeg-CVE-2022-3341.patch
BuildRequires: ladspa-devel BuildRequires: ladspa-devel
BuildRequires: libgsm-devel BuildRequires: libgsm-devel
BuildRequires: libmp3lame-devel BuildRequires: libmp3lame-devel

44
ffmpeg-CVE-2022-3341.patch Normal file
View File

@ -0,0 +1,44 @@
diff --unified --recursive --text --new-file --color ffmpeg-4.4.3.old/libavformat/nutdec.c ffmpeg-4.4.3.new/libavformat/nutdec.c
--- ffmpeg-4.4.3.old/libavformat/nutdec.c 2022-10-10 03:04:43.000000000 +0800
+++ ffmpeg-4.4.3.new/libavformat/nutdec.c 2023-01-20 15:33:38.060002545 +0800
@@ -358,8 +358,12 @@
ret = AVERROR(ENOMEM);
goto fail;
}
- for (i = 0; i < stream_count; i++)
- avformat_new_stream(s, NULL);
+ for (i = 0; i < stream_count; i++) {
+ if (!avformat_new_stream(s, NULL)) {
+ ret = AVERROR(ENOMEM);
+ goto fail;
+ }
+ }
return 0;
fail:
@@ -807,19 +811,23 @@
NUTContext *nut = s->priv_data;
AVIOContext *bc = s->pb;
int64_t pos;
- int initialized_stream_count;
+ int initialized_stream_count, ret;
nut->avf = s;
/* main header */
pos = 0;
+ ret = 0;
do {
+ if (ret == AVERROR(ENOMEM))
+ return ret;
+
pos = find_startcode(bc, MAIN_STARTCODE, pos) + 1;
if (pos < 0 + 1) {
av_log(s, AV_LOG_ERROR, "No main startcode found.\n");
goto fail;
}
- } while (decode_main_header(nut) < 0);
+ } while ((ret = decode_main_header(nut)) < 0);
/* stream headers */
pos = 0;