0001-libavcodec-arm-mlpdsp_armv5te-fix-label-format-to-wo.patch

@@ -1,58 +0,0 @@
-From 654bd47716c4f36719fb0f3f7fd8386d5ed0b916 Mon Sep 17 00:00:00 2001
-From: Ross Burton <ross.burton@arm.com>
-Date: Fri, 9 Aug 2024 11:32:00 +0100
-Subject: [PATCH] libavcodec/arm/mlpdsp_armv5te: fix label format to work with
- binutils 2.43
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-binutils 2.43 has stricter validation for labels[1] and results in errors
-when building ffmpeg for armv5:
-
-src/libavcodec/arm/mlpdsp_armv5te.S:232: Error: junk at end of line, first unrecognized character is `0'
-
-Remove the leading zero in the "01" label to resolve this error.
-
-[1] https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=226749d5a6ff0d5c607d6428d6c81e1e7e7a994b
-
-Signed-off-by: Ross Burton <ross.burton@arm.com>
-Signed-off-by: Martin Storsjö <martin@martin.st>
----
- libavcodec/arm/mlpdsp_armv5te.S | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/libavcodec/arm/mlpdsp_armv5te.S b/libavcodec/arm/mlpdsp_armv5te.S
-index 4f9aa485fd..d31568611c 100644
---- a/libavcodec/arm/mlpdsp_armv5te.S
-+++ b/libavcodec/arm/mlpdsp_armv5te.S
-@@ -229,7 +229,7 @@ A .endif
-   .endif
- 
-         // Begin loop
--01:
-+1:
-   .if TOTAL_TAPS == 0
-         // Things simplify a lot in this case
-         // In fact this could be pipelined further if it's worth it...
-@@ -241,7 +241,7 @@ A .endif
-         str     ST0, [PST, #-4]!
-         str     ST0, [PST, #4 * (MAX_BLOCKSIZE + MAX_FIR_ORDER)]
-         str     ST0, [PSAMP], #4 * MAX_CHANNELS
--        bne     01b
-+        bne     1b
-   .else
-     .if \fir_taps & 1
-       .set LOAD_REG, 1
-@@ -333,7 +333,7 @@ T       orr     AC0, AC0, AC1
-         str     ST3, [PST, #-4]!
-         str     ST2, [PST, #4 * (MAX_BLOCKSIZE + MAX_FIR_ORDER)]
-         str     ST3, [PSAMP], #4 * MAX_CHANNELS
--        bne     01b
-+        bne     1b
-   .endif
-         b       99f
- 
--- 
-2.46.0
-

ffmpeg-7-CVE-2024-32228.patch

@@ -0,0 +1,54 @@
+From 459648761f5412acdc3317d5bac982ceaa257584
+Author: Niklas Haas <git@haasn.dev>
+Date: Sat Apr 6 13:11:09 2024 +0200
+Subject: avcodec/hevcdec: fix segfault on invalid film grain metadata
+References: CVE-2024-32228
+References: https://bugzilla.opensuse.org/1227277
+Upstream: Backport from upstream
+
+Invalid input files may contain film grain metadata which survives
+ff_h274_film_grain_params_supported() but does not pass
+av_film_grain_params_select(), leading to a SIGSEGV on hevc_frame_end().
+
+Fix this by duplicating the av_film_grain_params_select() check at frame
+init time.
+
+An alternative solution here would be to defer the incompatibility check
+to hevc_frame_end(), but this has the downside of allocating a film
+grain buffer even when we already know we can't apply film grain.
+
+Fixes: https://trac.ffmpeg.org/ticket/10951
+
+--- ffmpeg-7.0/libavcodec/hevcdec.c
++++ ffmpeg-7.0_new/libavcodec/hevcdec.c
+@@ -2892,10 +2892,16 @@
+         !(s->avctx->export_side_data & AV_CODEC_EXPORT_DATA_FILM_GRAIN) &&
+         !s->avctx->hwaccel;
+ 
++    ret = set_side_data(s);
++    if (ret < 0)
++        goto fail;
++
+     if (s->ref->needs_fg &&
+-        s->sei.common.film_grain_characteristics.present &&
+-        !ff_h274_film_grain_params_supported(s->sei.common.film_grain_characteristics.model_id,
+-                                             s->ref->frame->format)) {
++        ( s->sei.common.film_grain_characteristics.present &&
++          !ff_h274_film_grain_params_supported(s->sei.common.film_grain_characteristics.model_id,
++                                               s->ref->frame->format))
++          || !av_film_grain_params_select(s->ref->frame)) {
++
+         av_log_once(s->avctx, AV_LOG_WARNING, AV_LOG_DEBUG, &s->film_grain_warning_shown,
+                     "Unsupported film grain parameters. Ignoring film grain.\n");
+         s->ref->needs_fg = 0;
+@@ -2909,10 +2915,6 @@
+             goto fail;
+     }
+ 
+-    ret = set_side_data(s);
+-    if (ret < 0)
+-        goto fail;
+-
+     s->frame->pict_type = 3 - s->sh.slice_type;
+ 
+     if (!IS_IRAP(s))

ffmpeg-7-CVE-2024-32229.patch

@@ -0,0 +1,38 @@
+From a528a54ee119dcba47e7c9e30d3a56206fbad416 Mon Sep 17 00:00:00 2001
+From: James Almer <jamrial@gmail.com>
+Date: Thu, 4 Jul 2024 14:55:23 -0300
+Subject: [PATCH] avfilter/vf_tiltandshift: fix buffer offset for yuv422p input
+
+Fixes ticket #10950.
+
+Signed-off-by: James Almer <jamrial@gmail.com>
+---
+ libavfilter/vf_tiltandshift.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/libavfilter/vf_tiltandshift.c b/libavfilter/vf_tiltandshift.c
+index 85cce84fc3..b49a713339 100644
+--- a/libavfilter/vf_tiltandshift.c
++++ b/libavfilter/vf_tiltandshift.c
+@@ -175,14 +175,14 @@ static void copy_column(AVFilterLink *outlink,
+     const uint8_t *src[4];
+ 
+     dst[0] = dst_data[0] + ncol;
+-    dst[1] = dst_data[1] + (ncol >> s->desc->log2_chroma_h);
+-    dst[2] = dst_data[2] + (ncol >> s->desc->log2_chroma_h);
++    dst[1] = dst_data[1] + (ncol >> s->desc->log2_chroma_w);
++    dst[2] = dst_data[2] + (ncol >> s->desc->log2_chroma_w);
+ 
+     if (!tilt)
+         ncol = 0;
+     src[0] = src_data[0] + ncol;
+-    src[1] = src_data[1] + (ncol >> s->desc->log2_chroma_h);
+-    src[2] = src_data[2] + (ncol >> s->desc->log2_chroma_h);
++    src[1] = src_data[1] + (ncol >> s->desc->log2_chroma_w);
++    src[2] = src_data[2] + (ncol >> s->desc->log2_chroma_w);
+ 
+     av_image_copy(dst, dst_linesizes, src, src_linesizes, outlink->format, 1, outlink->h);
+ }
+-- 
+2.41.0
+

ffmpeg-7-CVE-2024-32230.patch

@@ -0,0 +1,25 @@
+From 96449cfeaeb95fcfd7a2b8d9ccf7719e97471ed1
+Author: Michael Niedermayer <michael@niedermayer.cc>
+Date: Mon Apr 8 18:38:42 2024 +0200
+Subject: avcodec/mpegvideo_enc: Fix 1 line and one column images
+References: CVE-2024-32230
+References: https://bugzilla.opensuse.org/1227296
+Upstream: Backport from upstream
+
+Fixes: Ticket10952
+Fixes: poc21ffmpeg
+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
+
+--- ffmpeg-7.0/libavcodec/mpegvideo_enc.c
++++ ffmpeg-7.0_new/libavcodec/mpegvideo_enc.c
+@@ -1198,8 +1198,8 @@
+                 ptrdiff_t dst_stride = i ? s->uvlinesize : s->linesize;
+                 int h_shift = i ? s->chroma_x_shift : 0;
+                 int v_shift = i ? s->chroma_y_shift : 0;
+-                int w = s->width  >> h_shift;
+-                int h = s->height >> v_shift;
++                int w = AV_CEIL_RSHIFT(s->width , h_shift);
++                int h = AV_CEIL_RSHIFT(s->height, v_shift);
+                 const uint8_t *src = pic_arg->data[i];
+                 uint8_t *dst = pic->f->data[i];
+                 int vpad = 16;

ffmpeg-7.changes

@@ -1,9 +1,3 @@
--------------------------------------------------------------------
-Wed Aug 21 09:58:42 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
-
-- Add 0001-libavcodec-arm-mlpdsp_armv5te-fix-label-format-to-wo.patch
-  to resolve build failure on armv7 [boo#1229338]
-
 -------------------------------------------------------------------
 Wed Aug  7 07:37:24 UTC 2024 - Cliff Zhao <qzhao@suse.com>
 

ffmpeg-7.spec

@@ -110,7 +110,6 @@ Patch5:         work-around-abi-break.patch
 Patch10:        ffmpeg-chromium.patch
 Patch91:        ffmpeg-dlopen-openh264.patch
 Patch95:        ffmpeg-7-fix-crashes.patch
-Patch96:        0001-libavcodec-arm-mlpdsp_armv5te-fix-label-format-to-wo.patch
 BuildRequires:  ladspa-devel
 BuildRequires:  libgsm-devel
 BuildRequires:  libmp3lame-devel >= 3.98.3
@@ -807,7 +806,7 @@ done
 %else
 %define _name ffmpeg
 Name:           ffmpeg-7-mini
-Version:        7.0.2
+Version:        7.0
 Release:        0
 Summary:        Set of libraries for working with various multimedia formats
 License:        GPL-3.0-or-later
@@ -823,8 +822,10 @@ Patch4:         ffmpeg-4.2-dlopen-fdk_aac.patch
 Patch5:         work-around-abi-break.patch
 Patch10:        ffmpeg-chromium.patch
 Patch91:        ffmpeg-dlopen-openh264.patch
+Patch92:        ffmpeg-7-CVE-2024-32228.patch
+Patch93:        ffmpeg-7-CVE-2024-32230.patch
+Patch94:        ffmpeg-7-CVE-2024-32229.patch
 Patch95:        ffmpeg-7-fix-crashes.patch
-Patch96:        0001-libavcodec-arm-mlpdsp_armv5te-fix-label-format-to-wo.patch
 BuildRequires:  c_compiler
 Requires:       this-is-only-for-build-envs