From e0891e621bb7860397cb005f4aa7de5a1a2c6e9d1d0d6985ab9c2aa76e12e97c Mon Sep 17 00:00:00 2001 From: OBS User unknown Date: Sat, 27 Jul 2024 06:38:38 +0000 Subject: [PATCH] [info=cfe0711badaae4cfbccf67b46e8058d05336b845a8a44479fa7ac89ed55deea3] OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/ffmpeg-7?expand=0&rev=7 --- _scmsync.obsinfo | 4 ++-- build.specials.obscpio | 2 +- ffmpeg-7-CVE-2024-32228.patch | 11 +++++----- ffmpeg-7-CVE-2024-32229.patch | 38 +++++++++++++++++++++++++++++++++++ ffmpeg-7-CVE-2024-32230.patch | 8 ++++---- ffmpeg-7.changes | 10 ++++++++- ffmpeg-7.spec | 7 ++++--- 7 files changed, 63 insertions(+), 17 deletions(-) create mode 100644 ffmpeg-7-CVE-2024-32229.patch diff --git a/_scmsync.obsinfo b/_scmsync.obsinfo index dfdc321..9c6f22c 100644 --- a/_scmsync.obsinfo +++ b/_scmsync.obsinfo @@ -1,4 +1,4 @@ -mtime: 1720533753 -commit: 5866842008640d8587d2a2505eedfe03f21398112f825fb2986c6286a098bf00 +mtime: 1721902660 +commit: cfe0711badaae4cfbccf67b46e8058d05336b845a8a44479fa7ac89ed55deea3 url: https://src.opensuse.org/jengelh/ffmpeg-7 revision: master diff --git a/build.specials.obscpio b/build.specials.obscpio index 03397ad..156785f 100644 --- a/build.specials.obscpio +++ b/build.specials.obscpio @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:4b17bf94ebe10be719f568056498cb2e355abbe3b9b77538d8dccdc6ebeeaed3 +oid sha256:0d56ecdde70b7f2511e5b54a8c5b5f418a69fb448f6e18f1f391c12a9ea948f7 size 256 diff --git a/ffmpeg-7-CVE-2024-32228.patch b/ffmpeg-7-CVE-2024-32228.patch index 65ba077..cbd252f 100644 --- a/ffmpeg-7-CVE-2024-32228.patch +++ b/ffmpeg-7-CVE-2024-32228.patch @@ -1,12 +1,11 @@ -From 459648761f5412acdc3317d5bac982ceaa257584 Mon Sep 17 00:00:00 2001 -From: Niklas Haas +From 459648761f5412acdc3317d5bac982ceaa257584 +Author: Niklas Haas Date: Sat Apr 6 13:11:09 2024 +0200 Subject: avcodec/hevcdec: fix segfault on invalid film grain metadata References: CVE-2024-32228 -References: https://bugzilla.opensuse.org/1227277 +References: bsc#1227277 Upstream: Backport from upstream - Invalid input files may contain film grain metadata which survives ff_h274_film_grain_params_supported() but does not pass av_film_grain_params_select(), leading to a SIGSEGV on hevc_frame_end(). @@ -20,8 +19,8 @@ grain buffer even when we already know we can't apply film grain. Fixes: https://trac.ffmpeg.org/ticket/10951 ---- ffmpeg-7.0/libavcodec/hevcdec.c 2024-04-05 07:22:59.000000000 +0800 -+++ ffmpeg-7.0_new/libavcodec/hevcdec.c 2024-07-02 22:48:49.293996651 +0800 +--- ffmpeg-7.0/libavcodec/hevcdec.c ++++ ffmpeg-7.0_new/libavcodec/hevcdec.c @@ -2892,10 +2892,16 @@ !(s->avctx->export_side_data & AV_CODEC_EXPORT_DATA_FILM_GRAIN) && !s->avctx->hwaccel; diff --git a/ffmpeg-7-CVE-2024-32229.patch b/ffmpeg-7-CVE-2024-32229.patch new file mode 100644 index 0000000..1291d7f --- /dev/null +++ b/ffmpeg-7-CVE-2024-32229.patch @@ -0,0 +1,38 @@ +From a528a54ee119dcba47e7c9e30d3a56206fbad416 Mon Sep 17 00:00:00 2001 +From: James Almer +Date: Thu, 4 Jul 2024 14:55:23 -0300 +Subject: [PATCH] avfilter/vf_tiltandshift: fix buffer offset for yuv422p input + +Fixes ticket #10950. + +Signed-off-by: James Almer +--- + libavfilter/vf_tiltandshift.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/libavfilter/vf_tiltandshift.c b/libavfilter/vf_tiltandshift.c +index 85cce84fc3..b49a713339 100644 +--- a/libavfilter/vf_tiltandshift.c ++++ b/libavfilter/vf_tiltandshift.c +@@ -175,14 +175,14 @@ static void copy_column(AVFilterLink *outlink, + const uint8_t *src[4]; + + dst[0] = dst_data[0] + ncol; +- dst[1] = dst_data[1] + (ncol >> s->desc->log2_chroma_h); +- dst[2] = dst_data[2] + (ncol >> s->desc->log2_chroma_h); ++ dst[1] = dst_data[1] + (ncol >> s->desc->log2_chroma_w); ++ dst[2] = dst_data[2] + (ncol >> s->desc->log2_chroma_w); + + if (!tilt) + ncol = 0; + src[0] = src_data[0] + ncol; +- src[1] = src_data[1] + (ncol >> s->desc->log2_chroma_h); +- src[2] = src_data[2] + (ncol >> s->desc->log2_chroma_h); ++ src[1] = src_data[1] + (ncol >> s->desc->log2_chroma_w); ++ src[2] = src_data[2] + (ncol >> s->desc->log2_chroma_w); + + av_image_copy(dst, dst_linesizes, src, src_linesizes, outlink->format, 1, outlink->h); + } +-- +2.41.0 + diff --git a/ffmpeg-7-CVE-2024-32230.patch b/ffmpeg-7-CVE-2024-32230.patch index abe1c31..57946ea 100644 --- a/ffmpeg-7-CVE-2024-32230.patch +++ b/ffmpeg-7-CVE-2024-32230.patch @@ -1,17 +1,17 @@ -From 96449cfeaeb95fcfd7a2b8d9ccf7719e97471ed1 Mon Sep 17 00:00:00 2001 +From 96449cfeaeb95fcfd7a2b8d9ccf7719e97471ed1 Author: Michael Niedermayer Date: Mon Apr 8 18:38:42 2024 +0200 Subject: avcodec/mpegvideo_enc: Fix 1 line and one column images References: CVE-2024-32230 -References: https://bugzilla.opensuse.org/1227296 +References: bsc#1227296 Upstream: Backport from upstream Fixes: Ticket10952 Fixes: poc21ffmpeg Signed-off-by: Michael Niedermayer ---- ffmpeg-7.0/libavcodec/mpegvideo_enc.c 2024-04-05 07:22:59.000000000 +0800 -+++ ffmpeg-7.0_new/libavcodec/mpegvideo_enc.c 2024-07-02 23:24:47.410634866 +0800 +--- ffmpeg-7.0/libavcodec/mpegvideo_enc.c ++++ ffmpeg-7.0_new/libavcodec/mpegvideo_enc.c @@ -1198,8 +1198,8 @@ ptrdiff_t dst_stride = i ? s->uvlinesize : s->linesize; int h_shift = i ? s->chroma_x_shift : 0; diff --git a/ffmpeg-7.changes b/ffmpeg-7.changes index 0dc2358..c8baba7 100644 --- a/ffmpeg-7.changes +++ b/ffmpeg-7.changes @@ -1,9 +1,17 @@ +------------------------------------------------------------------- +Tue Jul 5 14:18:52 UTC 2024 - Cliff Zhao + +- Add ffmpeg-7-CVE-2024-32229.patch: + Backporting a528a54e from upstream, Fix buffer offset for yuv422p + input. + (CVE-2024-32229, bsc#1227277) + ------------------------------------------------------------------- Tue Jul 2 12:26:28 UTC 2024 - Cliff Zhao - Add ffmpeg-7-CVE-2024-32230.patch: Backporting 96449cfe from upstream, Fix 1 line and one column images. - (CVE-2024-32230 bsc#1227296) + (CVE-2024-32230, bsc#1227296) ------------------------------------------------------------------- Tue Jul 2 11:57:01 UTC 2024 - Cliff Zhao diff --git a/ffmpeg-7.spec b/ffmpeg-7.spec index 1035401..80e5dfb 100644 --- a/ffmpeg-7.spec +++ b/ffmpeg-7.spec @@ -92,9 +92,6 @@ Summary: Set of libraries for working with various multimedia formats License: GPL-3.0-or-later Group: Productivity/Multimedia/Video/Editors and Convertors URL: https://ffmpeg.org/ - -#Freshcode-URL: http://freshcode.club/projects/ffmpeg -#Git-Clone: git://source.ffmpeg.org/ffmpeg Source: https://www.ffmpeg.org/releases/%_name-%version.tar.xz Source2: https://www.ffmpeg.org/releases/%_name-%version.tar.xz.asc Source3: ffmpeg-7-rpmlintrc @@ -113,6 +110,7 @@ Patch10: ffmpeg-chromium.patch Patch91: ffmpeg-dlopen-openh264.patch Patch92: ffmpeg-7-CVE-2024-32228.patch Patch93: ffmpeg-7-CVE-2024-32230.patch +Patch94: ffmpeg-7-CVE-2024-32229.patch BuildRequires: ladspa-devel BuildRequires: libgsm-devel BuildRequires: libmp3lame-devel >= 3.98.3 @@ -825,6 +823,9 @@ Patch4: ffmpeg-4.2-dlopen-fdk_aac.patch Patch5: work-around-abi-break.patch Patch10: ffmpeg-chromium.patch Patch91: ffmpeg-dlopen-openh264.patch +Patch92: ffmpeg-7-CVE-2024-32228.patch +Patch93: ffmpeg-7-CVE-2024-32230.patch +Patch94: ffmpeg-7-CVE-2024-32229.patch BuildRequires: c_compiler Requires: this-is-only-for-build-envs