summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTony Tascioglu <tony.tascioglu@windriver.com>2021-07-27 16:20:47 -0700
committerRichard Purdie <richard.purdie@linuxfoundation.org>2021-07-28 23:47:00 +0100
commit9da5e45c73309900f119fd37eb4a8c3f33763674 (patch)
tree76c19e6b7c2dbe41dec8fe16b9c1759591a83b1d
parentd6044c86b081be3700ce7ba111b5c8ac3d4f5747 (diff)
downloadpoky-9da5e45c73309900f119fd37eb4a8c3f33763674.tar.gz
ffmpeg: fix CVE-2021-33815
avcodec/exr: More strictly check dc_count Fixes: out of array access Fixes: exr/deneme Found-by: Burak Çarıkçı <burakcarikci@crypttech.com> (From OE-Core rev: e03fda4df5d2865d5ac516f45aa120e2caf7de47) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> CVE: CVE-2021-33815 Upstream-Status: Backport [26d3c81bc5ef2f8c3f09d45eaeacfb4b1139a777] Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-33815.patch44
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg_4.4.bb1
2 files changed, 45 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-33815.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-33815.patch
new file mode 100644
index 0000000000..51edb76389
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-33815.patch
@@ -0,0 +1,44 @@
1From 26d3c81bc5ef2f8c3f09d45eaeacfb4b1139a777 Mon Sep 17 00:00:00 2001
2From: Michael Niedermayer <michael@niedermayer.cc>
3Date: Tue, 25 May 2021 19:29:18 +0200
4Subject: [PATCH] avcodec/exr: More strictly check dc_count
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9Fixes: out of array access
10Fixes: exr/deneme
11
12Found-by: Burak Çarıkçı <burakcarikci@crypttech.com>
13Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
14
15
16CVE: CVE-2021-33815
17Upstream-Status: Backport [26d3c81bc5ef2f8c3f09d45eaeacfb4b1139a777]
18
19Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
20---
21 libavcodec/exr.c | 4 ++--
22 1 file changed, 2 insertions(+), 2 deletions(-)
23
24diff --git a/libavcodec/exr.c b/libavcodec/exr.c
25index 9377a89169..4648ed7d62 100644
26--- a/libavcodec/exr.c
27+++ b/libavcodec/exr.c
28@@ -1059,11 +1059,11 @@ static int dwa_uncompress(EXRContext *s, const uint8_t *src, int compressed_size
29 bytestream2_skip(&gb, ac_size);
30 }
31
32- if (dc_size > 0) {
33+ {
34 unsigned long dest_len = dc_count * 2LL;
35 GetByteContext agb = gb;
36
37- if (dc_count > (6LL * td->xsize * td->ysize + 63) / 64)
38+ if (dc_count != dc_w * dc_h * 3)
39 return AVERROR_INVALIDDATA;
40
41 av_fast_padded_malloc(&td->dc_data, &td->dc_size, FFALIGN(dest_len, 64) * 2);
42--
432.32.0
44
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.4.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.4.bb
index 70b1513048..02af257d0f 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.4.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.4.bb
@@ -30,6 +30,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \
30 file://fix-CVE-2020-22015.patch \ 30 file://fix-CVE-2020-22015.patch \
31 file://fix-CVE-2020-22021.patch \ 31 file://fix-CVE-2020-22021.patch \
32 file://fix-CVE-2020-22033-CVE-2020-22019.patch \ 32 file://fix-CVE-2020-22033-CVE-2020-22019.patch \
33 file://fix-CVE-2021-33815.patch \
33 " 34 "
34SRC_URI[sha256sum] = "06b10a183ce5371f915c6bb15b7b1fffbe046e8275099c96affc29e17645d909" 35SRC_URI[sha256sum] = "06b10a183ce5371f915c6bb15b7b1fffbe046e8275099c96affc29e17645d909"
35 36