diff options
author | Tony Tascioglu <tony.tascioglu@windriver.com> | 2021-08-20 14:31:55 -0700 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-08-26 08:32:13 +0100 |
commit | 22b32a4ed1a906ae6559918b462ef5a87eceeddf (patch) | |
tree | 249a9d9eea678ce1ba04cc2f58c8d95169d9cc25 /meta | |
parent | 2bb72f85515db42fe3a896660151e8e6db65f022 (diff) | |
download | poky-22b32a4ed1a906ae6559918b462ef5a87eceeddf.tar.gz |
ffmpeg: fix CVE-2020-22015
avformat/movenc: Check pal_size before use
Fixes: assertion failure
Fixes: out of array read
Fixes: Ticket8190
Fixes: CVE-2020-22015
(From OE-Core rev: c10b49e2e8de02c1c6e6a57eab526ac9ebec066f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
CVE: CVE-2020-22015
Upstream-Status: Backport [4c1afa292520329eecd1cc7631bc59a8cca95c46]
Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r-- | meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2020-22015.patch | 44 | ||||
-rw-r--r-- | meta/recipes-multimedia/ffmpeg/ffmpeg_4.3.2.bb | 1 |
2 files changed, 45 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2020-22015.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2020-22015.patch new file mode 100644 index 0000000000..1fdb31de7d --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2020-22015.patch | |||
@@ -0,0 +1,44 @@ | |||
1 | From dce5d2c2ee991f8cd96ab74d51a2d1a134a1a645 Mon Sep 17 00:00:00 2001 | ||
2 | From: Michael Niedermayer <michael@niedermayer.cc> | ||
3 | Date: Sat, 29 May 2021 09:22:27 +0200 | ||
4 | Subject: [PATCH 3/5] avformat/movenc: Check pal_size before use | ||
5 | |||
6 | Fixes: assertion failure | ||
7 | Fixes: out of array read | ||
8 | Fixes: Ticket8190 | ||
9 | Fixes: CVE-2020-22015 | ||
10 | |||
11 | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> | ||
12 | |||
13 | |||
14 | CVE: CVE-2020-22015 | ||
15 | Upstream-Status: Backport [4c1afa292520329eecd1cc7631bc59a8cca95c46] | ||
16 | |||
17 | Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com> | ||
18 | --- | ||
19 | libavformat/movenc.c | 6 ++++-- | ||
20 | 1 file changed, 4 insertions(+), 2 deletions(-) | ||
21 | |||
22 | diff --git a/libavformat/movenc.c b/libavformat/movenc.c | ||
23 | index c34d86522a..9603704083 100644 | ||
24 | --- a/libavformat/movenc.c | ||
25 | +++ b/libavformat/movenc.c | ||
26 | @@ -2094,11 +2094,13 @@ static int mov_write_video_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContex | ||
27 | avio_wb16(pb, 0x18); /* Reserved */ | ||
28 | |||
29 | if (track->mode == MODE_MOV && track->par->format == AV_PIX_FMT_PAL8) { | ||
30 | - int pal_size = 1 << track->par->bits_per_coded_sample; | ||
31 | - int i; | ||
32 | + int pal_size, i; | ||
33 | avio_wb16(pb, 0); /* Color table ID */ | ||
34 | avio_wb32(pb, 0); /* Color table seed */ | ||
35 | avio_wb16(pb, 0x8000); /* Color table flags */ | ||
36 | + if (track->par->bits_per_coded_sample < 0 || track->par->bits_per_coded_sample > 8) | ||
37 | + return AVERROR(EINVAL); | ||
38 | + pal_size = 1 << track->par->bits_per_coded_sample; | ||
39 | avio_wb16(pb, pal_size - 1); /* Color table size (zero-relative) */ | ||
40 | for (i = 0; i < pal_size; i++) { | ||
41 | uint32_t rgb = track->palette[i]; | ||
42 | -- | ||
43 | 2.32.0 | ||
44 | |||
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.3.2.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.3.2.bb index 3917ad9c2c..c9c82b0398 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.3.2.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.3.2.bb | |||
@@ -28,6 +28,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ | |||
28 | file://0001-libavutil-include-assembly-with-full-path-from-sourc.patch \ | 28 | file://0001-libavutil-include-assembly-with-full-path-from-sourc.patch \ |
29 | file://fix-CVE-2020-20446.patch \ | 29 | file://fix-CVE-2020-20446.patch \ |
30 | file://fix-CVE-2020-20453.patch \ | 30 | file://fix-CVE-2020-20453.patch \ |
31 | file://fix-CVE-2020-22015.patch \ | ||
31 | " | 32 | " |
32 | SRC_URI[sha256sum] = "46e4e64f1dd0233cbc0934b9f1c0da676008cad34725113fb7f802cfa84ccddb" | 33 | SRC_URI[sha256sum] = "46e4e64f1dd0233cbc0934b9f1c0da676008cad34725113fb7f802cfa84ccddb" |
33 | 34 | ||