diff options
Diffstat (limited to 'meta/recipes-multimedia')
-rw-r--r-- | meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2020-12284.patch | 36 | ||||
-rw-r--r-- | meta/recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb | 1 |
2 files changed, 37 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2020-12284.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2020-12284.patch new file mode 100644 index 0000000000..5fff4754f4 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2020-12284.patch | |||
@@ -0,0 +1,36 @@ | |||
1 | From 1812352d767ccf5431aa440123e2e260a4db2726 Mon Sep 17 00:00:00 2001 | ||
2 | From: Michael Niedermayer <michael@niedermayer.cc> | ||
3 | Date: Sat, 7 Mar 2020 15:42:58 +0100 | ||
4 | Subject: [PATCH] avcodec/cbs_jpeg: Check length for SOS | ||
5 | |||
6 | Fixes: out of array access | ||
7 | Fixes: 19734/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5673507031875584 | ||
8 | Fixes: 19353/clusterfuzz-testcase-minimized-ffmpeg_BSF_TRACE_HEADERS_fuzzer-5703944462663680 | ||
9 | |||
10 | Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg | ||
11 | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> | ||
12 | |||
13 | Upstream-Status: Backport [https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/1812352d767ccf5431aa440123e2e260a4db2726] | ||
14 | CVE: CVE-2020-12284 | ||
15 | Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> | ||
16 | --- | ||
17 | libavcodec/cbs_jpeg.c | 3 +++ | ||
18 | 1 file changed, 3 insertions(+) | ||
19 | |||
20 | diff --git a/libavcodec/cbs_jpeg.c b/libavcodec/cbs_jpeg.c | ||
21 | index 6bbce5f..89512a2 100644 | ||
22 | --- a/libavcodec/cbs_jpeg.c | ||
23 | +++ b/libavcodec/cbs_jpeg.c | ||
24 | @@ -197,6 +197,9 @@ static int cbs_jpeg_split_fragment(CodedBitstreamContext *ctx, | ||
25 | if (marker == JPEG_MARKER_SOS) { | ||
26 | length = AV_RB16(frag->data + start); | ||
27 | |||
28 | + if (length > end - start) | ||
29 | + return AVERROR_INVALIDDATA; | ||
30 | + | ||
31 | data_ref = NULL; | ||
32 | data = av_malloc(end - start + | ||
33 | AV_INPUT_BUFFER_PADDING_SIZE); | ||
34 | -- | ||
35 | 2.7.4 | ||
36 | |||
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb index d7b0641054..fddfef9e27 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb | |||
@@ -25,6 +25,7 @@ LIC_FILES_CHKSUM = "file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \ | |||
25 | 25 | ||
26 | SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ | 26 | SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ |
27 | file://mips64_cpu_detection.patch \ | 27 | file://mips64_cpu_detection.patch \ |
28 | file://CVE-2020-12284.patch \ | ||
28 | " | 29 | " |
29 | SRC_URI[md5sum] = "348956fc2faa57a2f79bbb84ded9fbc3" | 30 | SRC_URI[md5sum] = "348956fc2faa57a2f79bbb84ded9fbc3" |
30 | SRC_URI[sha256sum] = "cb754255ab0ee2ea5f66f8850e1bd6ad5cac1cd855d0a2f4990fb8c668b0d29c" | 31 | SRC_URI[sha256sum] = "cb754255ab0ee2ea5f66f8850e1bd6ad5cac1cd855d0a2f4990fb8c668b0d29c" |