From 8ad8857f149c5ac46ae7914a8539980e397a7293 Mon Sep 17 00:00:00 2001 From: Archana Polampalli Date: Fri, 7 Feb 2025 15:41:11 +0000 Subject: ffmpeg: fix CVE-2024-36619 FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition. (From OE-Core rev: 161711ba2ef14fa77fba4740b1933c68043c57c7) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman --- .../ffmpeg/ffmpeg/CVE-2024-36619.patch | 36 ++++++++++++++++++++++ meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-36619.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-36619.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-36619.patch new file mode 100644 index 0000000000..63d08eabcc --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-36619.patch @@ -0,0 +1,36 @@ +From 28c7094b25b689185155a6833caf2747b94774a4 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Thu, 4 Apr 2024 00:15:27 +0200 +Subject: [PATCH] avcodec/wavarc: fix signed integer overflow in block type + 6/19 + +Fixes: signed integer overflow: -2088796289 + -91276551 cannot be represented in type 'int' +Fixes: 67772/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_WAVARC_fuzzer-6533568953122816 + +Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg +Signed-off-by: Michael Niedermayer + +CVE: CVE-2024-36619 + +Upstream-Status: Backport [https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4] + +Signed-off-by: Archana Polampalli +--- + libavcodec/wavarc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libavcodec/wavarc.c b/libavcodec/wavarc.c +index 09ed4d4..51d91a4 100644 +--- a/libavcodec/wavarc.c ++++ b/libavcodec/wavarc.c +@@ -648,7 +648,7 @@ static int decode_5elp(AVCodecContext *avctx, + for (int o = 0; o < order; o++) + sum += s->filter[ch][o] * (unsigned)samples[n + 70 - o - 1]; + +- samples[n + 70] += ac_out[n] + (sum >> 4); ++ samples[n + 70] += ac_out[n] + (unsigned)(sum >> 4); + } + + for (int n = 0; n < 70; n++) +-- +2.40.0 diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb index 37416ef01a..dff78ccc53 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb @@ -45,6 +45,7 @@ SRC_URI = " \ file://CVE-2024-36616.patch \ file://CVE-2024-36617.patch \ file://CVE-2024-36618.patch \ + file://CVE-2024-36619.patch \ " SRC_URI[sha256sum] = "8684f4b00f94b85461884c3719382f1261f0d9eb3d59640a1f4ac0873616f968" -- cgit v1.2.3-54-g00ecf