summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-49501.patch30
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-49502.patch107
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-50007.patch78
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-50008.patch29
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-31578.patch49
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-31582.patch34
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35367.patch47
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35368.patch41
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-0518.patch34
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-22919.patch39
-rw-r--r--meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.3.bb (renamed from meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.2.bb)12
11 files changed, 1 insertions, 499 deletions
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-49501.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-49501.patch
deleted file mode 100644
index 80d542952a..0000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-49501.patch
+++ /dev/null
@@ -1,30 +0,0 @@
1From 4adb93dff05dd947878c67784d98c9a4e13b57a7 Mon Sep 17 00:00:00 2001
2From: Paul B Mahol <onemda@gmail.com>
3Date: Thu, 23 Nov 2023 14:58:35 +0100
4Subject: [PATCH] avfilter/asrc_afirsrc: fix by one smaller allocation of
5 buffer
6
7CVE: CVE-2023-49501
8
9Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/4adb93dff05dd947878c67784d98c9a4e13b57a7]
10
11Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
12---
13 libavfilter/asrc_afirsrc.c | 2 +-
14 1 file changed, 1 insertion(+), 1 deletion(-)
15
16diff --git a/libavfilter/asrc_afirsrc.c b/libavfilter/asrc_afirsrc.c
17index e2359c1..ea04c35 100644
18--- a/libavfilter/asrc_afirsrc.c
19+++ b/libavfilter/asrc_afirsrc.c
20@@ -480,7 +480,7 @@ static av_cold int config_eq_output(AVFilterLink *outlink)
21 if (ret < 0)
22 return ret;
23
24- s->magnitude = av_calloc(s->nb_magnitude, sizeof(*s->magnitude));
25+ s->magnitude = av_calloc(s->nb_magnitude + 1, sizeof(*s->magnitude));
26 if (!s->magnitude)
27 return AVERROR(ENOMEM);
28 memcpy(s->magnitude, eq_presets[s->preset].gains, sizeof(*s->magnitude) * s->nb_magnitude);
29--
302.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-49502.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-49502.patch
deleted file mode 100644
index bc78a46d03..0000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-49502.patch
+++ /dev/null
@@ -1,107 +0,0 @@
1From 737ede405b11a37fdd61d19cf25df296a0cb0b75 Mon Sep 17 00:00:00 2001
2From: Cosmin Stejerean <cosmin@cosmin.at>
3Date: Wed, 6 Dec 2023 18:39:32 +0800
4Subject: [PATCH] avfilter/bwdif: account for chroma sub-sampling in min size
5 calculation
6
7The current logic for detecting frames that are too small for the
8algorithm does not account for chroma sub-sampling, and so a sample
9where the luma plane is large enough, but the chroma planes are not
10will not be rejected. In that event, a heap overflow will occur.
11
12This change adjusts the logic to consider the chroma planes and makes
13the change to all three bwdif implementations.
14
15Fixes #10688
16
17Signed-off-by: Cosmin Stejerean <cosmin@cosmin.at>
18Reviewed-by: Thomas Mundt <tmundt75@gmail.com>
19Signed-off-by: Philip Langdale <philipl@overt.org>
20
21CVE: CVE-2023-49502
22
23Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/737ede405b11a37f]
24
25Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
26---
27 libavfilter/vf_bwdif.c | 9 +++++----
28 libavfilter/vf_bwdif_cuda.c | 11 ++++++-----
29 libavfilter/vf_bwdif_vulkan.c | 11 +++++------
30 3 files changed, 16 insertions(+), 15 deletions(-)
31
32diff --git a/libavfilter/vf_bwdif.c b/libavfilter/vf_bwdif.c
33index 137cd5e..353cd0b 100644
34--- a/libavfilter/vf_bwdif.c
35+++ b/libavfilter/vf_bwdif.c
36@@ -191,13 +191,14 @@ static int config_props(AVFilterLink *link)
37 return ret;
38 }
39
40- if (link->w < 3 || link->h < 4) {
41- av_log(ctx, AV_LOG_ERROR, "Video of less than 3 columns or 4 lines is not supported\n");
42+ yadif->csp = av_pix_fmt_desc_get(link->format);
43+ yadif->filter = filter;
44+
45+ if (AV_CEIL_RSHIFT(link->w, yadif->csp->log2_chroma_w) < 3 || AV_CEIL_RSHIFT(link->h, yadif->csp->log2_chroma_h) < 4) {
46+ av_log(ctx, AV_LOG_ERROR, "Video with planes less than 3 columns or 4 lines is not supported\n");
47 return AVERROR(EINVAL);
48 }
49
50- yadif->csp = av_pix_fmt_desc_get(link->format);
51- yadif->filter = filter;
52 ff_bwdif_init_filter_line(&s->dsp, yadif->csp->comp[0].depth);
53
54 return 0;
55diff --git a/libavfilter/vf_bwdif_cuda.c b/libavfilter/vf_bwdif_cuda.c
56index a5ecfba..418f15f 100644
57--- a/libavfilter/vf_bwdif_cuda.c
58+++ b/libavfilter/vf_bwdif_cuda.c
59@@ -296,15 +296,16 @@ static int config_output(AVFilterLink *link)
60 link->frame_rate = av_mul_q(ctx->inputs[0]->frame_rate,
61 (AVRational){2, 1});
62
63- if (link->w < 3 || link->h < 3) {
64- av_log(ctx, AV_LOG_ERROR, "Video of less than 3 columns or lines is not supported\n");
65- ret = AVERROR(EINVAL);
66- goto exit;
67- }
68
69 y->csp = av_pix_fmt_desc_get(output_frames->sw_format);
70 y->filter = filter;
71
72+ if (AV_CEIL_RSHIFT(link->w, y->csp->log2_chroma_w) < 3 || AV_CEIL_RSHIFT(link->h, y->csp->log2_chroma_h) < 3) {
73+ av_log(ctx, AV_LOG_ERROR, "Video with planes less than 3 columns or lines is not supported\n");
74+ ret = AVERROR(EINVAL);
75+ goto exit;
76+ }
77+
78 ret = CHECK_CU(cu->cuCtxPushCurrent(s->hwctx->cuda_ctx));
79 if (ret < 0)
80 goto exit;
81diff --git a/libavfilter/vf_bwdif_vulkan.c b/libavfilter/vf_bwdif_vulkan.c
82index 690a89c..c51df9a 100644
83--- a/libavfilter/vf_bwdif_vulkan.c
84+++ b/libavfilter/vf_bwdif_vulkan.c
85@@ -362,15 +362,14 @@ static int bwdif_vulkan_config_output(AVFilterLink *outlink)
86 outlink->frame_rate = av_mul_q(avctx->inputs[0]->frame_rate,
87 (AVRational){2, 1});
88
89- if (outlink->w < 4 || outlink->h < 4) {
90- av_log(avctx, AV_LOG_ERROR, "Video of less than 4 columns or lines is not "
91- "supported\n");
92- return AVERROR(EINVAL);
93- }
94-
95 y->csp = av_pix_fmt_desc_get(vkctx->frames->sw_format);
96 y->filter = bwdif_vulkan_filter_frame;
97
98+ if (AV_CEIL_RSHIFT(outlink->w, y->csp->log2_chroma_w) < 4 || AV_CEIL_RSHIFT(outlink->h, y->csp->log2_chroma_h) < 4) {
99+ av_log(avctx, AV_LOG_ERROR, "Video with planes less than 4 columns or lines is not supported\n");
100+ return AVERROR(EINVAL);
101+ }
102+
103 return init_filter(avctx);
104 }
105
106--
1072.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-50007.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-50007.patch
deleted file mode 100644
index d86e39707e..0000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-50007.patch
+++ /dev/null
@@ -1,78 +0,0 @@
1From b1942734c7cbcdc9034034373abcc9ecb9644c47 Mon Sep 17 00:00:00 2001
2From: Paul B Mahol <onemda@gmail.com>
3Date: Mon, 27 Nov 2023 11:45:34 +0100
4Subject: [PATCH 2/3] avfilter/af_afwtdn: fix crash with EOF handling
5
6CVE: CVE-2023-50007
7
8Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47]
9
10Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
11---
12 libavfilter/af_afwtdn.c | 34 +++++++++++++++++++---------------
13 1 file changed, 19 insertions(+), 15 deletions(-)
14
15diff --git a/libavfilter/af_afwtdn.c b/libavfilter/af_afwtdn.c
16index 0fcfa77..63b7f5f 100644
17--- a/libavfilter/af_afwtdn.c
18+++ b/libavfilter/af_afwtdn.c
19@@ -408,6 +408,7 @@ typedef struct AudioFWTDNContext {
20
21 uint64_t sn;
22 int64_t eof_pts;
23+ int eof;
24
25 int wavelet_type;
26 int channels;
27@@ -1069,7 +1070,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
28 s->drop_samples = 0;
29 } else {
30 if (s->padd_samples < 0 && eof) {
31- out->nb_samples += s->padd_samples;
32+ out->nb_samples = FFMAX(0, out->nb_samples + s->padd_samples);
33 s->padd_samples = 0;
34 }
35 if (!eof)
36@@ -1208,23 +1209,26 @@ static int activate(AVFilterContext *ctx)
37
38 FF_FILTER_FORWARD_STATUS_BACK(outlink, inlink);
39
40- ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in);
41- if (ret < 0)
42- return ret;
43- if (ret > 0)
44- return filter_frame(inlink, in);
45+ if (!s->eof) {
46+ ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in);
47+ if (ret < 0)
48+ return ret;
49+ if (ret > 0)
50+ return filter_frame(inlink, in);
51+ }
52
53 if (ff_inlink_acknowledge_status(inlink, &status, &pts)) {
54- if (status == AVERROR_EOF) {
55- while (s->padd_samples != 0) {
56- ret = filter_frame(inlink, NULL);
57- if (ret < 0)
58- return ret;
59- }
60- ff_outlink_set_status(outlink, status, pts);
61- return ret;
62- }
63+ if (status == AVERROR_EOF)
64+ s->eof = 1;
65 }
66+
67+ if (s->eof && s->padd_samples != 0) {
68+ return filter_frame(inlink, NULL);
69+ } else if (s->eof) {
70+ ff_outlink_set_status(outlink, AVERROR_EOF, s->eof_pts);
71+ return 0;
72+ }
73+
74 FF_FILTER_FORWARD_WANTED(outlink, inlink);
75
76 return FFERROR_NOT_READY;
77--
782.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-50008.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-50008.patch
deleted file mode 100644
index 4b8935628f..0000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2023-50008.patch
+++ /dev/null
@@ -1,29 +0,0 @@
1From 5f87a68cf70dafeab2fb89b42e41a4c29053b89b Mon Sep 17 00:00:00 2001
2From: Paul B Mahol <onemda@gmail.com>
3Date: Mon, 27 Nov 2023 12:08:20 +0100
4Subject: [PATCH] avfilter/vf_colorcorrect: fix memory leaks
5
6CVE: CVE-2023-50008
7
8Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b]
9
10Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
11---
12 libavfilter/vf_colorcorrect.c | 2 ++
13 1 file changed, 2 insertions(+)
14
15diff --git a/libavfilter/vf_colorcorrect.c b/libavfilter/vf_colorcorrect.c
16index 1c4dea5..6bdec2c 100644
17--- a/libavfilter/vf_colorcorrect.c
18+++ b/libavfilter/vf_colorcorrect.c
19@@ -497,6 +497,8 @@ static av_cold void uninit(AVFilterContext *ctx)
20 ColorCorrectContext *s = ctx->priv;
21
22 av_freep(&s->analyzeret);
23+ av_freep(&s->uhistogram);
24+ av_freep(&s->vhistogram);
25 }
26
27 static const AVFilterPad colorcorrect_inputs[] = {
28--
292.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-31578.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-31578.patch
deleted file mode 100644
index f8e7e1283b..0000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-31578.patch
+++ /dev/null
@@ -1,49 +0,0 @@
1From edeeb35cecb5bc0d433b14dd0e544ae826b7ece5 Mon Sep 17 00:00:00 2001
2From: Zhao Zhili <zhilizhao@tencent.com>
3Date: Tue, 20 Feb 2024 20:08:55 +0800
4Subject: [PATCH] avutil/hwcontext: Don't assume frames_uninit is reentrant
5
6Fix heap use after free when vulkan_frames_init failed.
7
8Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
9
10CVE: CVE-2024-31578
11
12Upstream-Status: Backport [https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83]
13
14Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
15---
16 libavutil/hwcontext.c | 8 ++------
17 1 file changed, 2 insertions(+), 6 deletions(-)
18
19diff --git a/libavutil/hwcontext.c b/libavutil/hwcontext.c
20index 3650d46..0ef3479 100644
21--- a/libavutil/hwcontext.c
22+++ b/libavutil/hwcontext.c
23@@ -363,7 +363,7 @@ int av_hwframe_ctx_init(AVBufferRef *ref)
24 if (ctx->internal->hw_type->frames_init) {
25 ret = ctx->internal->hw_type->frames_init(ctx);
26 if (ret < 0)
27- goto fail;
28+ return ret;
29 }
30
31 if (ctx->internal->pool_internal && !ctx->pool)
32@@ -373,14 +373,10 @@ int av_hwframe_ctx_init(AVBufferRef *ref)
33 if (ctx->initial_pool_size > 0) {
34 ret = hwframe_pool_prealloc(ref);
35 if (ret < 0)
36- goto fail;
37+ return ret;
38 }
39
40 return 0;
41-fail:
42- if (ctx->internal->hw_type->frames_uninit)
43- ctx->internal->hw_type->frames_uninit(ctx);
44- return ret;
45 }
46
47 int av_hwframe_transfer_get_formats(AVBufferRef *hwframe_ref,
48--
492.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-31582.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-31582.patch
deleted file mode 100644
index 2ade3ab6b1..0000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-31582.patch
+++ /dev/null
@@ -1,34 +0,0 @@
1From 1d1a05b393ece9fa3df825bfef3724b7370aefdc Mon Sep 17 00:00:00 2001
2From: Zhao Zhili <zhilizhao@tencent.com>
3Date: Fri, 29 Dec 2023 05:56:43 +0800
4Subject: [PATCH] avfilter/vf_codecview: fix heap buffer overflow
5
6And improve the performance by a little bit.
7
8Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
9
10CVE: CVE-2024-31582
11
12Upstream-Status: Backport [https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2]
13
14Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
15---
16 libavfilter/vf_codecview.c | 3 ---
17 1 file changed, 3 deletions(-)
18
19diff --git a/libavfilter/vf_codecview.c b/libavfilter/vf_codecview.c
20index 55d9c8c..f65ccbd 100644
21--- a/libavfilter/vf_codecview.c
22+++ b/libavfilter/vf_codecview.c
23@@ -216,9 +216,6 @@ static void draw_block_rectangle(uint8_t *buf, int sx, int sy, int w, int h, ptr
24 buf[sx + w - 1] = color;
25 buf += stride;
26 }
27-
28- for (int x = sx; x < sx + w; x++)
29- buf[x] = color;
30 }
31
32 static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
33--
342.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35367.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35367.patch
deleted file mode 100644
index a1bec43c66..0000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35367.patch
+++ /dev/null
@@ -1,47 +0,0 @@
1From 09e6840cf7a3ee07a73c3ae88a020bf27ca1a667 Mon Sep 17 00:00:00 2001
2From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
3Date: Wed, 13 Mar 2024 02:10:26 +0100
4Subject: [PATCH] avcodec/ppc/vp8dsp_altivec: Fix out-of-bounds access
5
6h_subpel_filters_inner[i] and h_subpel_filters_outer[i / 2]
7belong together and the former allows the range 0..6,
8so the latter needs to support 0..3. But it has only three
9elements. Add another one.
10The value for the last element has been guesstimated
11from subpel_filters in libavcodec/vp8dsp.c.
12
13This is also intended to fix FATE-failures with UBSan here:
14https://fate.ffmpeg.org/report.cgi?time=20240312011016&slot=ppc-linux-gcc-13.2-ubsan-altivec-qemu
15
16Tested-by: Sean McGovern <gseanmcg@gmail.com>
17Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
18
19CVE: CVE-2024-35367
20
21Upstream-Status: Backport [https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667]
22
23Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
24---
25 libavcodec/ppc/vp8dsp_altivec.c | 3 ++-
26 1 file changed, 2 insertions(+), 1 deletion(-)
27
28diff --git a/libavcodec/ppc/vp8dsp_altivec.c b/libavcodec/ppc/vp8dsp_altivec.c
29index 12dac8b..061914f 100644
30--- a/libavcodec/ppc/vp8dsp_altivec.c
31+++ b/libavcodec/ppc/vp8dsp_altivec.c
32@@ -50,11 +50,12 @@ static const vec_s8 h_subpel_filters_inner[7] =
33 // for 6tap filters, these are the outer two taps
34 // The zeros mask off pixels 4-7 when filtering 0-3
35 // and vice-versa
36-static const vec_s8 h_subpel_filters_outer[3] =
37+static const vec_s8 h_subpel_filters_outer[4] =
38 {
39 REPT4(0, 0, 2, 1),
40 REPT4(0, 0, 3, 3),
41 REPT4(0, 0, 1, 2),
42+ REPT4(0, 0, 0, 0),
43 };
44
45 #define LOAD_H_SUBPEL_FILTER(i) \
46--
472.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35368.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35368.patch
deleted file mode 100644
index 7b802762eb..0000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35368.patch
+++ /dev/null
@@ -1,41 +0,0 @@
1From 4513300989502090c4fd6560544dce399a8cd53c Mon Sep 17 00:00:00 2001
2From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
3Date: Sun, 24 Sep 2023 13:15:48 +0200
4Subject: [PATCH] avcodec/rkmppdec: Fix double-free on error
5
6After having created the AVBuffer that is put into frame->buf[0],
7ownership of several objects (namely an AVDRMFrameDescriptor,
8an MppFrame and some AVBufferRefs framecontextref and decoder_ref)
9has passed to the AVBuffer and therefore to the frame.
10Yet it has nevertheless been freed manually on error
11afterwards, which would lead to a double-free as soon
12as the AVFrame is unreferenced.
13
14Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
15
16CVE: CVE-2024-35368
17
18Upstream-Status: Backport [https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c]
19
20Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
21---
22 libavcodec/rkmppdec.c | 4 ++--
23 1 file changed, 2 insertions(+), 2 deletions(-)
24
25diff --git a/libavcodec/rkmppdec.c b/libavcodec/rkmppdec.c
26index 5768568..2ca368e 100644
27--- a/libavcodec/rkmppdec.c
28+++ b/libavcodec/rkmppdec.c
29@@ -462,8 +462,8 @@ static int rkmpp_retrieve_frame(AVCodecContext *avctx, AVFrame *frame)
30
31 frame->hw_frames_ctx = av_buffer_ref(decoder->frames_ref);
32 if (!frame->hw_frames_ctx) {
33- ret = AVERROR(ENOMEM);
34- goto fail;
35+ av_frame_unref(frame);
36+ return AVERROR(ENOMEM);
37 }
38
39 return 0;
40--
412.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-0518.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-0518.patch
deleted file mode 100644
index d3e02bebe6..0000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-0518.patch
+++ /dev/null
@@ -1,34 +0,0 @@
1From b5b6391d64807578ab872dc58fb8aa621dcfc38a Mon Sep 17 00:00:00 2001
2From: Michael Niedermayer <michael@niedermayer.cc>
3Date: Mon, 6 Jan 2025 22:01:39 +0100
4Subject: [PATCH] avfilter/af_pan: Fix sscanf() use
5
6Fixes: Memory Data Leak
7
8Found-by: Simcha Kosman <simcha.kosman@cyberark.com>
9Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
10
11CVE: CVE-2025-0518
12
13Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a]
14
15Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
16---
17 libavfilter/af_pan.c | 2 +-
18 1 file changed, 1 insertion(+), 1 deletion(-)
19
20diff --git a/libavfilter/af_pan.c b/libavfilter/af_pan.c
21index cfed9f1..ffcd214 100644
22--- a/libavfilter/af_pan.c
23+++ b/libavfilter/af_pan.c
24@@ -165,7 +165,7 @@ static av_cold int init(AVFilterContext *ctx)
25 sign = 1;
26 while (1) {
27 gain = 1;
28- if (sscanf(arg, "%lf%n *%n", &gain, &len, &len))
29+ if (sscanf(arg, "%lf%n *%n", &gain, &len, &len) >= 1)
30 arg += len;
31 if (parse_channel_name(&arg, &in_ch_id, &named)){
32 av_log(ctx, AV_LOG_ERROR,
33--
342.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-22919.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-22919.patch
deleted file mode 100644
index f895576de3..0000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-22919.patch
+++ /dev/null
@@ -1,39 +0,0 @@
1From 1446e37d3d032e1452844778b3e6ba2c20f0c322 Mon Sep 17 00:00:00 2001
2From: James Almer <jamrial@gmail.com>
3Date: Mon, 30 Dec 2024 00:25:41 -0300
4Subject: [PATCH] avfilter/buffersrc: check for valid sample rate
5
6A sample rate <= 0 is invalid.
7
8Fixes an assert in ffmpeg_enc.c that assumed a valid sample rate would be set.
9Fixes ticket #11385.
10
11Signed-off-by: James Almer <jamrial@gmail.com>
12
13CVE: CVE-2025-22919
14
15Upstream-Status: Backport [https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1446e37d3d032e1452844778b3e6ba2c20f0c322]
16
17Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
18---
19 libavfilter/buffersrc.c | 5 +++++
20 1 file changed, 5 insertions(+)
21
22diff --git a/libavfilter/buffersrc.c b/libavfilter/buffersrc.c
23index 453fc0f..f49aa91 100644
24--- a/libavfilter/buffersrc.c
25+++ b/libavfilter/buffersrc.c
26@@ -401,6 +401,11 @@ FF_ENABLE_DEPRECATION_WARNINGS
27 av_channel_layout_describe(&s->ch_layout, buf, sizeof(buf));
28 }
29
30+ if (s->sample_rate <= 0) {
31+ av_log(ctx, AV_LOG_ERROR, "Sample rate not set\n");
32+ return AVERROR(EINVAL);
33+ }
34+
35 if (!s->time_base.num)
36 s->time_base = (AVRational){1, s->sample_rate};
37
38--
392.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.2.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.3.bb
index a789980dde..c0112757f0 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.2.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.3.bb
@@ -27,26 +27,16 @@ SRC_URI = " \
27 file://av1_ordering_info.patch \ 27 file://av1_ordering_info.patch \
28 file://vulkan_av1_stable_API.patch \ 28 file://vulkan_av1_stable_API.patch \
29 file://vulkan_fix_gcc14.patch \ 29 file://vulkan_fix_gcc14.patch \
30 file://CVE-2023-49502.patch \
31 file://CVE-2024-31578.patch \
32 file://CVE-2024-31582.patch \
33 file://CVE-2023-50008.patch \
34 file://CVE-2023-49501.patch \
35 file://CVE-2024-28661.patch \ 30 file://CVE-2024-28661.patch \
36 file://CVE-2023-50007.patch \
37 file://CVE-2023-49528.patch \ 31 file://CVE-2023-49528.patch \
38 file://CVE-2024-35367.patch \
39 file://CVE-2024-35368.patch \
40 file://CVE-2024-35365.patch \ 32 file://CVE-2024-35365.patch \
41 file://CVE-2024-36618.patch \ 33 file://CVE-2024-36618.patch \
42 file://CVE-2024-35369.patch \ 34 file://CVE-2024-35369.patch \
43 file://CVE-2025-25473.patch \ 35 file://CVE-2025-25473.patch \
44 file://CVE-2025-22919.patch \
45 file://CVE-2025-22921.patch \ 36 file://CVE-2025-22921.patch \
46 file://CVE-2025-0518.patch \
47" 37"
48 38
49SRC_URI[sha256sum] = "3b624649725ecdc565c903ca6643d41f33bd49239922e45c9b1442c63dca4e38" 39SRC_URI[sha256sum] = "bc5f1e4a4d283a6492354684ee1124129c52293bcfc6a9169193539fbece3487"
50 40
51# https://nvd.nist.gov/vuln/detail/CVE-2023-39018 41# https://nvd.nist.gov/vuln/detail/CVE-2023-39018
52# https://github.com/bramp/ffmpeg-cli-wrapper/issues/291 42# https://github.com/bramp/ffmpeg-cli-wrapper/issues/291
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-10-04 22:17:26 +0000