summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/ffmpeg
Commit message (Collapse)AuthorAgeFilesLines
* ffmpeg: set status for CVE-2025-12343Peter Marko2026-03-161-1/+1
| | | | | | | | | | | | | | | | Per [1] is patch for this CVE [2]. This is equivalent of [3] which is included in n6.1.3. [1] https://security-tracker.debian.org/tracker/CVE-2025-12343 [2] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/b8d5f65b9e89d893f27cf00799dbc15fc0ca2f8e [3] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/6250ed77a6fb5bb089e533e30985d197e8323dcf (From OE-Core rev: b839647eb0627598a9e1667d18802b6b03637abf) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: set status for CVE-2025-10256Peter Marko2026-03-161-1/+1
| | | | | | | | | | | | | | | | Per [1] is patch for this CVE [2]. This is equivalent of [3] which is included in n6.1.3. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-10256 [2] https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931 [3] https://github.com/FFmpeg/FFmpeg/commit/00b5af29a4203a31574c11b3df892d78d5d862ec (From OE-Core rev: 8a24195c27d440fa851da555f1147230564674b0) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: set status of CVE-2025-25468Peter Marko2026-02-271-0/+1
| | | | | | | | | | | | | | | | | This vulnerability was introduced in v8.0. This can be seen by blaming fix [1] (linked from NVD report [3]) is showing that the return without freeing memory was introduced in [2]. [1] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/d5873be583ada9e1fb887e2fe8dcfd4b12e0efcd [2] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/d38fc25519cf12a9212dadcba1258fc176ffbade [3] https://nvd.nist.gov/vuln/detail/CVE-2025-25468 (From OE-Core rev: 2915986318230846e1b513b4cf3d9ba62a5b8cb9) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: ignore CVE-2025-1594Peter Marko2026-02-271-1/+1
| | | | | | | | | | | | | | | | This CVE was patched via c9a15206bae7f1e85dc3b8812eabb936a7e6d383 Patch was dropped during update to 6.1.4, however NVD DB does not have this information so it re-appeared in CVE reports. Set its status accordingly. (From OE-Core rev: 26e32dccade107101992dd81f387696c993d47aa) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: ignore CVE-2025-25469Ankur Tyagi2026-02-161-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Details https://nvd.nist.gov/vuln/detail/CVE-2025-25469 This vulnerability exists in IAMF (Immersive Audio Model and Formats demuxer) which was introduced in version 7.0 [1] $ git tag --contains 4ee05182b7cccfa6928dcb0a45c2b50b7d9ea39b n7.0 n7.0.1 n7.0.2 n7.0.3 n7.1 n7.1-dev n7.1.1 n7.1.2 n7.1.3 n7.2-dev n8.0 n8.0.1 n8.1-dev [1] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/4ee05182b7cccfa6928dcb0a45c2b50b7d9ea39b (From OE-Core rev: 935bd46fab333a29a8bf4bb511fb55d5d02b3a71) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: upgrade 6.1.3 -> 6.1.4Ankur Tyagi2026-02-164-207/+1
| | | | | | | | | | | | | | Dropped patches that are part of the upstream version. Changelog: https://git.ffmpeg.org/gitweb/ffmpeg.git/blob/34277e12e80031c7f89494ba543684bc1dd0be8f:/Changelog (From OE-Core rev: f9f054faca45a08507b510c8982f170edd6bf83a) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: ignore 8 CVEs fixed in 6.1.1 and 6.1.3 releasesPeter Marko2025-10-131-0/+4
| | | | | | | | | | | | | | | Following are mentioned in commit upgrading the recipe to 6.1.3: * CVE-2023-49502 CVE-2023-50007 CVE-2023-50008 CVE-2024-31578 CVE-2024-31582 Following are fixed via mentioned commits already in 6.1.1: * CVE-2023-50009: https://github.com/FFmpeg/FFmpeg/commit/162b4c60c8f72be2e93b759f3b1e14652b70b3ba * CVE-2023-50010: https://github.com/FFmpeg/FFmpeg/commit/e809c23786fe297797198a7b9f5d3392d581daf1 * CVE-2024-31585: https://github.com/FFmpeg/FFmpeg/commit/3061bf668feffc7c1f0b244205167b3b86da8015 (From OE-Core rev: 8286570b3baf275ff48c45ca0864348a8d3faa01) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-1594Archana Polampalli2025-09-012-0/+106
| | | | | | | | | | | | | A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. (From OE-Core rev: c9a15206bae7f1e85dc3b8812eabb936a7e6d383) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: upgrade 6.1.2 -> 6.1.3Archana Polampalli2025-09-0111-499/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: CVE-2023-6604 CVE-2023-6602 CVE-2025-7700 Changelog: https://github.com/FFmpeg/FFmpeg/blob/n6.1.3/Changelog Removed the CVE patches which are already fixed with this upgrade ref: https://github.com/FFmpeg/FFmpeg/commit/c104119c6b5e00496c5ff14071c85f95c98b7ae5 https://github.com/FFmpeg/FFmpeg/commit/7d79d0a43b5533ff584249332bc1db7fedbab1d2 https://github.com/FFmpeg/FFmpeg/commit/a4b6e37ad5f50454974fa22cc8f19d83cdaff0eb https://github.com/FFmpeg/FFmpeg/commit/efedc1d1b6aef2481cf613a11992b1dce6320055 https://github.com/FFmpeg/FFmpeg/commit/dcf34f13f516aa0e214384f3185aff306feba01d https://github.com/FFmpeg/FFmpeg/commit/bed04417b4d38af7a1b477b24ea6e26547e32373 https://github.com/FFmpeg/FFmpeg/commit/b43a12363c1fef0efa7eac15b6b830417656db15 https://github.com/FFmpeg/FFmpeg/commit/e2b20632b8c71a4e174511f8ff6e8342e0c63bd3 https://github.com/FFmpeg/FFmpeg/commit/43f64690ad9df72976bcbd6ea9e41b2542db2464 (From OE-Core rev: 901304a22413030b9744006ae18b587146b71953) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-1373Colin Pinnell McAllister2025-06-201-0/+4
| | | | | | | | | | CVE-2025-1373 does not appear to affect ffmpeg 5.0.3. The CVE has been marked as "fixed-version". (From OE-Core rev: 0ffe159d9a4ee434b4c995e1ca9a85b01e0a5d05) Signed-off-by: Colin Pinnell McAllister <colin.mcallister@garmin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: upgrade 6.1.1 -> 6.1.2Divyanshu Rathore2025-06-029-281/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ffmpeg_6.1.2 is the newest available stable release for 6.1. It introduces quite a few bug and CVE fixes, which should help all. CVEs that are fixed in the upgrade: CVE-2024-32230 CVE-2024-35366 CVE-2024-36613 CVE-2024-36616 CVE-2024-36617 CVE-2024-36619 CVE-2024-7055 During upgrade it was noticed that the CVE scan doesn't pick up the CVEs as unpatched (CVE-2025-0518, CVE-2025-22919, CVE-2025-22921, CVE-2025-25473, CVE-2024-36618, CVE-2024-35369, CVE-2024-35368, CVE-2024-35367, CVE-2024-35365, CVE-2024-28661, CVE-2023-50007, CVE-2023-49528, CVE-2023-49501), due to improper versioning in NVD, they are affecting 6.1.2 and hence we are leaving the patches in. check the changelog mention below for information about fixes. changelog: https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n6.1.2 This upgrade fixes CVE's hence remove those patches. Refresh vulkan_av1_stable_API.patch as per new codebase. (From OE-Core rev: 57e25585abf34677451c68d581374245e5b4b418) Signed-off-by: Divyanshu Rathore <divyanshurathore2022@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: Correct the CVE ID to fix CVE-2025-22919Archana Polampalli2025-03-082-2/+2
| | | | | | | | | | A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file. (From OE-Core rev: bf0ad79c46d8a01aafc91620ddf415749aa8849a) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-0518Archana Polampalli2025-03-082-0/+35
| | | | | | | | | | | | | | | Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C This issue affects FFmpeg: 7.1. Issue was fixed: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosma (From OE-Core rev: 75ad6e004de95ff6208820ccf2c0af01d9363749) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-22921Archana Polampalli2025-03-082-0/+35
| | | | | | | | | | FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c. (From OE-Core rev: bc9cdf3701b937d40964903a3489898a69525d17) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-25471Archana Polampalli2025-03-082-0/+40
| | | | | | | | | | FFmpeg git master before commit fd1772 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c. (From OE-Core rev: a8331b11d5d7aa8f1997eaa189b74aaab7cc44da) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-25473Archana Polampalli2025-03-082-0/+37
| | | | | | | | | | FFmpeg git master before commit c08d30 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c. (From OE-Core rev: abc6b3180b87c665ff04204b7163d1f074d99747) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-35369Archana Polampalli2025-02-142-0/+38
| | | | | | | | | | | | | In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process. (From OE-Core rev: c46bb37a76582ee7352f2bc027920e8ba76e5c15) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-36619Archana Polampalli2025-02-142-0/+37
| | | | | | | | | | | FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition. (From OE-Core rev: 161711ba2ef14fa77fba4740b1933c68043c57c7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-36618Archana Polampalli2025-02-142-0/+37
| | | | | | | | | | | FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition. (From OE-Core rev: 21230d5dfe908533958712e06316a253e16b9d2e) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-36617Archana Polampalli2025-02-142-0/+37
| | | | | | | | | FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder. (From OE-Core rev: 8057ba630477a7aeedf057b7e1ce25ab0c445665) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-36616Archana Polampalli2025-02-142-0/+36
| | | | | | | | | | An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file. (From OE-Core rev: fe7df1727d8ea4868091236ddfff7ea862c1ada8) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-36613Archana Polampalli2025-02-142-0/+38
| | | | | | | | | | | FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior. (From OE-Core rev: 5661bac10db7e20064c10660c47c361b7d2418ee) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-35365Archana Polampalli2025-02-142-0/+63
| | | | | | | | | | FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function. (From OE-Core rev: 051bc7afc01e72d5ef0fc14683689ab45e4eaab8) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-35368Archana Polampalli2024-12-232-0/+42
| | | | | | | | | | FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c. (From OE-Core rev: 53528caafa576a2f6417436cc0dba8be06e75048) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-35367Archana Polampalli2024-12-232-0/+48
| | | | | | | | | | FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer (From OE-Core rev: 64d77d422d3c99d8a246ab03edfb54d9d185326e) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-35366Archana Polampalli2024-12-232-0/+36
| | | | | | | | | | | | FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking. (From OE-Core rev: a07bc254011736c0f0445607c56609be677ea8a7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-7055Archana Polampalli2024-12-132-0/+39
| | | | | | | | | | | | | | A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651. (From OE-Core rev: 71a9c2d01ad8ed83f9da6e6b9541fcf1d9baed48) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2023-49528Archana Polampalli2024-12-132-0/+59
| | | | | | | | | | | Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component. (From OE-Core rev: a5e0e1f8be3c6611c09158c80e26848ae3d4f4e7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2023-50007Archana Polampalli2024-12-132-0/+79
| | | | | | | | | | | Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via theav_samples_set_silence function in the libavutil/samplefmt.c:260:9 component. (From OE-Core rev: b63ba0bff9e5b5e73d50b2b3ff805418fa98d7e5) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-28661Archana Polampalli2024-12-132-0/+38
| | | | | | | | | | | | | Some of the changes are already present in recipe version Ref: https://github.com/FFmpeg/FFmpeg/commit/148ada5577262c6c18ae97604df8fe1c18b096e2 https://ffmpeg.org/security.html (From OE-Core rev: 4ca1544e95e327c7060efa845aa69c2a1eb1d782) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2023-49501Archana Polampalli2024-12-132-0/+31
| | | | | | | | | | | Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component. (From OE-Core rev: 873025145d42ffe75d421884160ec299d85d21ef) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: Add "libswresample libavcodec" to CVE_PRODUCTaszh072024-10-301-0/+2
| | | | | | | | | | | | | | | | Currently, CVE_PRODUCT only detects vulnerabilities where the product is "ffmpeg". However, there are also vulnerabilities where the product is "libswresample", and "libavcodec" as shown below. https://app.opencve.io/vendors/?vendor=ffmpeg Therefore, add "libswresample libavcodec" to CVE_PRODUCT to detect vulnerabilities where the product is "libswresample libavcodec" as well. (From OE-Core rev: cebbbf76c029c5bf5563aca515b1c025c3644bf8) Signed-off-by: aszh07 <mail2szahir@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-32230Archana Polampalli2024-09-032-0/+37
| | | | | | | | | | FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0 (From OE-Core rev: b78fd9322b80734ec54440a01a36323a9b1b83f1) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2023-50008Archana Polampalli2024-08-192-0/+30
| | | | | | | | | | Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the av_malloc function in libavutil/mem.c:105:9 component. (From OE-Core rev: e7aea9b5f66414afb6fefd9aad6123c42af94b4c) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-31582Archana Polampalli2024-08-102-0/+35
| | | | | | | (From OE-Core rev: 617a9cdba6e2f0bd3ccc24e7bb2fe84e9573fecd) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-31578Archana Polampalli2024-08-012-0/+50
| | | | | | | | | FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function. (From OE-Core rev: bd9fe64c40f7f4e1d18b5d33a9a366e95c2ddd2d) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2023-49502Archana Polampalli2024-08-012-0/+108
| | | | | | | | | | | Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component. (From OE-Core rev: 814a688d1dc3f22cf7d1b88bde6842b032c13d12) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: backport patch to fix errors with GCC 14Dmitry Baryshkov2024-07-032-0/+103
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On ARMv7 compilation of ffmpeg breaks if Vulkan support is enabled. Backport a patch from the trunk to fix compilation issues: | src/libavcodec/vulkan_av1.c: In function 'vk_av1_create_params': | src/libavcodec/vulkan_av1.c:214:43: error: initialization of 'long long unsigned int' from 'void *' makes integer from pointer without a cast [-Wint-conversion] | 214 | .videoSessionParametersTemplate = NULL, | | ^~~~ | src/libavcodec/vulkan_av1.c:214:43: note: (near initialization for '(anonymous).videoSessionParametersTemplate') | make: *** [/oe/build/tmp-rpb_wayland-glibc/work/armv7at2hf-neon-linaro-linux-gnueabi/ffmpeg/6.1.1/ffmpeg-6.1.1/ffbuild/common.mak:81: libavcodec/vulkan_av1.o] Error 1 | make: *** Waiting for unfinished jobs.... | src/libavcodec/vulkan_decode.c: In function 'ff_vk_decode_prepare_frame': | src/libavcodec/vulkan_decode.c:191:26: error: assignment to 'VkImageView' {aka 'long long unsigned int'} from 'void *' makes integer from pointer without a cast [-Wint-conversion] | 191 | vkpic->img_view_ref = NULL; | | ^ | src/libavcodec/vulkan_decode.c:192:26: error: assignment to 'VkImageView' {aka 'long long unsigned int'} from 'void *' makes integer from pointer without a cast [-Wint-conversion] | 192 | vkpic->img_view_out = NULL; | | ^ | src/libavcodec/vulkan_decode.c:193:26: error: assignment to 'VkImageView' {aka 'long long unsigned int'} from 'void *' makes integer from pointer without a cast [-Wint-conversion] | 193 | vkpic->img_view_dest = NULL; | | ^ | make: *** [/oe/build/tmp-rpb_wayland-glibc/work/armv7at2hf-neon-linaro-linux-gnueabi/ffmpeg/6.1.1/ffmpeg-6.1.1/ffbuild/common.mak:81: libavcodec/vulkan_decode.o] Error 1 (From OE-Core rev: 6b3ca9f5745c438de74ef4e2e041ee95583b8dc6) Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 52001cabd021b7c856acf426b668b99a72561de0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: backport patches to use new Vulkan AV1 codec APIDmitry Baryshkov2024-07-033-1/+1478
| | | | | | | | | | | | | Backport two patches from ffmpeg git to fix compilation with the newest Vulkan API. (From OE-Core rev: 9dc5060abdc61e6a8a8a1ca44bb0aaf266d32271) Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a9393391613cd81643744daf930eaabf2ced79b7) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: upgrade 6.1 -> 6.1.1Wang Mingyu2024-01-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== - avcodec/mpegvideo_enc: Dont copy beyond the image - avfilter/vf_minterpolate: Check pts before division - avfilter/avf_showwaves: Check history_nb_samples - avformat/flacdec: Avoid double AVERRORS - avfilter/vf_vidstabdetect: Avoid double AVERRORS - avcodec/vaapi_encode: Avoid double AVERRORS - avfilter/vf_swaprect: round coordinates down - avfilter/vf_swaprect: Use height for vertical variables - avfilter/vf_swaprect: assert that rectangles are within memory - avfilter/af_alimiter: Check nextpos before use - avfilter/f_reverse: Apply PTS compensation only when pts is available - avfilter/af_stereowiden: Check length - avformat/mov: Fix MSAN issue with stsd_id - avcodec/jpegxl_parser: Check get_vlc2() - avfilter/vf_weave: Fix odd height handling - avfilter/edge_template: Fix small inputs with gaussian_blur() - avfilter/vf_gradfun: Do not overread last line - avfilter/avf_showspectrum: fix off by 1 error - avcodec/jpegxl_parser: Add padding to cs_buffer - avformat/mov: do not set sign bit for chunk_offsets - avcodec/jpeglsdec: Check Jpeg-LS LSE - avcodec/osq: Implement flush() - configure: Enable section_data_rel_ro for FreeBSD and NetBSD aarch64 / arm - avcodec/cbs_h266: more restrictive check on pps_tile_idx_delta_val - avcodec/jpeg2000htdec: check if block decoding will exceed internal precision - tools/target_dec_fuzzer: Adjust threshold for VMIX - avcodec/av1dec: Fix resolving zero divisor - avformat/mov: Ignore duplicate ftyp - avformat/mov: Fix integer overflow in mov_read_packet(). - lavc/qsvdec: return 0 if more data is required - avcodec/jpegxl_parser: check ANS cluster alphabet size vs bundle size - libavformat/vvc: Make probe more conservative - hwcontext_vulkan: guard unistd.h include - lavc/Makefile: build vulkan decode code if vulkan_av1 has been enabled - lavc/dvdsubenc: only check canvas size when it is actually set - avcodec/decode: validate hw_frames_ctx when AVHWAccel.free_frame_priv is used - avcoded/fft: Fix memory leak if ctx2 is used - avcodec/fft: Use av_mallocz to avoid invalid free/uninit (From OE-Core rev: e9ca6bdd43069c0b25115ae70dc09f0dda93ab1f) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: Upgrade 6.0 -> 6.1Markus Volk2023-11-203-116/+2
| | | | | | | | | | -Remove patches that made it upstream (From OE-Core rev: faa32bbb35e92a14b8064715c12e1007fd106b34) Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: drop PE, PR from /usr/src/debug pathsMartin Jansa2023-11-201-1/+1
| | | | | | | | (From OE-Core rev: 25f821023c057ed2632ed1f99a6e28dfe857a5d8) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: avoid neon on unsupported machinesBenjamin Bara2023-09-041-0/+2
| | | | | | | | | | Disable neon if the machine does not support it. (From OE-Core rev: 0c3a6a74531d3860a3849a1f53f6709d6a0e88a5) Signed-off-by: Benjamin Bara <benjamin.bara@skidata.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: add CVE_STATUS for CVE-2023-39018Narpat Mali2023-08-211-0/+7
| | | | | | | | | | | | | | | | | | | | | | CVE-2023-39018 belongs to ffmpeg-cli-wrapper (Java wrapper around the FFmpeg CLI) and not ffmpeg itself. As per CVE description, it is mentioned as FFmpeg 0.7.0 which is the version for ffmpeg-cli-wrapper and ffmpeg don't have 0.7.0 version at all. Debian & Bugzilla trackers have already marked as NOT-FOR-US/RESOLVED-INVALID. As it won't be affecting the ffmpeg package so, we can ignore the CVE-2023-39018 in ffmpeg recipe. References: https://github.com/bramp/ffmpeg-cli-wrapper https://github.com/FFmpeg/FFmpeg https://security-tracker.debian.org/tracker/CVE-2023-39018 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-39018 (From OE-Core rev: c21ed498b423c13463a4ae0bb475883cc7901847) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: Fix wrong code found with gas/2.41Khem Raj2023-08-012-0/+78
| | | | | | | | (From OE-Core rev: 692e414aed5313ff275b69e93179aa7c559700f3) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: Use bfd linker on i386 when lld is distro linker defaultKhem Raj2023-07-271-0/+1
| | | | | | | | (From OE-Core rev: fc155090b8cfb62f1114b3e5f86fc4dacfb3bc89) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: Fix build on riscvKhem Raj2023-07-102-1/+37
| | | | | | | (From OE-Core rev: 5f2dfecab15142b659b09edd7673f4714626513b) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: add v4l2 PACKAGECONFIGRoss Burton2023-05-091-0/+1
| | | | | | | | | | | | Can't be enabled by default as v4l-utils is in meta-oe. (From OE-Core rev: c7a200553b720b9a58c5e6702a89b9ea49f70f74) (From OE-Core rev: 1d290bd4373dea5fd035593249a1f31afe54b789) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "ffmpeg: move ffmpeg config into packageconfig"Ross Burton2023-05-091-9/+6
| | | | | | | | | | | | | | | | | There's very little reason to expose "build shared libraries", "build position-independent code", or "enable threads" as recipe-specific packageconfig options. Revert the commit which did this and explicitly set the relevant options in EXTRA_OECONF. This reverts commit b6e67e3d287407c6f022bbe672d9d206d90a12a4. (From OE-Core rev: ec62603a348154d837d5f0cbd52bb12468973341) (From OE-Core rev: 521a084190f72fc7a8783571829bd697e2baa1f0) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ffmpeg: Disable asm and rvv on riscv32Khem Raj2023-04-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | ffmpeg 6.0 has added assembly routines which uses rv64i ISA unconditionally, ideally it should check for ISA before using those instructions. Fixes errors like <instantiation>:1:1: error: instruction requires the following: RV64I Base Instruction Set ld t0, (a1) ^ src/libavcodec/riscv/pixblockdsp_rvi.S:24:1: note: while in macro instantiation .irp row, 0, 1, 2, 3, 4, 5, 6, 7 ^ <instantiation>:3:9: error: instruction requires the following: RV64I Base Instruction Set sd zero, ((0 * 16) + 0)(a0) ^ (From OE-Core rev: 010b068bcc126dbbc1e2032997e8d83360a7de35) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-21 22:48:47 +0000