From a18a302dba4acc867e92abc0856cb0f5fce6d8a8 Mon Sep 17 00:00:00 2001 From: Archana Polampalli Date: Thu, 6 Mar 2025 06:59:23 +0000 Subject: ffmpeg: Correct the CVE ID to fix CVE-2025-22919 A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file. (From OE-Core rev: bf0ad79c46d8a01aafc91620ddf415749aa8849a) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman --- .../ffmpeg/ffmpeg/CVE-2025-22919.patch | 39 ++++++++++++++++++++++ .../ffmpeg/ffmpeg/CVE-2025-25471.patch | 39 ---------------------- meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 2 +- 3 files changed, 40 insertions(+), 40 deletions(-) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-22919.patch delete mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-25471.patch (limited to 'meta') diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-22919.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-22919.patch new file mode 100644 index 0000000000..f895576de3 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-22919.patch @@ -0,0 +1,39 @@ +From 1446e37d3d032e1452844778b3e6ba2c20f0c322 Mon Sep 17 00:00:00 2001 +From: James Almer +Date: Mon, 30 Dec 2024 00:25:41 -0300 +Subject: [PATCH] avfilter/buffersrc: check for valid sample rate + +A sample rate <= 0 is invalid. + +Fixes an assert in ffmpeg_enc.c that assumed a valid sample rate would be set. +Fixes ticket #11385. + +Signed-off-by: James Almer + +CVE: CVE-2025-22919 + +Upstream-Status: Backport [https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1446e37d3d032e1452844778b3e6ba2c20f0c322] + +Signed-off-by: Archana Polampalli +--- + libavfilter/buffersrc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libavfilter/buffersrc.c b/libavfilter/buffersrc.c +index 453fc0f..f49aa91 100644 +--- a/libavfilter/buffersrc.c ++++ b/libavfilter/buffersrc.c +@@ -401,6 +401,11 @@ FF_ENABLE_DEPRECATION_WARNINGS + av_channel_layout_describe(&s->ch_layout, buf, sizeof(buf)); + } + ++ if (s->sample_rate <= 0) { ++ av_log(ctx, AV_LOG_ERROR, "Sample rate not set\n"); ++ return AVERROR(EINVAL); ++ } ++ + if (!s->time_base.num) + s->time_base = (AVRational){1, s->sample_rate}; + +-- +2.40.0 diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-25471.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-25471.patch deleted file mode 100644 index 6af01b298f..0000000000 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-25471.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 1446e37d3d032e1452844778b3e6ba2c20f0c322 Mon Sep 17 00:00:00 2001 -From: James Almer -Date: Mon, 30 Dec 2024 00:25:41 -0300 -Subject: [PATCH] avfilter/buffersrc: check for valid sample rate - -A sample rate <= 0 is invalid. - -Fixes an assert in ffmpeg_enc.c that assumed a valid sample rate would be set. -Fixes ticket #11385. - -Signed-off-by: James Almer - -CVE: CVE-2025-25471 - -Upstream-Status: Backport [https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1446e37d3d032e1452844778b3e6ba2c20f0c322] - -Signed-off-by: Archana Polampalli ---- - libavfilter/buffersrc.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/libavfilter/buffersrc.c b/libavfilter/buffersrc.c -index 453fc0f..f49aa91 100644 ---- a/libavfilter/buffersrc.c -+++ b/libavfilter/buffersrc.c -@@ -401,6 +401,11 @@ FF_ENABLE_DEPRECATION_WARNINGS - av_channel_layout_describe(&s->ch_layout, buf, sizeof(buf)); - } - -+ if (s->sample_rate <= 0) { -+ av_log(ctx, AV_LOG_ERROR, "Sample rate not set\n"); -+ return AVERROR(EINVAL); -+ } -+ - if (!s->time_base.num) - s->time_base = (AVRational){1, s->sample_rate}; - --- -2.40.0 diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb index 06ca65a480..3d766c3fc7 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb @@ -48,7 +48,7 @@ SRC_URI = " \ file://CVE-2024-36619.patch \ file://CVE-2024-35369.patch \ file://CVE-2025-25473.patch \ - file://CVE-2025-25471.patch \ + file://CVE-2025-22919.patch \ file://CVE-2025-22921.patch \ file://CVE-2025-0518.patch \ " -- cgit v1.2.3-54-g00ecf