* [PATCH] ffmpeg: fix CVE-2021-38114
@ 2021-10-08 16:48 Kiran Surendran
2021-10-08 21:12 ` [OE-core] " Richard Purdie
0 siblings, 1 reply; 3+ messages in thread
From: Kiran Surendran @ 2021-10-08 16:48 UTC (permalink / raw)
To: openembedded-core
backport from upstream
Signed-off-by: Kiran Surendran <kiran.surendran@windriver.com>
---
.../ffmpeg/ffmpeg/fix-CVE-2021-38114.patch | 67 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_4.3.2.bb | 3 +-
2 files changed, 69 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-38114.patch
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-38114.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-38114.patch
new file mode 100644
index 0000000000..3de7cf7e0f
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-38114.patch
@@ -0,0 +1,67 @@
+CVE: CVE-2021-38114
+Upstream-Status: Backport
+Signed-off-by: Kiran Surendran <kiran.surendran@windriver.com>
+
+From 662aef4aacf23b4be4c1cfaebd837e225b357e51 Mon Sep 17 00:00:00 2001
+From: maryam ebr <me22bee@outlook.com>
+Date: Tue, 3 Aug 2021 01:05:47 -0400
+Subject: [PATCH] avcodec/dnxhddec: check and propagate function return value
+
+Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed.
+crafted DNxHD data can cause unspecified impact.
+
+Reviewed-by: Paul B Mahol <onemda@gmail.com>
+Signed-off-by: James Almer <jamrial@gmail.com>
+---
+ libavcodec/dnxhddec.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/libavcodec/dnxhddec.c b/libavcodec/dnxhddec.c
+index e5d01e2e71..54f894f81b 100644
+--- a/libavcodec/dnxhddec.c
++++ b/libavcodec/dnxhddec.c
+@@ -110,6 +110,7 @@ static av_cold int dnxhd_decode_init(AVCodecContext *avctx)
+
+ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
+ {
++ int ret;
+ if (cid != ctx->cid) {
+ int index;
+
+@@ -129,19 +130,26 @@ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
+ ff_free_vlc(&ctx->dc_vlc);
+ ff_free_vlc(&ctx->run_vlc);
+
+- init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
++ if ((ret = init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
+ ctx->cid_table->ac_bits, 1, 1,
+- ctx->cid_table->ac_codes, 2, 2, 0);
+- init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
++ ctx->cid_table->ac_codes, 2, 2, 0)) < 0)
++ goto out;
++ if ((ret = init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
+ ctx->cid_table->dc_bits, 1, 1,
+- ctx->cid_table->dc_codes, 1, 1, 0);
+- init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
++ ctx->cid_table->dc_codes, 1, 1, 0)) < 0)
++ goto out;
++ if ((ret = init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
+ ctx->cid_table->run_bits, 1, 1,
+- ctx->cid_table->run_codes, 2, 2, 0);
++ ctx->cid_table->run_codes, 2, 2, 0)) < 0)
++ goto out;
+
+ ctx->cid = cid;
+ }
+- return 0;
++ ret = 0;
++out:
++ if (ret < 0)
++ av_log(ctx->avctx, AV_LOG_ERROR, "init_vlc failed\n");
++ return ret;
+ }
+
+ static int dnxhd_get_profile(int cid)
+--
+2.31.1
+
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.3.2.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.3.2.bb
index 0a49493abd..7df356946b 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.3.2.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.3.2.bb
@@ -31,7 +31,8 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \
file://fix-CVE-2020-22015.patch \
file://fix-CVE-2020-22021.patch \
file://fix-CVE-2020-22033-CVE-2020-22019.patch \
- "
+ file://fix-CVE-2021-38114.patch \
+ "
SRC_URI[sha256sum] = "46e4e64f1dd0233cbc0934b9f1c0da676008cad34725113fb7f802cfa84ccddb"
# Build fails when thumb is enabled: https://bugzilla.yoctoproject.org/show_bug.cgi?id=7717
--
2.31.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [OE-core] [PATCH] ffmpeg: fix CVE-2021-38114
2021-10-08 16:48 [PATCH] ffmpeg: fix CVE-2021-38114 Kiran Surendran
@ 2021-10-08 21:12 ` Richard Purdie
2021-10-08 21:47 ` Kiran Surendran
0 siblings, 1 reply; 3+ messages in thread
From: Richard Purdie @ 2021-10-08 21:12 UTC (permalink / raw)
To: Kiran Surendran, openembedded-core
On Fri, 2021-10-08 at 09:48 -0700, Kiran Surendran wrote:
> backport from upstream
>
> Signed-off-by: Kiran Surendran <kiran.surendran@windriver.com>
> ---
> .../ffmpeg/ffmpeg/fix-CVE-2021-38114.patch | 67 +++++++++++++++++++
> .../recipes-multimedia/ffmpeg/ffmpeg_4.3.2.bb | 3 +-
> 2 files changed, 69 insertions(+), 1 deletion(-)
> create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-38114.patch
Master has 4.4 so this doesnt apply? Which release was this targeted at?
Cheers,
Richard
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [OE-core] [PATCH] ffmpeg: fix CVE-2021-38114
2021-10-08 21:12 ` [OE-core] " Richard Purdie
@ 2021-10-08 21:47 ` Kiran Surendran
0 siblings, 0 replies; 3+ messages in thread
From: Kiran Surendran @ 2021-10-08 21:47 UTC (permalink / raw)
To: Richard Purdie, openembedded-core
Ah yes sorry, tried to use the same patch I made for hardknott, I'll
send the correct one for 4.4
Regards,
Kiran
On 10/8/21 5:12 PM, Richard Purdie wrote:
> [Please note: This e-mail is from an EXTERNAL e-mail address]
>
> On Fri, 2021-10-08 at 09:48 -0700, Kiran Surendran wrote:
>> backport from upstream
>>
>> Signed-off-by: Kiran Surendran <kiran.surendran@windriver.com>
>> ---
>> .../ffmpeg/ffmpeg/fix-CVE-2021-38114.patch | 67 +++++++++++++++++++
>> .../recipes-multimedia/ffmpeg/ffmpeg_4.3.2.bb | 3 +-
>> 2 files changed, 69 insertions(+), 1 deletion(-)
>> create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-38114.patch
> Master has 4.4 so this doesnt apply? Which release was this targeted at?
>
> Cheers,
>
> Richard
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-10-08 21:47 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-08 16:48 [PATCH] ffmpeg: fix CVE-2021-38114 Kiran Surendran
2021-10-08 21:12 ` [OE-core] " Richard Purdie
2021-10-08 21:47 ` Kiran Surendran
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.