CaROS/poky
3
1
Fork 0
mirror of https://git.yoctoproject.org/git/poky synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

ffmpeg: fix CVE-2021-38114

Browse Source 
backport from upstream

(From OE-Core rev: 437f5e04c92158d3c9e27fe6252260a02a108391)

Signed-off-by: Kiran Surendran <kiran.surendran@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Kiran Surendran 2021-09-15 12:34:17 -07:00 committed by Richard Purdie
parent bae79104d4
commit e6ba9f34ef
2 changed files with 68 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-38114.patch Normal file
View File

@ -0,0 +1,67 @@
CVE: CVE-2021-38114
Upstream-Status: Backport
Signed-off-by: Kiran Surendran <kiran.surendran@windriver.com>
From 662aef4aacf23b4be4c1cfaebd837e225b357e51 Mon Sep 17 00:00:00 2001
From: maryam ebr <me22bee@outlook.com>
Date: Tue, 3 Aug 2021 01:05:47 -0400
Subject: [PATCH] avcodec/dnxhddec: check and propagate function return value
Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed.
crafted DNxHD data can cause unspecified impact.
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
---
libavcodec/dnxhddec.c | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
diff --git a/libavcodec/dnxhddec.c b/libavcodec/dnxhddec.c
index e5d01e2e71..54f894f81b 100644
--- a/libavcodec/dnxhddec.c
+++ b/libavcodec/dnxhddec.c
@@ -110,6 +110,7 @@ static av_cold int dnxhd_decode_init(AVCodecContext *avctx)
static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
{
+ int ret;
if (cid != ctx->cid) {
int index;
@@ -129,19 +130,26 @@ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
ff_free_vlc(&ctx->dc_vlc);
ff_free_vlc(&ctx->run_vlc);
- init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
+ if ((ret = init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
ctx->cid_table->ac_bits, 1, 1,
- ctx->cid_table->ac_codes, 2, 2, 0);
- init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
+ ctx->cid_table->ac_codes, 2, 2, 0)) < 0)
+ goto out;
+ if ((ret = init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
ctx->cid_table->dc_bits, 1, 1,
- ctx->cid_table->dc_codes, 1, 1, 0);
- init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
+ ctx->cid_table->dc_codes, 1, 1, 0)) < 0)
+ goto out;
+ if ((ret = init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
ctx->cid_table->run_bits, 1, 1,
- ctx->cid_table->run_codes, 2, 2, 0);
+ ctx->cid_table->run_codes, 2, 2, 0)) < 0)
+ goto out;
ctx->cid = cid;
}
- return 0;
+ ret = 0;
+out:
+ if (ret < 0)
+ av_log(ctx->avctx, AV_LOG_ERROR, "init_vlc failed\n");
+ return ret;
}
static int dnxhd_get_profile(int cid)
--
2.31.1

1
meta/recipes-multimedia/ffmpeg/ffmpeg_4.3.2.bb
View File

@ -33,6 +33,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \
file://fix-CVE-2020-22033-CVE-2020-22019.patch \
file://fix-CVE-2021-38291.patch \
file://fix-CVE-2021-38171.patch \
file://fix-CVE-2021-38114.patch \
"
SRC_URI[sha256sum] = "46e4e64f1dd0233cbc0934b9f1c0da676008cad34725113fb7f802cfa84ccddb"