Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ffmpeg-4 for openSUSE:Factory checked in at 2021-02-11 12:48:31 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ffmpeg-4 (Old) and /work/SRC/openSUSE:Factory/.ffmpeg-4.new.28504 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ffmpeg-4" Thu Feb 11 12:48:31 2021 rev:37 rq:870496 version:4.3.1 Changes: -------- --- /work/SRC/openSUSE:Factory/ffmpeg-4/ffmpeg-4.changes 2021-02-01 13:24:26.909751393 +0100 +++ /work/SRC/openSUSE:Factory/.ffmpeg-4.new.28504/ffmpeg-4.changes 2021-02-11 12:52:18.425911887 +0100 @@ -1,0 +2,6 @@ +Fri Feb 5 21:10:43 UTC 2021 - Jan Engelhardt <jeng...@inai.de> + +- Add 0001-avformat-vividas-improve-extradata-packing-checks-in.patch + [boo#1180519] [CVE-2020-35964] + +------------------------------------------------------------------- New: ---- 0001-avformat-vividas-improve-extradata-packing-checks-in.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ffmpeg-4.spec ++++++ --- /var/tmp/diff_new_pack.rtGQHj/_old 2021-02-11 12:52:19.181912928 +0100 +++ /var/tmp/diff_new_pack.rtGQHj/_new 2021-02-11 12:52:19.185912934 +0100 @@ -118,6 +118,7 @@ Patch7: 0001-lavf-srt-fix-build-fail-when-used-the-libsrt-1.4.1.patch Patch8: vmaf-trim-usr-local.patch Patch9: ffmpeg_altivec_yuv2rgb_novsx.patch +Patch10: 0001-avformat-vividas-improve-extradata-packing-checks-in.patch BuildRequires: ladspa-devel BuildRequires: libgsm-devel BuildRequires: libmp3lame-devel @@ -579,8 +580,7 @@ break compatibility without any notice. %prep -%setup -q -n %_name-%version -%autopatch -p1 +%autosetup -p1 -n %_name-%version %build %ifarch %ix86 %arm ++++++ 0001-avformat-vividas-improve-extradata-packing-checks-in.patch ++++++ >From 27a99e2c7d450fef15594671eef4465c8a166bd7 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <mich...@niedermayer.cc> Date: Wed, 28 Oct 2020 20:11:54 +0100 Subject: [PATCH] avformat/vividas: improve extradata packing checks in track_header() Fixes: out of array accesses Fixes: 26622/clusterfuzz-testcase-minimized-ffmpeg_dem_VIVIDAS_fuzzer-6581200338288640 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavformat/vividas.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git libavformat/vividas.c libavformat/vividas.c index 83d0ed1167..46c66bf9a0 100644 --- a/libavformat/vividas.c +++ a/libavformat/vividas.c @@ -28,6 +28,7 @@ * @sa http://wiki.multimedia.cx/index.php?title=Vividas_VIV */ +#include "libavutil/avassert.h" #include "libavutil/intreadwrite.h" #include "avio_internal.h" #include "avformat.h" @@ -379,7 +380,7 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t * if (avio_tell(pb) < off) { int num_data; - int xd_size = 0; + int xd_size = 1; int data_len[256]; int offset = 1; uint8_t *p; @@ -393,10 +394,10 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t * return AVERROR_INVALIDDATA; } data_len[j] = len; - xd_size += len; + xd_size += len + 1 + len/255; } - ret = ff_alloc_extradata(st->codecpar, 64 + xd_size + xd_size / 255); + ret = ff_alloc_extradata(st->codecpar, xd_size); if (ret < 0) return ret; @@ -405,9 +406,7 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t * for (j = 0; j < num_data - 1; j++) { unsigned delta = av_xiphlacing(&p[offset], data_len[j]); - if (delta > data_len[j]) { - return AVERROR_INVALIDDATA; - } + av_assert0(delta <= xd_size - offset); offset += delta; } @@ -418,6 +417,7 @@ static int track_header(VividasDemuxContext *viv, AVFormatContext *s, uint8_t * av_freep(&st->codecpar->extradata); break; } + av_assert0(data_len[j] <= xd_size - offset); offset += data_len[j]; } -- 2.30.0
