Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ffmpeg-4 for openSUSE:Factory checked in at 2026-08-04 21:37:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ffmpeg-4 (Old) and /work/SRC/openSUSE:Factory/.ffmpeg-4.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ffmpeg-4" Tue Aug 4 21:37:10 2026 rev:98 rq:1369399 version:4.4.8 Changes: -------- --- /work/SRC/openSUSE:Factory/ffmpeg-4/ffmpeg-4.changes 2026-07-24 00:18:16.050976754 +0200 +++ /work/SRC/openSUSE:Factory/.ffmpeg-4.new.16738/ffmpeg-4.changes 2026-08-04 21:39:34.222980872 +0200 @@ -1,0 +2,10 @@ +Thu Jul 30 02:39:03 UTC 2026 - Xiaoguang Wang <[email protected]> + +- Add CVE patches: + ffmpeg-4-CVE-2026-64835.patch: (CVE-2026-64835, bsc#1272758) + ffmpeg-4-CVE-2026-64832.patch: (CVE-2026-64832, bsc#1272754) + ffmpeg-4-CVE-2026-64830.patch: (CVE-2026-64830, bsc#1272752) + ffmpeg-4-CVE-2026-66038.patch: (CVE-2026-66038, bsc#1272768) + ffmpeg-4-CVE-2026-66039.patch: (CVE-2026-66039, bsc#1272765) + +------------------------------------------------------------------- New: ---- ffmpeg-4-CVE-2026-64830.patch ffmpeg-4-CVE-2026-64832.patch ffmpeg-4-CVE-2026-64835.patch ffmpeg-4-CVE-2026-66038.patch ffmpeg-4-CVE-2026-66039.patch ----------(New B)---------- New: ffmpeg-4-CVE-2026-64832.patch: (CVE-2026-64832, bsc#1272754) ffmpeg-4-CVE-2026-64830.patch: (CVE-2026-64830, bsc#1272752) ffmpeg-4-CVE-2026-66038.patch: (CVE-2026-66038, bsc#1272768) New: ffmpeg-4-CVE-2026-64835.patch: (CVE-2026-64835, bsc#1272758) ffmpeg-4-CVE-2026-64832.patch: (CVE-2026-64832, bsc#1272754) ffmpeg-4-CVE-2026-64830.patch: (CVE-2026-64830, bsc#1272752) New:- Add CVE patches: ffmpeg-4-CVE-2026-64835.patch: (CVE-2026-64835, bsc#1272758) ffmpeg-4-CVE-2026-64832.patch: (CVE-2026-64832, bsc#1272754) New: ffmpeg-4-CVE-2026-64830.patch: (CVE-2026-64830, bsc#1272752) ffmpeg-4-CVE-2026-66038.patch: (CVE-2026-66038, bsc#1272768) ffmpeg-4-CVE-2026-66039.patch: (CVE-2026-66039, bsc#1272765) New: ffmpeg-4-CVE-2026-66038.patch: (CVE-2026-66038, bsc#1272768) ffmpeg-4-CVE-2026-66039.patch: (CVE-2026-66039, bsc#1272765) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ffmpeg-4.spec ++++++ --- /var/tmp/diff_new_pack.2508zX/_old 2026-08-04 21:39:35.291018463 +0200 +++ /var/tmp/diff_new_pack.2508zX/_new 2026-08-04 21:39:35.295018604 +0200 @@ -150,6 +150,11 @@ Patch41: ffmpeg-4-CVE-2026-40962.patch Patch42: ffmpeg-4-CVE-2025-10256.patch Patch43: pcmbluray-bigendian.patch +Patch44: ffmpeg-4-CVE-2026-64835.patch +Patch45: ffmpeg-4-CVE-2026-64832.patch +Patch46: ffmpeg-4-CVE-2026-64830.patch +Patch47: ffmpeg-4-CVE-2026-66038.patch +Patch48: ffmpeg-4-CVE-2026-66039.patch BuildRequires: ladspa-devel BuildRequires: libgsm-devel BuildRequires: libmp3lame-devel ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.2508zX/_old 2026-08-04 21:39:35.371021279 +0200 +++ /var/tmp/diff_new_pack.2508zX/_new 2026-08-04 21:39:35.375021420 +0200 @@ -1,5 +1,5 @@ -mtime: 1784823926 -commit: 4bc87333163220daeb9679f2ab0ec8cd1c50107a1efabb847a2825569966db8f +mtime: 1785803606 +commit: 7735673b58953246683a52fc3da8206c86599ba76e135b733f538331877a6111 url: https://src.opensuse.org/jengelh/ffmpeg-4 revision: master ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-04 02:33:26.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ ffmpeg-4-CVE-2026-64830.patch ++++++ >From dbd495f066a85ba96b17433f4306582aa37c3951 Mon Sep 17 00:00:00 2001 From: Pavel Kohout <[email protected]> Date: Mon, 29 Jun 2026 23:30:41 +0200 Subject: [PATCH] avformat/vobsub: reuse subtitle streams and bound the stream count Fixes: heap buffer overflow Fixes: lqaO5R1BaZGO Fixes: dbfe61100b (avformat/vobsub: fix several issues.) Found-by: Pavel Kohout (Aisle Research) Signed-off-by: Michael Niedermayer <[email protected]> --- libavformat/mpeg.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/libavformat/mpeg.c b/libavformat/mpeg.c index ff5ced8107..29abe329b9 100644 --- a/libavformat/mpeg.c +++ b/libavformat/mpeg.c @@ -841,6 +841,20 @@ static int vobsub_read_header(AVFormatContext *s) } if (!st || st->id != stream_id) { + st = NULL; + for (i = 0; i < s->nb_streams; i++) { + if (s->streams[i]->id == stream_id) { + st = s->streams[i]; + break; + } + } + } + if (!st) { + if (s->nb_streams >= FF_ARRAY_ELEMS(vobsub->q)) { + av_log(s, AV_LOG_ERROR, "Maximum number of subtitle streams reached\n"); + ret = AVERROR_INVALIDDATA; + goto end; + } st = avformat_new_stream(s, NULL); if (!st) { ret = AVERROR(ENOMEM); @@ -865,14 +879,14 @@ static int vobsub_read_header(AVFormatContext *s) timestamp = (hh*3600LL + mm*60LL + ss) * 1000LL + ms + delay; timestamp = av_rescale_q(timestamp, av_make_q(1, 1000), st->time_base); - sub = ff_subtitles_queue_insert(&vobsub->q[s->nb_streams - 1], "", 0, 0); + sub = ff_subtitles_queue_insert(&vobsub->q[st->index], "", 0, 0); if (!sub) { ret = AVERROR(ENOMEM); goto end; } sub->pos = pos; sub->pts = timestamp; - sub->stream_index = s->nb_streams - 1; + sub->stream_index = st->index; } else if (!strncmp(line, "alt:", 4)) { const char *p = line + 4; -- 2.54.0 ++++++ ffmpeg-4-CVE-2026-64832.patch ++++++ >From 4c6217477fc64305055b37d9d1d0d76d30e37f97 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 30 Jun 2026 00:24:07 +0200 Subject: [PATCH] avcodec/nvdec: don't double free the fdd-owned context on the sep_ref error path Fixes: double free Fixes: rpSz7v3yq2u8 Fixes: 72982f8cb5dad6252a14226d28128313eed4a5ff (avcodec/nvdec: add support for separate reference frame) Found-by: Pavel Kohout (Aisle Research) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/nvdec.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) Index: ffmpeg-4.4.8/libavcodec/nvdec.c =================================================================== --- ffmpeg-4.4.8.orig/libavcodec/nvdec.c +++ ffmpeg-4.4.8/libavcodec/nvdec.c @@ -616,8 +616,7 @@ int ff_nvdec_start_frame_sep_ref(AVCodec cf->ref_idx_ref = av_buffer_pool_get(ctx->decoder_pool); if (!cf->ref_idx_ref) { av_log(avctx, AV_LOG_ERROR, "No decoder surfaces left\n"); - ret = AVERROR(ENOMEM); - goto fail; + return AVERROR(ENOMEM); } } cf->ref_idx = *(unsigned int*)cf->ref_idx_ref->data; @@ -627,9 +626,6 @@ int ff_nvdec_start_frame_sep_ref(AVCodec } return 0; -fail: - nvdec_fdd_priv_free(cf); - return ret; } int ff_nvdec_end_frame(AVCodecContext *avctx) ++++++ ffmpeg-4-CVE-2026-64835.patch ++++++ >From 1836ef96846937a6cc2443698a693104f5c0b21e Mon Sep 17 00:00:00 2001 From: Pavel Kohout <[email protected]> Date: Mon, 29 Jun 2026 23:46:16 +0200 Subject: [PATCH] avcodec/adx: sync decoder channel state on NEW_EXTRADATA Fixes: out of array access Fixes: heaNtmHvklpe Fixes: 92396cee602320c714713ca2d93b53684ad57000 (avformat: add CRI AAX demuxer) Found-by: Pavel Kohout (Aisle Research) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/adxdec.c | 5 +++++ 1 file changed, 5 insertions(+) Index: ffmpeg-4.4.8/libavcodec/adxdec.c =================================================================== --- ffmpeg-4.4.8.orig/libavcodec/adxdec.c +++ ffmpeg-4.4.8/libavcodec/adxdec.c @@ -109,6 +109,7 @@ static int adx_decode_frame(AVCodecConte new_extradata = av_packet_get_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA, &new_extradata_size); if (new_extradata && new_extradata_size > 0) { + int old_channels = c->channels; int header_size; if ((ret = ff_adx_decode_header(avctx, new_extradata, new_extradata_size, &header_size, @@ -117,6 +118,10 @@ static int adx_decode_frame(AVCodecConte return AVERROR_INVALIDDATA; } + c->channels = avctx->channels; + c->header_parsed = 1; + if (old_channels != c->channels) + memset(c->prev, 0, sizeof(c->prev)); c->eof = 0; } ++++++ ffmpeg-4-CVE-2026-66038.patch ++++++ >From e7cbfd1c507b57a806a5825b87d609963e862c8c Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 28 Jun 2026 19:04:07 +0200 Subject: [PATCH] avcodec/lcldec: zero the not-decoded tail to avoid heap disclosure Fixes: use of uninitialized memory Fixes: CsNDKB1K1U0C Fixes: e2c3aa8e2b (avcodec/lcldec: More space for rgb24) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/lcldec.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) Index: ffmpeg-4.4.8/libavcodec/lcldec.c =================================================================== --- ffmpeg-4.4.8.orig/libavcodec/lcldec.c +++ ffmpeg-4.4.8/libavcodec/lcldec.c @@ -116,6 +116,9 @@ static unsigned int mszh_decomp(const un } } + if (destptr < destptr_end) + memset(destptr, 0, destptr_end - destptr); + return destptr - destptr_bak; } @@ -148,8 +151,11 @@ static int zlib_decomp(AVCodecContext *a if (expected != (unsigned int)c->zstream.total_out) { av_log(avctx, AV_LOG_ERROR, "Decoded size differs (%d != %lu)\n", expected, c->zstream.total_out); - if (expected > (unsigned int)c->zstream.total_out) + if (expected > (unsigned int)c->zstream.total_out) { + memset(c->decomp_buf + offset + c->zstream.total_out, 0, + c->decomp_size - offset - c->zstream.total_out); return (unsigned int)c->zstream.total_out; + } return AVERROR_UNKNOWN; } return c->zstream.total_out; ++++++ ffmpeg-4-CVE-2026-66039.patch ++++++ >From aafb5c655edc76a753275c383ebb139feb032718 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 29 Jun 2026 01:16:44 +0200 Subject: [PATCH] avcodec/mace: reject sample counts that overflow int Fixes: heap buffer overflow Fixes: FmXBI2dbgvgD Fixes: 0eea212943544d40f99b05571aa7159d78667154 (Add avcodec_decode_audio4().) Found-by: Adrian Junge (vurlo) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/mace.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) Index: ffmpeg-4.4.8/libavcodec/mace.c =================================================================== --- ffmpeg-4.4.8.orig/libavcodec/mace.c +++ ffmpeg-4.4.8/libavcodec/mace.c @@ -252,7 +252,10 @@ static int mace_decode_frame(AVCodecCont } /* get output buffer */ - frame->nb_samples = 3 * (buf_size << (1 - is_mace3)) / avctx->channels; + int64_t nb_samples = 3 * ((int64_t)buf_size << (1 - is_mace3)) / avctx->channels; + if (nb_samples > INT_MAX) + return AVERROR_INVALIDDATA; + frame->nb_samples = nb_samples; if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) return ret; samples = (int16_t **)frame->extended_data;
