From: Kiran Surendran <kiran.surend...@windriver.com>
backport from upstream
Signed-off-by: Kiran Surendran <kiran.surend...@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.bell...@bootlin.com>
Signed-off-by: Richard Purdie <richard.pur...@linuxfoundation.org>
(cherry picked from commit fe9cdf74f7ef3637ed7c600182f8a0ba40510d2a)
Signed-off-by: Anuj Mittal <anuj.mit...@intel.com>
---
.../ffmpeg/ffmpeg/fix-CVE-2021-38114.patch | 67 +++++++++++++++++++
meta/recipes-multimedia/ffmpeg/ffmpeg_4.4.bb | 3 +-
2 files changed, 69 insertions(+), 1 deletion(-)
create mode 100644
meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-38114.patch
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-38114.patch
b/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-38114.patch
new file mode 100644
index 0000000000..ab3ecfecbb
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/fix-CVE-2021-38114.patch
@@ -0,0 +1,67 @@
+CVE: CVE-2021-38114
+Upstream-Status: Backport
+Signed-off-by: Kiran Surendran <kiran.surend...@windriver.com>
+
+From 463dbe4e78cc560ca5b09f23a07add0eb78ccee8 Mon Sep 17 00:00:00 2001
+From: maryam ebr <me22...@outlook.com>
+Date: Tue, 3 Aug 2021 01:05:47 -0400
+Subject: [PATCH] avcodec/dnxhddec: check and propagate function return value
+
+Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed.
+crafted DNxHD data can cause unspecified impact.
+
+Reviewed-by: Paul B Mahol <one...@gmail.com>
+Signed-off-by: James Almer <jamr...@gmail.com>
+---
+ libavcodec/dnxhddec.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/libavcodec/dnxhddec.c b/libavcodec/dnxhddec.c
+index c78d55aee5..9b475a6979 100644
+--- a/libavcodec/dnxhddec.c
++++ b/libavcodec/dnxhddec.c
+@@ -112,6 +112,7 @@ static av_cold int dnxhd_decode_init(AVCodecContext *avctx)
+
+ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
+ {
++ int ret;
+ if (cid != ctx->cid) {
+ const CIDEntry *cid_table = ff_dnxhd_get_cid_table(cid);
+
+@@ -132,19 +133,26 @@ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t
cid, int bitdepth)
+ ff_free_vlc(&ctx->dc_vlc);
+ ff_free_vlc(&ctx->run_vlc);
+
+- init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
++ if ((ret = init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
+ ctx->cid_table->ac_bits, 1, 1,
+- ctx->cid_table->ac_codes, 2, 2, 0);
+- init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
++ ctx->cid_table->ac_codes, 2, 2, 0)) < 0)
++ goto out;
++ if ((ret = init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ?
14 : 12,
+ ctx->cid_table->dc_bits, 1, 1,
+- ctx->cid_table->dc_codes, 1, 1, 0);
+- init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
++ ctx->cid_table->dc_codes, 1, 1, 0)) < 0)
++ goto out;
++ if ((ret = init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
+ ctx->cid_table->run_bits, 1, 1,
+- ctx->cid_table->run_codes, 2, 2, 0);
++ ctx->cid_table->run_codes, 2, 2, 0)) < 0)
++ goto out;
+
+ ctx->cid = cid;
+ }
+- return 0;
++ ret = 0;
++out:
++ if (ret < 0)
++ av_log(ctx->avctx, AV_LOG_ERROR, "init_vlc failed\n");
++ return ret;
+ }
+
+ static int dnxhd_get_profile(int cid)
+--
+2.31.1
+
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.4.bb
b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.4.bb
index 0c6af6549d..c0318ef01d 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.4.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.4.bb
@@ -31,7 +31,8 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \
file://fix-CVE-2020-22021.patch \
file://fix-CVE-2020-22033-CVE-2020-22019.patch \
file://fix-CVE-2021-33815.patch \
- file://fix-CVE-2021-38171.patch \
+ file://fix-CVE-2021-38171.patch \
+ file://fix-CVE-2021-38114.patch \
"
SRC_URI[sha256sum] =
"06b10a183ce5371f915c6bb15b7b1fffbe046e8275099c96affc29e17645d909"
--
2.31.1
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#157440):
https://lists.openembedded.org/g/openembedded-core/message/157440
Mute This Topic: https://lists.openembedded.org/mt/86606526/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
