Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libvpx for openSUSE:Factory checked in at 2023-09-29 21:12:43 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libvpx (Old) and /work/SRC/openSUSE:Factory/.libvpx.new.28202 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libvpx" Fri Sep 29 21:12:43 2023 rev:49 rq:1114051 version:1.13.0 Changes: -------- --- /work/SRC/openSUSE:Factory/libvpx/libvpx.changes 2023-02-16 16:55:10.594536615 +0100 +++ /work/SRC/openSUSE:Factory/.libvpx.new.28202/libvpx.changes 2023-09-29 21:12:59.228478544 +0200 @@ -1,0 +2,6 @@ +Thu Sep 28 09:27:46 UTC 2023 - Adrian Schröter <[email protected]> + +- Fixing CVE-2023-5217 heap buffer overflow (boo#1215778) + added CVE-2023-5217.patch + +------------------------------------------------------------------- New: ---- CVE-2023-5217.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libvpx.spec ++++++ --- /var/tmp/diff_new_pack.JAdzE3/_old 2023-09-29 21:13:01.064544789 +0200 +++ /var/tmp/diff_new_pack.JAdzE3/_new 2023-09-29 21:13:01.064544789 +0200 @@ -26,6 +26,8 @@ URL: https://www.webmproject.org/ Source0: %{name}-%{version}.tar.xz Source1000: baselibs.conf +# PATCH-FIX-UPSTREAM +Patch1: CVE-2023-5217.patch Patch2: libvpx-configure-add-arch.patch # only needed for test suite BuildRequires: gcc-c++ ++++++ CVE-2023-5217.patch ++++++ commit af6dedd715f4307669366944cca6e0417b290282 Author: James Zern <[email protected]> Date: Mon Sep 25 18:53:41 2023 -0700 encode_api_test: add ConfigResizeChangeThreadCount Update thread counts and resolution to ensure allocations are updated correctly. VP8 is disabled to avoid a crash. Bug: chromium:1486441 Change-Id: Ie89776d9818d27dc351eff298a44c699e850761b Index: libvpx-1.13.0/test/encode_api_test.cc =================================================================== --- libvpx-1.13.0.orig/test/encode_api_test.cc +++ libvpx-1.13.0/test/encode_api_test.cc @@ -304,7 +304,6 @@ TEST(EncodeAPI, SetRoi) { void InitCodec(const vpx_codec_iface_t &iface, int width, int height, vpx_codec_ctx_t *enc, vpx_codec_enc_cfg_t *cfg) { - ASSERT_EQ(vpx_codec_enc_config_default(&iface, cfg, 0), VPX_CODEC_OK); cfg->g_w = width; cfg->g_h = height; cfg->g_lag_in_frames = 0; @@ -342,6 +341,7 @@ TEST(EncodeAPI, ConfigChangeThreadCount) vpx_codec_ctx_t ctx = {}; } enc; + ASSERT_EQ(vpx_codec_enc_config_default(iface, &cfg, 0), VPX_CODEC_OK); EXPECT_NO_FATAL_FAILURE( InitCodec(*iface, kWidth, kHeight, &enc.ctx, &cfg)); if (IsVP9(iface)) { @@ -353,6 +353,54 @@ TEST(EncodeAPI, ConfigChangeThreadCount) for (const auto threads : { 1, 4, 8, 6, 2, 1 }) { cfg.g_threads = threads; + EXPECT_NO_FATAL_FAILURE(EncodeWithConfig(cfg, &enc.ctx)) + << "iteration: " << i << " threads: " << threads; + } + } + } +} + +TEST(EncodeAPI, ConfigResizeChangeThreadCount) { + constexpr int kInitWidth = 1024; + constexpr int kInitHeight = 1024; + + for (const auto *iface : kCodecIfaces) { + SCOPED_TRACE(vpx_codec_iface_name(iface)); + if (!IsVP9(iface)) { + GTEST_SKIP() << "TODO(https://crbug.com/1486441) remove this condition " + "after VP8 is fixed."; + } + for (int i = 0; i < (IsVP9(iface) ? 2 : 1); ++i) { + vpx_codec_enc_cfg_t cfg = {}; + struct Encoder { + ~Encoder() { EXPECT_EQ(vpx_codec_destroy(&ctx), VPX_CODEC_OK); } + vpx_codec_ctx_t ctx = {}; + } enc; + + ASSERT_EQ(vpx_codec_enc_config_default(iface, &cfg, 0), VPX_CODEC_OK); + // Start in threaded mode to ensure resolution and thread related + // allocations are updated correctly across changes in resolution and + // thread counts. See https://crbug.com/1486441. + cfg.g_threads = 4; + EXPECT_NO_FATAL_FAILURE( + InitCodec(*iface, kInitWidth, kInitHeight, &enc.ctx, &cfg)); + if (IsVP9(iface)) { + EXPECT_EQ(vpx_codec_control_(&enc.ctx, VP9E_SET_TILE_COLUMNS, 6), + VPX_CODEC_OK); + EXPECT_EQ(vpx_codec_control_(&enc.ctx, VP9E_SET_ROW_MT, i), + VPX_CODEC_OK); + } + + cfg.g_w = 1000; + cfg.g_h = 608; + EXPECT_EQ(vpx_codec_enc_config_set(&enc.ctx, &cfg), VPX_CODEC_OK) + << vpx_codec_error_detail(&enc.ctx); + + cfg.g_w = 16; + cfg.g_h = 720; + + for (const auto threads : { 1, 4, 8, 6, 2, 1 }) { + cfg.g_threads = threads; EXPECT_NO_FATAL_FAILURE(EncodeWithConfig(cfg, &enc.ctx)) << "iteration: " << i << " threads: " << threads; } Index: libvpx-1.13.0/vp8/encoder/onyx_if.c =================================================================== --- libvpx-1.13.0.orig/vp8/encoder/onyx_if.c +++ libvpx-1.13.0/vp8/encoder/onyx_if.c @@ -1443,6 +1443,11 @@ void vp8_change_config(VP8_COMP *cpi, VP last_h = cpi->oxcf.Height; prev_number_of_layers = cpi->oxcf.number_of_layers; + if (cpi->initial_width) { + // TODO(https://crbug.com/1486441): Allow changing thread counts; the + // allocation is done once in vp8_create_compressor(). + oxcf->multi_threaded = cpi->oxcf.multi_threaded; + } cpi->oxcf = *oxcf; switch (cpi->oxcf.Mode) { ++++++ libvpx-1.13.0.obscpio ++++++ /work/SRC/openSUSE:Factory/libvpx/libvpx-1.13.0.obscpio /work/SRC/openSUSE:Factory/.libvpx.new.28202/libvpx-1.13.0.obscpio differ: char 69090, line 1820
