Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ffmpeg-4 for openSUSE:Factory checked in at 2026-10-06 19:15:12 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ffmpeg-4 (Old) and /work/SRC/openSUSE:Factory/.ffmpeg-4.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ffmpeg-4" Tue Oct 6 19:15:12 2026 rev:101 rq:1382587 version:4.4.8 Changes: -------- --- /work/SRC/openSUSE:Factory/ffmpeg-4/ffmpeg-4.changes 2026-09-08 16:54:38.885301431 +0200 +++ /work/SRC/openSUSE:Factory/.ffmpeg-4.new.3698736/ffmpeg-4.changes 2026-10-06 19:16:10.147889860 +0200 @@ -1,0 +2,32 @@ +Mon Sep 21 02:44:56 UTC 2026 - Cliff Zhao <[email protected]> + +- Add ffmpeg-4-CVE-2026-75141.patch: + Backport acf5d7cd from upstream, avformat/hevc: reject hvcC + NAL arrays that overflow the 16-bit count. + (CVE-2026-75141, bsc#1276407) + +------------------------------------------------------------------- +Fri Sep 11 12:54:08 UTC 2026 - Cliff Zhao <[email protected]> + +- Add ffmpeg-4-CVE-2026-38350-part02-c44d237.patch: + Backport c44d237d from upstream, swscale/output: Fix integer + overflow with lum/chr/alpha filter. + (CVE-2026-38350, bsc#1277370) + +------------------------------------------------------------------- +Fri Sep 11 12:38:21 UTC 2026 - Cliff Zhao <[email protected]> + +- Add ffmpeg-4-CVE-2026-38350-part01-aca41d3.patch: + Backport aca41d3d from upstream, swscale/output: Fix all bilinear + integer overflows. + (CVE-2026-38350, bsc#1277370) + +------------------------------------------------------------------- +Fri Sep 11 12:04:54 UTC 2026 - Cliff Zhao <[email protected]> + +- Add ffmpeg-4-CVE-2026-38345.patch: + Backport 04fe9848 from upstream, libswscale/utils: prevent division + by zero for chroma width 8. + (CVE-2026-38345, bsc#1277376) + +------------------------------------------------------------------- @@ -163,2 +195,2 @@ - avcodec/magicyuv: Expand the s->interlaced slice-height sanity check - avcodec/magicyuv: reject slice_height misaligned with chroma vshift + * avcodec/magicyuv: Expand the s->interlaced slice-height sanity check + * avcodec/magicyuv: reject slice_height misaligned with chroma vshift @@ -165,0 +198,4 @@ + * swscale/alphablend: don't overread alpha plane on subsampled odd size. + (CVE-2026-38347, bsc#1277373) + * avformat/hls: check return value of new_init_section(). + (CVE-2023-6603, bsc#1220547) @@ -188,0 +225,10 @@ + * avcodec/tdsc: remove double stride adjustment. + (CVE-2026-18393, bsc#1277377) + * swscale/output: Fixes integer overflow in yuv2planeX_8_c. + (CVE-2026-38346, bsc#1277375) + * swscale/output: Fix integer overflow in alpha in yuv2rgba64_1_c_template(). + (CVE-2026-38349, bsc#1277369) + * swscale/utils: Check *Inc. + (CVE-2026-38348, bsc#1277368) + * avcodec/ppc/vp8dsp_altivec: Fix out-of-bounds access. + (CVE-2024-35367, bsc#1234029) @@ -275,0 +322,2 @@ + * avformat/hls: Be more picky on extensions. + (CVE-2023-6602, bsc#1220546, CVE-2023-6604, bsc#1220549) New: ---- ffmpeg-4-CVE-2026-38345.patch ffmpeg-4-CVE-2026-38350-part01-aca41d3.patch ffmpeg-4-CVE-2026-38350-part02-c44d237.patch ffmpeg-4-CVE-2026-75141.patch ----------(New B)---------- New: - Add ffmpeg-4-CVE-2026-38345.patch: Backport 04fe9848 from upstream, libswscale/utils: prevent division New: - Add ffmpeg-4-CVE-2026-38350-part01-aca41d3.patch: Backport aca41d3d from upstream, swscale/output: Fix all bilinear New: - Add ffmpeg-4-CVE-2026-38350-part02-c44d237.patch: Backport c44d237d from upstream, swscale/output: Fix integer New: - Add ffmpeg-4-CVE-2026-75141.patch: Backport acf5d7cd from upstream, avformat/hevc: reject hvcC ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ffmpeg-4.spec ++++++ --- /var/tmp/diff_new_pack.1tragG/_old 2026-10-06 19:16:11.812959537 +0200 +++ /var/tmp/diff_new_pack.1tragG/_new 2026-10-06 19:16:11.815959663 +0200 @@ -169,10 +169,14 @@ Patch60: ffmpeg-4-CVE-2026-70630.patch Patch61: ffmpeg-4-CVE-2026-70631.patch Patch62: ffmpeg-4-CVE-2026-70632.patch +Patch63: ffmpeg-4-CVE-2026-75141.patch Patch64: ffmpeg-4-CVE-2026-75142.patch Patch65: ffmpeg-4-CVE-2026-75143.patch Patch66: ffmpeg-4-CVE-2026-75144.patch Patch67: ffmpeg-4-CVE-2026-75146.patch +Patch68: ffmpeg-4-CVE-2026-38345.patch +Patch69: ffmpeg-4-CVE-2026-38350-part01-aca41d3.patch +Patch70: ffmpeg-4-CVE-2026-38350-part02-c44d237.patch BuildRequires: ladspa-devel BuildRequires: libgsm-devel BuildRequires: libmp3lame-devel ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.1tragG/_old 2026-10-06 19:16:11.870961964 +0200 +++ /var/tmp/diff_new_pack.1tragG/_new 2026-10-06 19:16:11.875962173 +0200 @@ -1,5 +1,5 @@ -mtime: 1788692822 -commit: 8717f2501a05e13d6c46e8660428d203db26b18b57900f646e9e25d2c3761691 +mtime: 1791218466 +commit: e36a0b011c4fc0972838eb6f373b2679d081fa7f7e16adf43c640f2035cfa76a url: https://src.opensuse.org/jengelh/ffmpeg-4 revision: master ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-05 18:41:06.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ ffmpeg-4-CVE-2026-38345.patch ++++++ From: AnandajithS <[email protected]> Date: Sun, 15 Feb 2026 20:38:36 +0000 Subject: [PATCH 3/3] libswscale/utils: prevent division by zero for chroma width 8 Upstream: 04fe98482a264117fa49a166c18227f3f93f921b References: bsc#1277376 CVE-2026-38345 Target: FFmpeg n4.4.8; apply in series order Backport notes: - Adapt ff_sws_init_single_context/sws to sws_init_context/c. - The old MMX fast-bilinear path also divides by chrDstW - 2. - Retain the upstream dstW <= 8 fallback to SWS_BILINEAR. --- diff --git a/libswscale/utils.c b/libswscale/utils.c --- a/libswscale/utils.c +++ b/libswscale/utils.c @@ -1284,7 +1284,7 @@ return AVERROR(EINVAL); } if (flags & SWS_FAST_BILINEAR) { - if (srcW < 8 || dstW < 8) { + if (srcW < 8 || dstW <= 8) { flags ^= SWS_FAST_BILINEAR | SWS_BILINEAR; c->flags = flags; } ++++++ ffmpeg-4-CVE-2026-38350-part01-aca41d3.patch ++++++ From: Michael Niedermayer <[email protected]> Date: Tue, 29 Jul 2025 18:57:53 +0000 Subject: [PATCH 2/3] swscale/output: Fix all bilinear integer overflows Upstream: aca41d3d9327be4d6ab036f494b700118fcc04e1 References: bsc#1277370 CVE-2026-38350 Target: FFmpeg n4.4.8; apply in series order Backport notes: - Preserve SwsContext, existing signatures and endian handling. - Port all changes in the three _2_c_template calculation bodies. - The two _1_c_template paths use fixed chroma averaging and have no uvalpha1 variable; their upstream hunks are not applicable. Ticket11686 hinted at one of these overflows this fixes them all Issue in line 1325/1326 found by HAORAN FANG <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- diff --git a/libswscale/output.c b/libswscale/output.c --- a/libswscale/output.c +++ b/libswscale/output.c @@ -938,26 +938,27 @@ yuv2ya16_2_c_template(SwsContext *c, const int32_t *buf[2], const int32_t *unused_ubuf[2], const int32_t *unused_vbuf[2], const int32_t *abuf[2], uint16_t *dest, int dstW, - int yalpha, int unused_uvalpha, int y, + int yalpha_param, int unused_uvalpha, int y, enum AVPixelFormat target, int unused_hasAlpha, int unused_eightbytes) { + unsigned yalpha = yalpha_param; int hasAlpha = abuf && abuf[0] && abuf[1]; const int32_t *buf0 = buf[0], *buf1 = buf[1], *abuf0 = hasAlpha ? abuf[0] : NULL, *abuf1 = hasAlpha ? abuf[1] : NULL; - int yalpha1 = 4096 - yalpha; + unsigned yalpha1 = 4096 - yalpha; int i; av_assert2(yalpha <= 4096U); for (i = 0; i < dstW; i++) { - int Y = (buf0[i] * yalpha1 + buf1[i] * yalpha) >> 15; + int Y = (int)(buf0[i] * yalpha1 + buf1[i] * yalpha) >> 15; int A; Y = av_clip_uint16(Y); if (hasAlpha) { - A = (abuf0[i] * yalpha1 + abuf1[i] * yalpha) >> 15; + A = (int)(abuf0[i] * yalpha1 + abuf1[i] * yalpha) >> 15; A = av_clip_uint16(A); } @@ -1078,16 +1079,18 @@ yuv2rgba64_2_c_template(SwsContext *c, const int32_t *buf[2], const int32_t *ubuf[2], const int32_t *vbuf[2], const int32_t *abuf[2], uint16_t *dest, int dstW, - int yalpha, int uvalpha, int y, + int yalpha_param, int uvalpha_param, int y, enum AVPixelFormat target, int hasAlpha, int eightbytes) { + unsigned yalpha = yalpha_param; + unsigned uvalpha = uvalpha_param; const int32_t *buf0 = buf[0], *buf1 = buf[1], *ubuf0 = ubuf[0], *ubuf1 = ubuf[1], *vbuf0 = vbuf[0], *vbuf1 = vbuf[1], *abuf0 = hasAlpha ? abuf[0] : NULL, *abuf1 = hasAlpha ? abuf[1] : NULL; - int yalpha1 = 4096 - yalpha; - int uvalpha1 = 4096 - uvalpha; + unsigned yalpha1 = 4096 - yalpha; + unsigned uvalpha1 = 4096 - uvalpha; int i; int A1 = 0xffff<<14, A2 = 0xffff<<14; @@ -1095,10 +1098,10 @@ av_assert2(uvalpha <= 4096U); for (i = 0; i < ((dstW + 1) >> 1); i++) { - unsigned Y1 = (buf0[i * 2] * yalpha1 + buf1[i * 2] * yalpha) >> 14; - unsigned Y2 = (buf0[i * 2 + 1] * yalpha1 + buf1[i * 2 + 1] * yalpha) >> 14; - int U = (ubuf0[i] * uvalpha1 + ubuf1[i] * uvalpha - (128 << 23)) >> 14; - int V = (vbuf0[i] * uvalpha1 + vbuf1[i] * uvalpha - (128 << 23)) >> 14; + unsigned Y1 = (int)(buf0[i * 2] * yalpha1 + buf1[i * 2] * yalpha) >> 14; + unsigned Y2 = (int)(buf0[i * 2 + 1] * yalpha1 + buf1[i * 2 + 1] * yalpha) >> 14; + int U = (int)(ubuf0[i] * uvalpha1 + ubuf1[i] * uvalpha - (128 << 23)) >> 14; + int V = (int)(vbuf0[i] * uvalpha1 + vbuf1[i] * uvalpha - (128 << 23)) >> 14; int R, G, B; Y1 -= c->yuv2rgb_y_offset; @@ -1113,8 +1116,8 @@ B = U * c->yuv2rgb_u2b_coeff; if (hasAlpha) { - A1 = (abuf0[i * 2 ] * yalpha1 + abuf1[i * 2 ] * yalpha) >> 1; - A2 = (abuf0[i * 2 + 1] * yalpha1 + abuf1[i * 2 + 1] * yalpha) >> 1; + A1 = (int)(abuf0[i * 2 ] * yalpha1 + abuf1[i * 2 ] * yalpha) >> 1; + A2 = (int)(abuf0[i * 2 + 1] * yalpha1 + abuf1[i * 2 + 1] * yalpha) >> 1; A1 += 1 << 13; A2 += 1 << 13; @@ -1310,16 +1313,18 @@ yuv2rgba64_full_2_c_template(SwsContext *c, const int32_t *buf[2], const int32_t *ubuf[2], const int32_t *vbuf[2], const int32_t *abuf[2], uint16_t *dest, int dstW, - int yalpha, int uvalpha, int y, + int yalpha_param, int uvalpha_param, int y, enum AVPixelFormat target, int hasAlpha, int eightbytes) { + unsigned yalpha = yalpha_param; + unsigned uvalpha = uvalpha_param; const int32_t *buf0 = buf[0], *buf1 = buf[1], *ubuf0 = ubuf[0], *ubuf1 = ubuf[1], *vbuf0 = vbuf[0], *vbuf1 = vbuf[1], *abuf0 = hasAlpha ? abuf[0] : NULL, *abuf1 = hasAlpha ? abuf[1] : NULL; - int yalpha1 = 4096 - yalpha; - int uvalpha1 = 4096 - uvalpha; + unsigned yalpha1 = 4096 - yalpha; + unsigned uvalpha1 = 4096 - uvalpha; int i; int A = 0xffff<<14; @@ -1327,9 +1332,9 @@ av_assert2(uvalpha <= 4096U); for (i = 0; i < dstW; i++) { - int Y = (buf0[i] * yalpha1 + buf1[i] * yalpha) >> 14; - int U = (ubuf0[i] * uvalpha1 + ubuf1[i] * uvalpha - (128 << 23)) >> 14; - int V = (vbuf0[i] * uvalpha1 + vbuf1[i] * uvalpha - (128 << 23)) >> 14; + int Y = (int)(buf0[i] * yalpha1 + buf1[i] * yalpha) >> 14; + int U = (int)(ubuf0[i] * uvalpha1 + ubuf1[i] * uvalpha - (128 << 23)) >> 14; + int V = (int)(vbuf0[i] * uvalpha1 + vbuf1[i] * uvalpha - (128 << 23)) >> 14; int R, G, B; Y -= c->yuv2rgb_y_offset; @@ -1341,7 +1346,7 @@ B = U * c->yuv2rgb_u2b_coeff; if (hasAlpha) { - A = (abuf0[i] * yalpha1 + abuf1[i] * yalpha) >> 1; + A = (int)(abuf0[i] * yalpha1 + abuf1[i] * yalpha) >> 1; A += 1 << 13; } ++++++ ffmpeg-4-CVE-2026-38350-part02-c44d237.patch ++++++ From: Michael Niedermayer <[email protected]> Date: Wed, 30 Jul 2025 10:35:59 +0000 Subject: [PATCH 1/3] swscale/output: Fix integer overflow with lum/chr/alpha filter Upstream: c44d237d8069a7be8679b27106372f2ba8c0a51b References: bsc#1277370 CVE-2026-38350 Target: FFmpeg n4.4.8; apply in series order Backport notes: - Keep SwsContext and existing function signatures. - Map yuv2p01xcX_c to yuv2p010cX_c. - Preserve existing unsigned multiplication in the YA16 X path. - Newer XV30/XV36, AYUV/VUYA 8-bit, packed Y2xx and VYU444 paths are absent from n4.4.8; do not introduce them. - Update all 28 applicable accumulation expressions in eight functions. Signed-off-by: Michael Niedermayer <[email protected]> --- diff -Nurap a/libswscale/output.c b/libswscale/output.c --- a/libswscale/output.c +++ b/libswscale/output.c @@ -420,8 +420,8 @@ static void yuv2nv12cX_c(enum AVPixelFor int v = chrDither[(i + 3) & 7] << 12; int j; for (j=0; j<chrFilterSize; j++) { - u += chrUSrc[j][i] * chrFilter[j]; - v += chrVSrc[j][i] * chrFilter[j]; + u += (unsigned)(chrUSrc[j][i] * chrFilter[j]); + v += (unsigned)(chrVSrc[j][i] * chrFilter[j]); } dest[2*i]= av_clip_uint8(u>>19); @@ -433,8 +433,8 @@ static void yuv2nv12cX_c(enum AVPixelFor int v = chrDither[(i + 3) & 7] << 12; int j; for (j=0; j<chrFilterSize; j++) { - u += chrUSrc[j][i] * chrFilter[j]; - v += chrVSrc[j][i] * chrFilter[j]; + u += (unsigned)(chrUSrc[j][i] * chrFilter[j]); + v += (unsigned)(chrVSrc[j][i] * chrFilter[j]); } dest[2*i]= av_clip_uint8(v>>19); @@ -495,8 +495,8 @@ static void yuv2p010cX_c(enum AVPixelFor int v = 1 << (shift - 1); for (j = 0; j < chrFilterSize; j++) { - u += chrUSrc[j][i] * chrFilter[j]; - v += chrVSrc[j][i] * chrFilter[j]; + u += (unsigned)(chrUSrc[j][i] * chrFilter[j]); + v += (unsigned)(chrVSrc[j][i] * chrFilter[j]); } output_pixel(&dest[2*i] , u); @@ -564,8 +564,8 @@ yuv2mono_X_c_template(SwsContext *c, con int Y2 = 1 << 18; for (j = 0; j < lumFilterSize; j++) { - Y1 += lumSrc[j][i] * lumFilter[j]; - Y2 += lumSrc[j][i+1] * lumFilter[j]; + Y1 += (unsigned)(lumSrc[j][i] * lumFilter[j]); + Y2 += (unsigned)(lumSrc[j][i+1] * lumFilter[j]); } Y1 >>= 19; Y2 >>= 19; @@ -782,12 +782,12 @@ yuv2422_X_c_template(SwsContext *c, cons int V = 1 << 18; for (j = 0; j < lumFilterSize; j++) { - Y1 += lumSrc[j][i * 2] * lumFilter[j]; - Y2 += lumSrc[j][i * 2 + 1] * lumFilter[j]; + Y1 += (unsigned)(lumSrc[j][i * 2] * lumFilter[j]); + Y2 += (unsigned)(lumSrc[j][i * 2 + 1] * lumFilter[j]); } for (j = 0; j < chrFilterSize; j++) { - U += chrUSrc[j][i] * chrFilter[j]; - V += chrVSrc[j][i] * chrFilter[j]; + U += (unsigned)(chrUSrc[j][i] * chrFilter[j]); + V += (unsigned)(chrVSrc[j][i] * chrFilter[j]); } Y1 >>= 19; Y2 >>= 19; @@ -913,7 +913,7 @@ yuv2ya16_X_c_template(SwsContext *c, con int A = 0xffff; for (j = 0; j < lumFilterSize; j++) - Y += lumSrc[j][i] * (unsigned)lumFilter[j]; + Y += (unsigned)(lumSrc[j][i] * lumFilter[j]); Y >>= 15; Y += (1<<3) + 0x8000; @@ -922,7 +922,7 @@ yuv2ya16_X_c_template(SwsContext *c, con if (hasAlpha) { A = -0x40000000 + (1<<14); for (j = 0; j < lumFilterSize; j++) - A += alpSrc[j][i] * (unsigned)lumFilter[j]; + A += (unsigned)(alpSrc[j][i] * lumFilter[j]); A >>= 15; A += 0x8000; @@ -1013,20 +1013,20 @@ yuv2rgba64_X_c_template(SwsContext *c, c int R, G, B; for (j = 0; j < lumFilterSize; j++) { - Y1 += lumSrc[j][i * 2] * (unsigned)lumFilter[j]; - Y2 += lumSrc[j][i * 2 + 1] * (unsigned)lumFilter[j]; + Y1 += (unsigned)(lumSrc[j][i * 2] * lumFilter[j]); + Y2 += (unsigned)(lumSrc[j][i * 2 + 1] * lumFilter[j]); } for (j = 0; j < chrFilterSize; j++) {; - U += chrUSrc[j][i] * (unsigned)chrFilter[j]; - V += chrVSrc[j][i] * (unsigned)chrFilter[j]; + U += (unsigned)(chrUSrc[j][i] * chrFilter[j]); + V += (unsigned)(chrVSrc[j][i] * chrFilter[j]); } if (hasAlpha) { A1 = -0x40000000; A2 = -0x40000000; for (j = 0; j < lumFilterSize; j++) { - A1 += alpSrc[j][i * 2] * (unsigned)lumFilter[j]; - A2 += alpSrc[j][i * 2 + 1] * (unsigned)lumFilter[j]; + A1 += (unsigned)(alpSrc[j][i * 2 ] * lumFilter[j]); + A2 += (unsigned)(alpSrc[j][i * 2 + 1] * lumFilter[j]); } A1 >>= 1; A1 += 0x20002000; @@ -1264,17 +1264,17 @@ yuv2rgba64_full_X_c_template(SwsContext int R, G, B; for (j = 0; j < lumFilterSize; j++) { - Y += lumSrc[j][i] * (unsigned)lumFilter[j]; + Y += (unsigned)(lumSrc[j][i] * lumFilter[j]); } for (j = 0; j < chrFilterSize; j++) {; - U += chrUSrc[j][i] * (unsigned)chrFilter[j]; - V += chrVSrc[j][i] * (unsigned)chrFilter[j]; + U += (unsigned)(chrUSrc[j][i] * chrFilter[j]); + V += (unsigned)(chrVSrc[j][i] * chrFilter[j]); } if (hasAlpha) { A = -0x40000000; for (j = 0; j < lumFilterSize; j++) { - A += alpSrc[j][i] * (unsigned)lumFilter[j]; + A += (unsigned)(alpSrc[j][i] * lumFilter[j]); } A >>= 1; A += 0x20002000; @@ -1671,12 +1671,12 @@ yuv2rgb_X_c_template(SwsContext *c, cons const void *r, *g, *b; for (j = 0; j < lumFilterSize; j++) { - Y1 += lumSrc[j][i * 2] * lumFilter[j]; - Y2 += lumSrc[j][i * 2 + 1] * lumFilter[j]; + Y1 += (unsigned)(lumSrc[j][i * 2] * lumFilter[j]); + Y2 += (unsigned)(lumSrc[j][i * 2 + 1] * lumFilter[j]); } for (j = 0; j < chrFilterSize; j++) { - U += chrUSrc[j][i] * chrFilter[j]; - V += chrVSrc[j][i] * chrFilter[j]; + U += (unsigned)(chrUSrc[j][i] * chrFilter[j]); + V += (unsigned)(chrVSrc[j][i] * chrFilter[j]); } Y1 >>= 19; Y2 >>= 19; @@ -1686,8 +1686,8 @@ yuv2rgb_X_c_template(SwsContext *c, cons A1 = 1 << 18; A2 = 1 << 18; for (j = 0; j < lumFilterSize; j++) { - A1 += alpSrc[j][i * 2 ] * lumFilter[j]; - A2 += alpSrc[j][i * 2 + 1] * lumFilter[j]; + A1 += (unsigned)(alpSrc[j][i * 2 ] * lumFilter[j]); + A2 += (unsigned)(alpSrc[j][i * 2 + 1] * lumFilter[j]); } A1 >>= 19; A2 >>= 19; @@ -2021,11 +2021,11 @@ yuv2rgb_full_X_c_template(SwsContext *c, int V = (1<<9)-(128 << 19); for (j = 0; j < lumFilterSize; j++) { - Y += lumSrc[j][i] * lumFilter[j]; + Y += (unsigned)(lumSrc[j][i] * lumFilter[j]); } for (j = 0; j < chrFilterSize; j++) { - U += chrUSrc[j][i] * chrFilter[j]; - V += chrVSrc[j][i] * chrFilter[j]; + U += (unsigned)(chrUSrc[j][i] * chrFilter[j]); + V += (unsigned)(chrVSrc[j][i] * chrFilter[j]); } Y >>= 10; U >>= 10; @@ -2033,7 +2033,7 @@ yuv2rgb_full_X_c_template(SwsContext *c, if (hasAlpha) { A = 1 << 18; for (j = 0; j < lumFilterSize; j++) { - A += alpSrc[j][i] * lumFilter[j]; + A += (unsigned)(alpSrc[j][i] * lumFilter[j]); } A >>= 19; if (A & 0x100) @@ -2196,11 +2196,11 @@ yuv2gbrp_full_X_c(SwsContext *c, const i int R, G, B; for (j = 0; j < lumFilterSize; j++) - Y += lumSrc[j][i] * (unsigned)lumFilter[j]; + Y += (unsigned)(lumSrc[j][i] * lumFilter[j]); for (j = 0; j < chrFilterSize; j++) { - U += chrUSrc[j][i] * chrFilter[j]; - V += chrVSrc[j][i] * chrFilter[j]; + U += (unsigned)(chrUSrc[j][i] * chrFilter[j]); + V += (unsigned)(chrVSrc[j][i] * chrFilter[j]); } Y >>= 10; @@ -2211,7 +2211,7 @@ yuv2gbrp_full_X_c(SwsContext *c, const i A = 1 << 18; for (j = 0; j < lumFilterSize; j++) - A += alpSrc[j][i] * (unsigned)lumFilter[j]; + A += (unsigned)(alpSrc[j][i] * lumFilter[j]); if (A & 0xF8000000) A = av_clip_uintp2(A, 27); @@ -2478,7 +2478,7 @@ yuv2ya8_X_c(SwsContext *c, const int16_t int Y = 1 << 18, A = 1 << 18; for (j = 0; j < lumFilterSize; j++) - Y += lumSrc[j][i] * lumFilter[j]; + Y += (unsigned)(lumSrc[j][i] * lumFilter[j]); Y >>= 19; if (Y & 0x100) @@ -2486,7 +2486,7 @@ yuv2ya8_X_c(SwsContext *c, const int16_t if (hasAlpha) { for (j = 0; j < lumFilterSize; j++) - A += alpSrc[j][i] * lumFilter[j]; + A += (unsigned)(alpSrc[j][i] * lumFilter[j]); A >>= 19; ++++++ ffmpeg-4-CVE-2026-75141.patch ++++++ >From acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781 Mon Sep 17 00:00:00 2001 From: Joshua Rogers <[email protected]> Date: Tue, 4 Aug 2026 12:11:56 +0000 Subject: [PATCH] avformat/hevc: reject hvcC NAL arrays that overflow the 16-bit count numNalus is uint16_t; a crafted hvcC declaring >65535 NAL units of one type wraps it to 0 and then writes nal[-1]. Reject before the count can wrap. Reachable by remuxing a crafted file with -c copy. Fixes: integer overflow Fixes: out of array access --- libavformat/hevc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavformat/hevc.c b/libavformat/hevc.c index 94eb3a9..229024e 100644 --- a/libavformat/hevc.c +++ b/libavformat/hevc.c @@ -685,6 +685,9 @@ static int hvcc_array_add_nal_unit(uint8_t *nal_buf, uint32_t nal_size, array = &hvcc->array[index]; numNalus = array->numNalus; + if (numNalus >= UINT16_MAX) + return AVERROR_INVALIDDATA; + ret = av_reallocp_array(&array->nalUnit, numNalus + 1, sizeof(uint8_t*)); if (ret < 0) return ret;
