Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ffmpeg-7 for openSUSE:Factory checked in at 2024-07-28 17:19:40 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ffmpeg-7 (Old) and /work/SRC/openSUSE:Factory/.ffmpeg-7.new.1882 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ffmpeg-7" Sun Jul 28 17:19:40 2024 rev:3 rq:1189880 version:7.0 Changes: -------- --- /work/SRC/openSUSE:Factory/ffmpeg-7/ffmpeg-7.changes 2024-07-04 16:25:25.556225206 +0200 +++ /work/SRC/openSUSE:Factory/.ffmpeg-7.new.1882/ffmpeg-7.changes 2024-07-28 17:20:16.721796059 +0200 @@ -1,0 +2,8 @@ +Tue Jul 5 14:18:52 UTC 2024 - Cliff Zhao <qz...@suse.com> + +- Add ffmpeg-7-CVE-2024-32229.patch: + Backporting a528a54e from upstream, Fix buffer offset for yuv422p + input. + (CVE-2024-32229, bsc#1227277) + +------------------------------------------------------------------- @@ -6 +14 @@ - (CVE-2024-32230 bsc#1227296) + (CVE-2024-32230, bsc#1227296) New: ---- _scmsync.obsinfo build.specials.obscpio ffmpeg-7-CVE-2024-32229.patch BETA DEBUG BEGIN: New: - Add ffmpeg-7-CVE-2024-32229.patch: Backporting a528a54e from upstream, Fix buffer offset for yuv422p BETA DEBUG END: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ffmpeg-7.spec ++++++ --- /var/tmp/diff_new_pack.mctMB7/_old 2024-07-28 17:20:17.593830906 +0200 +++ /var/tmp/diff_new_pack.mctMB7/_new 2024-07-28 17:20:17.597831066 +0200 @@ -91,10 +91,8 @@ Summary: Set of libraries for working with various multimedia formats License: GPL-3.0-or-later Group: Productivity/Multimedia/Video/Editors and Convertors -URL: https://ffmpeg.org/ - -#Freshcode-URL: http://freshcode.club/projects/ffmpeg #Git-Clone: git://source.ffmpeg.org/ffmpeg +URL: https://ffmpeg.org/ Source: https://www.ffmpeg.org/releases/%_name-%version.tar.xz Source2: https://www.ffmpeg.org/releases/%_name-%version.tar.xz.asc Source3: ffmpeg-7-rpmlintrc @@ -113,6 +111,7 @@ Patch91: ffmpeg-dlopen-openh264.patch Patch92: ffmpeg-7-CVE-2024-32228.patch Patch93: ffmpeg-7-CVE-2024-32230.patch +Patch94: ffmpeg-7-CVE-2024-32229.patch BuildRequires: ladspa-devel BuildRequires: libgsm-devel BuildRequires: libmp3lame-devel >= 3.98.3 @@ -825,6 +824,9 @@ Patch5: work-around-abi-break.patch Patch10: ffmpeg-chromium.patch Patch91: ffmpeg-dlopen-openh264.patch +Patch92: ffmpeg-7-CVE-2024-32228.patch +Patch93: ffmpeg-7-CVE-2024-32230.patch +Patch94: ffmpeg-7-CVE-2024-32229.patch BuildRequires: c_compiler Requires: this-is-only-for-build-envs ++++++ _scmsync.obsinfo ++++++ mtime: 1722062716 commit: 99ea9689b9928285bdc91473b710e322c6674d77460c31063bc7209002dfa7e3 url: https://src.opensuse.org/jengelh/ffmpeg-7 revision: master ++++++ ffmpeg-7-CVE-2024-32228.patch ++++++ --- /var/tmp/diff_new_pack.mctMB7/_old 2024-07-28 17:20:17.713835701 +0200 +++ /var/tmp/diff_new_pack.mctMB7/_new 2024-07-28 17:20:17.717835861 +0200 @@ -1,12 +1,11 @@ -From 459648761f5412acdc3317d5bac982ceaa257584 Mon Sep 17 00:00:00 2001 -From: Niklas Haas <g...@haasn.dev> +From 459648761f5412acdc3317d5bac982ceaa257584 +Author: Niklas Haas <g...@haasn.dev> Date: Sat Apr 6 13:11:09 2024 +0200 Subject: avcodec/hevcdec: fix segfault on invalid film grain metadata References: CVE-2024-32228 References: https://bugzilla.opensuse.org/1227277 Upstream: Backport from upstream - Invalid input files may contain film grain metadata which survives ff_h274_film_grain_params_supported() but does not pass av_film_grain_params_select(), leading to a SIGSEGV on hevc_frame_end(). @@ -20,8 +19,8 @@ Fixes: https://trac.ffmpeg.org/ticket/10951 ---- ffmpeg-7.0/libavcodec/hevcdec.c 2024-04-05 07:22:59.000000000 +0800 -+++ ffmpeg-7.0_new/libavcodec/hevcdec.c 2024-07-02 22:48:49.293996651 +0800 +--- ffmpeg-7.0/libavcodec/hevcdec.c ++++ ffmpeg-7.0_new/libavcodec/hevcdec.c @@ -2892,10 +2892,16 @@ !(s->avctx->export_side_data & AV_CODEC_EXPORT_DATA_FILM_GRAIN) && !s->avctx->hwaccel; ++++++ ffmpeg-7-CVE-2024-32229.patch ++++++ >From a528a54ee119dcba47e7c9e30d3a56206fbad416 Mon Sep 17 00:00:00 2001 From: James Almer <jamr...@gmail.com> Date: Thu, 4 Jul 2024 14:55:23 -0300 Subject: [PATCH] avfilter/vf_tiltandshift: fix buffer offset for yuv422p input Fixes ticket #10950. Signed-off-by: James Almer <jamr...@gmail.com> --- libavfilter/vf_tiltandshift.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavfilter/vf_tiltandshift.c b/libavfilter/vf_tiltandshift.c index 85cce84fc3..b49a713339 100644 --- a/libavfilter/vf_tiltandshift.c +++ b/libavfilter/vf_tiltandshift.c @@ -175,14 +175,14 @@ static void copy_column(AVFilterLink *outlink, const uint8_t *src[4]; dst[0] = dst_data[0] + ncol; - dst[1] = dst_data[1] + (ncol >> s->desc->log2_chroma_h); - dst[2] = dst_data[2] + (ncol >> s->desc->log2_chroma_h); + dst[1] = dst_data[1] + (ncol >> s->desc->log2_chroma_w); + dst[2] = dst_data[2] + (ncol >> s->desc->log2_chroma_w); if (!tilt) ncol = 0; src[0] = src_data[0] + ncol; - src[1] = src_data[1] + (ncol >> s->desc->log2_chroma_h); - src[2] = src_data[2] + (ncol >> s->desc->log2_chroma_h); + src[1] = src_data[1] + (ncol >> s->desc->log2_chroma_w); + src[2] = src_data[2] + (ncol >> s->desc->log2_chroma_w); av_image_copy(dst, dst_linesizes, src, src_linesizes, outlink->format, 1, outlink->h); } -- 2.41.0 ++++++ ffmpeg-7-CVE-2024-32230.patch ++++++ --- /var/tmp/diff_new_pack.mctMB7/_old 2024-07-28 17:20:17.745836980 +0200 +++ /var/tmp/diff_new_pack.mctMB7/_new 2024-07-28 17:20:17.745836980 +0200 @@ -1,6 +1,6 @@ -From 96449cfeaeb95fcfd7a2b8d9ccf7719e97471ed1 Mon Sep 17 00:00:00 2001 +From 96449cfeaeb95fcfd7a2b8d9ccf7719e97471ed1 Author: Michael Niedermayer <mich...@niedermayer.cc> -Date: Mon Apr 8 18:38:42 2024 +0200 +Date: Mon Apr 8 18:38:42 2024 +0200 Subject: avcodec/mpegvideo_enc: Fix 1 line and one column images References: CVE-2024-32230 References: https://bugzilla.opensuse.org/1227296 @@ -10,8 +10,8 @@ Fixes: poc21ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> ---- ffmpeg-7.0/libavcodec/mpegvideo_enc.c 2024-04-05 07:22:59.000000000 +0800 -+++ ffmpeg-7.0_new/libavcodec/mpegvideo_enc.c 2024-07-02 23:24:47.410634866 +0800 +--- ffmpeg-7.0/libavcodec/mpegvideo_enc.c ++++ ffmpeg-7.0_new/libavcodec/mpegvideo_enc.c @@ -1198,8 +1198,8 @@ ptrdiff_t dst_stride = i ? s->uvlinesize : s->linesize; int h_shift = i ? s->chroma_x_shift : 0;
