From: Archana Polampalli <archana.polampa...@windriver.com> AV1 codec parser buffer overflow
Signed-off-by: Archana Polampalli <archana.polampa...@windriver.com> --- .../CVE-2023-44429.patch | 38 +++++++++++++++++++ .../gstreamer1.0-plugins-bad_1.20.7.bb | 1 + 2 files changed, 39 insertions(+) create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-44429.patch diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-44429.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-44429.patch new file mode 100644 index 0000000000..5070d6b865 --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-44429.patch @@ -0,0 +1,38 @@ +From 1db83d3f745332cbda6adf954b2c53a10caa205e Mon Sep 17 00:00:00 2001 +From: Benjamin Gaignard <benjamin.gaign...@collabora.com> +Date: Wed, 4 Oct 2023 11:14:38 +0200 +Subject: [PATCH] codecparsers: av1: Clip max tile rows and cols values + +Clip tile rows and cols to 64 as describe in AV1 specification. + +Fixes ZDI-CAN-22226 / CVE-2023-44429 + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3015 + +Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5634> + +CVE: CVE-2023-44429 + +Upstream-Status: Backport +[https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/1db83d3f745332cbda6adf954b2c53a10caa205e] + +Signed-off-by: Archana Polampalli <archana.polampa...@windriver.com> +--- + gst-libs/gst/codecparsers/gstav1parser.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/gst-libs/gst/codecparsers/gstav1parser.c b/gst-libs/gst/codecparsers/gstav1parser.c +index 7b9378c..68f8a76 100644 +--- a/gst-libs/gst/codecparsers/gstav1parser.c ++++ b/gst-libs/gst/codecparsers/gstav1parser.c +@@ -2219,6 +2219,8 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br, + ((parser->state.mi_cols + 31) >> 5) : ((parser->state.mi_cols + 15) >> 4); + sb_rows = seq_header->use_128x128_superblock ? ((parser->state.mi_rows + + 31) >> 5) : ((parser->state.mi_rows + 15) >> 4); ++ sb_cols = MIN (GST_AV1_MAX_TILE_COLS, sb_cols); ++ sb_rows = MIN (GST_AV1_MAX_TILE_ROWS, sb_rows); + sb_shift = seq_header->use_128x128_superblock ? 5 : 4; + sb_size = sb_shift + 2; + max_tile_width_sb = GST_AV1_MAX_TILE_WIDTH >> sb_size; +-- +2.40.0 diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.7.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.7.bb index fbaabda3f9..504cfce1fd 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.7.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.7.bb @@ -13,6 +13,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad file://CVE-2023-40474.patch \ file://CVE-2023-40475.patch \ file://CVE-2023-40476.patch \ + file://CVE-2023-44429.patch \ " SRC_URI[sha256sum] = "87251beebfd1325e5118cc67774061f6e8971761ca65a9e5957919610080d195" -- 2.40.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#191069): https://lists.openembedded.org/g/openembedded-core/message/191069 Mute This Topic: https://lists.openembedded.org/mt/102747135/21656 Group Owner: openembedded-core+ow...@lists.openembedded.org Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
