From: Bhavesh R Maheshwari <[email protected]> Pick the patch from [1] and [2], mentioned in PR#23783 [3] which is referenced in the NVD report [4]
[1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f0f634b6585fdc7bbb43ab3ae461499bfca9ad2e [2] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c [3] https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783 [4] https://nvd.nist.gov/vuln/detail/cve-2026-66036 Signed-off-by: Bhavesh R Maheshwari <[email protected]> --- .../ffmpeg/ffmpeg/CVE-2026-66036_p1.patch | 120 ++++++++++++++++++ .../ffmpeg/ffmpeg/CVE-2026-66036_p2.patch | 71 +++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 2 + 3 files changed, 193 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p1.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p2.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p1.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p1.patch new file mode 100644 index 0000000000..bce0265114 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p1.patch @@ -0,0 +1,120 @@ +From 7ac88955c4678fc10cc44a786ff9bf724bb12deb Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer <[email protected]> +Date: Sun, 12 Jul 2026 13:05:07 +0200 +Subject: [PATCH 1/2] avfilter/vf_hqdn3d: reject unsupported frame parameter + changes + +Fixes: out of array access +Fixes: 9aj_hqdn3d_dynamic_res.mjpg / 9aj_generate_hqdn3d_dynamic_res_mjpg.py +Fixes: wWDsy2oDvMuR +Found-by: Adrian Junge (vurlo) <[email protected]> + +CVE: CVE-2026-66036 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f0f634b6585fdc7bbb43ab3ae461499bfca9ad2e] + +Signed-off-by: Bhavesh R Maheshwari <[email protected]> +--- + libavfilter/vf_hqdn3d.c | 34 +++++++++++++++++++++++++--------- + libavfilter/vf_hqdn3d.h | 2 ++ + 2 files changed, 27 insertions(+), 9 deletions(-) + +diff --git a/libavfilter/vf_hqdn3d.c b/libavfilter/vf_hqdn3d.c +index 1136931b9b..44fb3574a0 100644 +--- a/libavfilter/vf_hqdn3d.c ++++ b/libavfilter/vf_hqdn3d.c +@@ -165,12 +165,8 @@ static int denoise_depth(HQDN3DContext *s, + case 14: ret = denoise_depth(__VA_ARGS__, 14); break; \ + case 16: ret = denoise_depth(__VA_ARGS__, 16); break; \ + } \ +- if (ret < 0) { \ +- av_frame_free(&out); \ +- if (!direct) \ +- av_frame_free(&in); \ ++ if (ret < 0) \ + return ret; \ +- } \ + } while (0) + + static void precalc_coefs(double dist25, int depth, int16_t *ct) +@@ -283,12 +279,15 @@ static int config_input(AVFilterLink *inlink) + ff_hqdn3d_init_x86(s); + #endif + ++ s->format = inlink->format; ++ s->width = inlink->w; ++ s->height = inlink->h; ++ + return 0; + } + + typedef struct ThreadData { + AVFrame *in, *out; +- int direct; + } ThreadData; + + static int do_denoise(AVFilterContext *ctx, void *data, int job_nr, int n_jobs) +@@ -297,7 +296,6 @@ static int do_denoise(AVFilterContext *ctx, void *data, int job_nr, int n_jobs) + const ThreadData *td = data; + AVFrame *out = td->out; + AVFrame *in = td->in; +- int direct = td->direct; + + denoise(s, in->data[job_nr], out->data[job_nr], + s->line[job_nr], &s->frame_prev[job_nr], +@@ -314,10 +312,21 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) + { + AVFilterContext *ctx = inlink->dst; + AVFilterLink *outlink = ctx->outputs[0]; ++ HQDN3DContext *s = ctx->priv; + + AVFrame *out; + int direct = av_frame_is_writable(in) && !ctx->is_disabled; + ThreadData td; ++ int ret[3]; ++ ++ if (in->format != s->format || ++ in->width != s->width || ++ in->height != s->height) { ++ av_log(ctx, AV_LOG_ERROR, ++ "Frame size or format changed without filter graph reinitialization\n"); ++ av_frame_free(&in); ++ return AVERROR(EINVAL); ++ } + + if (direct) { + out = in; +@@ -333,9 +342,16 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) + + td.in = in; + td.out = out; +- td.direct = direct; + /* one thread per plane */ +- ff_filter_execute(ctx, do_denoise, &td, NULL, 3); ++ ff_filter_execute(ctx, do_denoise, &td, ret, 3); ++ for (int i = 0; i < FF_ARRAY_ELEMS(ret); i++) { ++ if (ret[i] < 0) { ++ av_frame_free(&out); ++ if (!direct) ++ av_frame_free(&in); ++ return ret[i]; ++ } ++ } + + if (ctx->is_disabled) { + av_frame_free(&out); +diff --git a/libavfilter/vf_hqdn3d.h b/libavfilter/vf_hqdn3d.h +index 3279bbcc77..3467f27145 100644 +--- a/libavfilter/vf_hqdn3d.h ++++ b/libavfilter/vf_hqdn3d.h +@@ -36,6 +36,8 @@ typedef struct HQDN3DContext { + double strength[4]; + int hsub, vsub; + int depth; ++ int width, height; ++ enum AVPixelFormat format; + void (*denoise_row[17])(uint8_t *src, uint8_t *dst, uint16_t *line_ant, uint16_t *frame_ant, ptrdiff_t w, int16_t *spatial, int16_t *temporal); + } HQDN3DContext; + +-- +2.53.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p2.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p2.patch new file mode 100644 index 0000000000..e5148e8629 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p2.patch @@ -0,0 +1,71 @@ +From 6e2b4a7713d9fd4ddfc0e2775af9ba6a03e77d55 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer <[email protected]> +Date: Sun, 12 Jul 2026 13:05:33 +0200 +Subject: [PATCH 2/2] avfilter/vf_hqdn3d: support dynamic frame sizes + +CVE: CVE-2026-66036 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c] + +Signed-off-by: Bhavesh R Maheshwari <[email protected]> +--- + libavfilter/avfilter.c | 3 ++- + libavfilter/vf_hqdn3d.c | 21 ++++++++++++++------- + 2 files changed, 16 insertions(+), 8 deletions(-) + +diff --git a/libavfilter/avfilter.c b/libavfilter/avfilter.c +index 5bcf0b4ef7..c039f3a1ff 100644 +--- a/libavfilter/avfilter.c ++++ b/libavfilter/avfilter.c +@@ -1072,7 +1072,8 @@ int ff_filter_frame(AVFilterLink *link, AVFrame *frame) + strcmp(link->dst->filter->name, "idet") && + strcmp(link->dst->filter->name, "null") && + strcmp(link->dst->filter->name, "scale") && +- strcmp(link->dst->filter->name, "libplacebo")) { ++ strcmp(link->dst->filter->name, "libplacebo") && ++ strcmp(link->dst->filter->name, "hqdn3d")) { + av_assert1(frame->format == link->format); + av_assert1(frame->width == link->w); + av_assert1(frame->height == link->h); +diff --git a/libavfilter/vf_hqdn3d.c b/libavfilter/vf_hqdn3d.c +index 44fb3574a0..92163042eb 100644 +--- a/libavfilter/vf_hqdn3d.c ++++ b/libavfilter/vf_hqdn3d.c +@@ -317,21 +317,28 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) + AVFrame *out; + int direct = av_frame_is_writable(in) && !ctx->is_disabled; + ThreadData td; +- int ret[3]; ++ int err, ret[3]; + +- if (in->format != s->format || +- in->width != s->width || +- in->height != s->height) { +- av_log(ctx, AV_LOG_ERROR, +- "Frame size or format changed without filter graph reinitialization\n"); ++ if (in->format != s->format) { + av_frame_free(&in); + return AVERROR(EINVAL); + } + ++ if (in->width != s->width || in->height != s->height) { ++ inlink->w = in->width; ++ inlink->h = in->height; ++ if ((err = config_input(inlink)) < 0) { ++ av_frame_free(&in); ++ return err; ++ } ++ outlink->w = in->width; ++ outlink->h = in->height; ++ } ++ + if (direct) { + out = in; + } else { +- out = ff_get_video_buffer(outlink, outlink->w, outlink->h); ++ out = ff_get_video_buffer(outlink, in->width, in->height); + if (!out) { + av_frame_free(&in); + return AVERROR(ENOMEM); +-- +2.53.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index 48ece24760..42ec15bf81 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -37,6 +37,8 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2026-65705_p1.patch \ file://CVE-2026-65705_p2.patch \ file://CVE-2026-65706.patch \ + file://CVE-2026-66036_p1.patch \ + file://CVE-2026-66036_p2.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" -- 2.43.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246382): https://lists.openembedded.org/g/openembedded-core/message/246382 Mute This Topic: https://lists.openembedded.org/mt/121370954/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
