Hello community,
here is the log from the commit of package ffmpeg2 for openSUSE:Factory checked
in at 2017-09-13 21:37:02
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/ffmpeg2 (Old)
and /work/SRC/openSUSE:Factory/.ffmpeg2.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ffmpeg2"
Wed Sep 13 21:37:02 2017 rev:12 rq:523675 version:2.8.13
Changes:
--------
--- /work/SRC/openSUSE:Factory/ffmpeg2/ffmpeg2.changes 2017-09-07
22:12:17.858725709 +0200
+++ /work/SRC/openSUSE:Factory/.ffmpeg2.new/ffmpeg2.changes 2017-09-13
21:37:14.111943970 +0200
@@ -1,0 +2,8 @@
+Tue Sep 12 11:05:31 UTC 2017 - jeng...@inai.de
+
+- Add patches 0001-avformat-asfdec-Fix-DoS-in-asf_build_simple_index.patch
+ [CVE-2017-14223] [boo#1058019],
+ 0001-avformat-mov-Fix-DoS-in-read_tfra.patch
+ [CVE-2017-14222] [boo#1058020]
+
+-------------------------------------------------------------------
@@ -21,0 +30,2 @@
+ * avutil/pixdesc: av_color_primaries_name NULL deref fixed
+ [CVE-2017-14225] [boo#1058018]
New:
----
0001-avformat-asfdec-Fix-DoS-in-asf_build_simple_index.patch
0001-avformat-mov-Fix-DoS-in-read_tfra.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ ffmpeg2.spec ++++++
--- /var/tmp/diff_new_pack.NWVc6C/_old 2017-09-13 21:37:14.999819046 +0200
+++ /var/tmp/diff_new_pack.NWVc6C/_new 2017-09-13 21:37:14.999819046 +0200
@@ -48,6 +48,8 @@
Patch4: ffmpeg-new-coder-errors.diff
Patch5: ffmpeg-codec-choice.diff
Patch6: 0001-avcodec-exr-Check-tile-positions.patch
+Patch7: 0001-avformat-asfdec-Fix-DoS-in-asf_build_simple_index.patch
+Patch8: 0001-avformat-mov-Fix-DoS-in-read_tfra.patch
BuildRequires: ladspa-devel
BuildRequires: libgsm-devel
BuildRequires: libmp3lame-devel
@@ -273,7 +275,7 @@
%prep
%setup -qn ffmpeg-%version
-%patch -P 1 -P 2 -P 3 -P 4 -P 5 -P 6 -p1
+%patch -P 1 -P 2 -P 3 -P 4 -P 5 -P 6 -P 7 -P 8 -p1
%build
perl -i -pe 's{__TIME__|__DATE__}{"$&"}g' *.c
++++++ 0001-avformat-asfdec-Fix-DoS-in-asf_build_simple_index.patch ++++++
>From b61e5a878c845b8bee1267fdb75c293feb00ae0d Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <mich...@niedermayer.cc>
Date: Tue, 5 Sep 2017 00:16:29 +0200
Subject: [PATCH] avformat/asfdec: Fix DoS in asf_build_simple_index()
Fixes: Missing EOF check in loop
No testcase
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
(cherry picked from commit afc9c683ed9db01edb357bc8c19edad4282b3a97)
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavformat/asfdec_f.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
index f3acbae280..cc648b9a2f 100644
--- a/libavformat/asfdec_f.c
+++ b/libavformat/asfdec_f.c
@@ -1610,6 +1610,11 @@ static int asf_build_simple_index(AVFormatContext *s,
int stream_index)
int64_t pos = s->internal->data_offset + s->packet_size *
(int64_t)pktnum;
int64_t index_pts = FFMAX(av_rescale(itime, i, 10000) -
asf->hdr.preroll, 0);
+ if (avio_feof(s->pb)) {
+ ret = AVERROR_INVALIDDATA;
+ goto end;
+ }
+
if (pos != last_pos) {
av_log(s, AV_LOG_DEBUG, "pktnum:%d, pktct:%d pts:
%"PRId64"\n",
pktnum, pktct, index_pts);
--
2.14.1
++++++ 0001-avformat-mov-Fix-DoS-in-read_tfra.patch ++++++
>From d9cf9f5af82228b588828ae2692acccec588fdac Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <mich...@niedermayer.cc>
Date: Tue, 5 Sep 2017 00:16:29 +0200
Subject: [PATCH] avformat/mov: Fix DoS in read_tfra()
Fixes: Missing EOF check in loop
No testcase
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
(cherry picked from commit 9cb4eb772839c5e1de2855d126bf74ff16d13382)
Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
libavformat/mov.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/libavformat/mov.c b/libavformat/mov.c
index 6b1cee8d6c..90b068f091 100644
--- a/libavformat/mov.c
+++ b/libavformat/mov.c
@@ -5873,6 +5873,13 @@ static int read_tfra(MOVContext *mov, AVIOContext *f)
}
for (i = 0; i < index->item_count; i++) {
int64_t time, offset;
+
+ if (avio_feof(f)) {
+ index->item_count = 0;
+ av_freep(&index->items);
+ return AVERROR_INVALIDDATA;
+ }
+
if (version == 1) {
time = avio_rb64(f);
offset = avio_rb64(f);
--
2.14.1
