Hello community,

here is the log from the commit of package ffmpeg-4 for openSUSE:Factory 
checked in at 2019-09-19 15:47:08
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/ffmpeg-4 (Old)
 and      /work/SRC/openSUSE:Factory/.ffmpeg-4.new.7948 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "ffmpeg-4"

Thu Sep 19 15:47:08 2019 rev:19 rq:729720 version:4.2

Changes:
--------
--- /work/SRC/openSUSE:Factory/ffmpeg-4/ffmpeg-4.changes        2019-08-27 
15:23:21.568781279 +0200
+++ /work/SRC/openSUSE:Factory/.ffmpeg-4.new.7948/ffmpeg-4.changes      
2019-09-19 15:47:19.803336154 +0200
@@ -1,0 +2,11 @@
+Tue Sep 10 08:30:36 UTC 2019 - Jan Engelhardt <[email protected]>
+
+- Add 0001-avcodec-h2645_parse-zero-initialize-the-rbsp-buffer.patch
+  [boo#1149839, CVE-2019-15942]
+
+-------------------------------------------------------------------
+Wed Sep  4 12:05:35 UTC 2019 - Ismail Dönmez <[email protected]>
+
+- Make ffmpeg-4.2-dlopen-fdk_aac.patch less verbose
+
+-------------------------------------------------------------------

New:
----
  0001-avcodec-h2645_parse-zero-initialize-the-rbsp-buffer.patch

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ ffmpeg-4.spec ++++++
--- /var/tmp/diff_new_pack.vJ03F2/_old  2019-09-19 15:47:22.199335667 +0200
+++ /var/tmp/diff_new_pack.vJ03F2/_new  2019-09-19 15:47:22.203335666 +0200
@@ -122,6 +122,7 @@
 # https://trac.ffmpeg.org/ticket/7861
 Patch7:         ffmpeg4_swscale_replace_illegal_vector_keyword.patch
 Patch8:         ffmpeg4_swscale_fix_altivec_vsx_recent_gcc.patch
+Patch9:         0001-avcodec-h2645_parse-zero-initialize-the-rbsp-buffer.patch
 BuildRequires:  ladspa-devel
 BuildRequires:  libgsm-devel
 BuildRequires:  libmp3lame-devel

++++++ 0001-avcodec-h2645_parse-zero-initialize-the-rbsp-buffer.patch ++++++
>From af70bfbeadc0c9b9215cf045ff2a6a31e8ac3a71 Mon Sep 17 00:00:00 2001
From: James Almer <[email protected]>
Date: Mon, 26 Aug 2019 00:54:20 -0300
Subject: [PATCH] avcodec/h2645_parse: zero initialize the rbsp buffer

Fixes ticket #8093

Reviewed-by: Andreas Rheinhardt <[email protected]>
Signed-off-by: James Almer <[email protected]>
---
 libavcodec/h2645_parse.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/libavcodec/h2645_parse.c b/libavcodec/h2645_parse.c
index 24658b3dfa..307e8643e6 100644
--- a/libavcodec/h2645_parse.c
+++ b/libavcodec/h2645_parse.c
@@ -345,13 +345,18 @@ static int find_next_start_code(const uint8_t *buf, const 
uint8_t *next_avc)
 
 static void alloc_rbsp_buffer(H2645RBSP *rbsp, unsigned int size, int use_ref)
 {
+    int min_size = size;
+
     if (size > INT_MAX - AV_INPUT_BUFFER_PADDING_SIZE)
         goto fail;
     size += AV_INPUT_BUFFER_PADDING_SIZE;
 
     if (rbsp->rbsp_buffer_alloc_size >= size &&
-        (!rbsp->rbsp_buffer_ref || 
av_buffer_is_writable(rbsp->rbsp_buffer_ref)))
+        (!rbsp->rbsp_buffer_ref || 
av_buffer_is_writable(rbsp->rbsp_buffer_ref))) {
+        av_assert0(rbsp->rbsp_buffer);
+        memset(rbsp->rbsp_buffer + min_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);
         return;
+    }
 
     size = FFMIN(size + size / 16 + 32, INT_MAX);
 
@@ -360,7 +365,7 @@ static void alloc_rbsp_buffer(H2645RBSP *rbsp, unsigned int 
size, int use_ref)
     else
         av_free(rbsp->rbsp_buffer);
 
-    rbsp->rbsp_buffer = av_malloc(size);
+    rbsp->rbsp_buffer = av_mallocz(size);
     if (!rbsp->rbsp_buffer)
         goto fail;
     rbsp->rbsp_buffer_alloc_size = size;
-- 
2.23.0

++++++ ffmpeg-4.2-dlopen-fdk_aac.patch ++++++
--- /var/tmp/diff_new_pack.vJ03F2/_old  2019-09-19 15:47:22.363335634 +0200
+++ /var/tmp/diff_new_pack.vJ03F2/_new  2019-09-19 15:47:22.367335633 +0200
@@ -30,7 +30,7 @@
 ===================================================================
 --- /dev/null
 +++ ffmpeg-4.2/libavcodec/dlopen.h
-@@ -0,0 +1,13 @@
+@@ -0,0 +1,12 @@
 +#ifndef LOCALINC_DLOPEN_H
 +#define LOCALINC_DLOPEN_H
 +#include <dlfcn.h>
@@ -38,7 +38,6 @@
 +#define str(x) #x
 +
 +#define dl_sym(func, args, lib) \
-+      fprintf(stderr, "dlsym " #func "\n"); \
 +      dl_##func = args dlsym(lib, #func); \
 +      if ((err = dlerror())) \
 +              goto error;



Reply via email to