From 600fd22dc4fcfd3d7ce6cced8a7870a74d942661 Mon Sep 17 00:00:00 2001 From: happyworker <208suo@208suo.com> Date: Fri, 12 Jul 2024 16:20:20 +0800 Subject: [PATCH] fix CVE-2022-1475 --- CVE-2022-1475.patch | 29 +++++++++++++++++++++++++++++ ffmpeg.spec | 7 ++++++- 2 files changed, 35 insertions(+), 1 deletion(-) create mode 100644 CVE-2022-1475.patch diff --git a/CVE-2022-1475.patch b/CVE-2022-1475.patch new file mode 100644 index 0000000..25208fb --- /dev/null +++ b/CVE-2022-1475.patch @@ -0,0 +1,29 @@ +From d4dbe14f2559639656e998c0ad4982cc2a53196a Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Fri, 12 Jul 2024 16:14:34 +0800 +Subject: [PATCH] g729_parser:Check channels + +Reference:https://git.videolan.org/?p=ffmpeg.git;a=commit;h=757da974b21833529cc41bdcc9684c29660cdfa8 + +--- + libavcodec/g729_parser.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/libavcodec/g729_parser.c b/libavcodec/g729_parser.c +index fc00235..6b63f46 100644 +--- a/libavcodec/g729_parser.c ++++ b/libavcodec/g729_parser.c +@@ -48,6 +48,10 @@ static int g729_parse(AVCodecParserContext *s1, AVCodecContext *avctx, + av_assert1(avctx->codec_id == AV_CODEC_ID_G729); + /* FIXME: replace this heuristic block_size with more precise estimate */ + s->block_size = (avctx->bit_rate < 8000) ? G729D_6K4_BLOCK_SIZE : G729_8K_BLOCK_SIZE; ++ // channels > 2 is invalid, we pass the packet on unchanged ++ if (avctx->channels > 2) ++ s->block_size = 0; ++ + s->block_size *= avctx->channels; + s->duration = avctx->frame_size; + } +-- +2.27.0 + diff --git a/ffmpeg.spec b/ffmpeg.spec index 701911d..620d5e8 100644 --- a/ffmpeg.spec +++ b/ffmpeg.spec @@ -60,7 +60,7 @@ Summary: Digital VCR and streaming server Name: ffmpeg%{?flavor} Version: 4.2.4 -Release: 14 +Release: 15 License: %{ffmpeg_license} URL: http://ffmpeg.org/ %if 0%{?date} @@ -83,6 +83,8 @@ Patch11: fix-CVE-2023-51793.patch Patch12: fix-CVE-2023-50010.patch Patch13: CVE-2021-38171.patch Patch14: CVE-2021-28429.patch +Patch15: CVE-2022-1475.patch + Requires: %{name}-libs%{?_isa} = %{version}-%{release} %{?_with_cuda:BuildRequires: cuda-minimal-build-%{_cuda_version_rpm} cuda-drivers-devel} %{?_with_libnpp:BuildRequires: pkgconfig(nppc-%{_cuda_version})} @@ -415,6 +417,9 @@ install -pm755 tools/qt-faststart %{buildroot}%{_bindir} %changelog +* Fri Jul 12 2024 happyworker <208suo@208suo.com> - 4.2.4-15 +- Fix CVE-2022-1475 + * Wed Jul 10 2024 happyworker <208suo@208suo.com> - 4.2.4-14 - The automatic compilation function is enabled for access control -- Gitee