From 1a8d3b83df68234dbdf1171181ce238bea28d358 Mon Sep 17 00:00:00 2001 From: Funda Wang Date: Sun, 23 Mar 2025 22:34:07 +0800 Subject: [PATCH] fix CVE-2025-22921 (cherry picked from commit b0eea9db5dcd27f88089ae30ef57eb6fc5ca7f07) --- backport-CVE-2025-22921.patch | 29 +++++++++++++++++++++++++++++ ffmpeg.spec | 6 +++++- 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2025-22921.patch diff --git a/backport-CVE-2025-22921.patch b/backport-CVE-2025-22921.patch new file mode 100644 index 0000000..3a522c8 --- /dev/null +++ b/backport-CVE-2025-22921.patch @@ -0,0 +1,29 @@ +From 7f9c7f9849a2155224711f0ff57ecdac6e4bfb57 Mon Sep 17 00:00:00 2001 +From: James Almer +Date: Wed, 1 Jan 2025 23:58:39 -0300 +Subject: [PATCH] avcodec/jpeg2000dec: clear array length when freeing it + +Fixes NULL pointer dereferences. +Fixes ticket #11393. + +Reviewed-by: Michael Niedermayer +Signed-off-by: James Almer +--- + libavcodec/jpeg2000dec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c +index e5e897a29f..b82d85d5ee 100644 +--- a/libavcodec/jpeg2000dec.c ++++ b/libavcodec/jpeg2000dec.c +@@ -1521,6 +1521,7 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile, + } + } + av_freep(&cblk->lengthinc); ++ cblk->nb_lengthinc = 0; + } + } + // Save state of stream +-- +2.48.1 + diff --git a/ffmpeg.spec b/ffmpeg.spec index 55ef158..3018ef4 100644 --- a/ffmpeg.spec +++ b/ffmpeg.spec @@ -73,7 +73,7 @@ Summary: Digital VCR and streaming server Name: ffmpeg%{?flavor} Version: 7.1 -Release: 4 +Release: 5 License: GPL-3.0-or-later URL: https://ffmpeg.org/ Source0: https://ffmpeg.org/releases/ffmpeg-%{version}.tar.xz @@ -83,6 +83,7 @@ Patch5: fix_libsvgdec_compile_error.patch # https://ffmpeg.org//pipermail/ffmpeg-devel/2024-November/335575.html Patch6: ffmpeg-7.1-build-with-texinfo-7.2.patch Patch7: backport-CVE-2025-0518.patch +Patch8: backport-CVE-2025-22921.patch Requires: %{name}-libs%{?_isa} = %{version}-%{release} %{?_with_cuda:BuildRequires: cuda-minimal-build-%{_cuda_version_rpm} cuda-drivers-devel} %{?_with_libnpp:BuildRequires: pkgconfig(nppc-%{_cuda_version})} @@ -405,6 +406,9 @@ install -pm755 tools/qt-faststart %{buildroot}%{_bindir} %{_libdir}/lib*.so %changelog +* Sun Mar 23 2025 Funda Wang - 7.1-5 +- fix CVE-2025-22991 + * Mon Jan 27 2025 Funda Wang - 7.1-4 - fix CVE-2025-0518 -- Gitee