File ffmpeg-CVE-2024-31578.patch of Package ffmpeg.35105

Overview Repositories Revisions Requests Users Attributes Meta

File ffmpeg-CVE-2024-31578.patch of Package ffmpeg.35105

commit 3bb00c0a420c3ce83c6fafee30270d69622ccad7 (20240220_CVE-2024-31578_3bb00c0a420c3ce83c6fafee30270d69622ccad7)
Author: Zhao Zhili <quinkblack@foxmail.com>
Date:   Tue Feb 20 20:08:55 2024 +0800

avutil/hwcontext: Don't assume frames_uninit is reentrant

Fix heap use after free when vulkan_frames_init failed.

Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>

diff -Nura ffmpeg-3.4.2/libavutil/hwcontext.c ffmpeg-3.4.2_new/libavutil/hwcontext.c
--- ffmpeg-3.4.2/libavutil/hwcontext.c	2018-02-12 08:29:06.000000000 +0800
+++ ffmpeg-3.4.2_new/libavutil/hwcontext.c	2024-04-23 01:55:24.173187674 +0800
@@ -352,7 +352,7 @@
     if (ctx->internal->hw_type->frames_init) {
         ret = ctx->internal->hw_type->frames_init(ctx);
         if (ret < 0)
-            goto fail;
+            return ret;
     }
 
     if (ctx->internal->pool_internal && !ctx->pool)
@@ -362,14 +362,10 @@
     if (ctx->initial_pool_size > 0) {
         ret = hwframe_pool_prealloc(ref);
         if (ret < 0)
-            goto fail;
+            return ret;
     }
 
     return 0;
-fail:
-    if (ctx->internal->hw_type->frames_uninit)
-        ctx->internal->hw_type->frames_uninit(ctx);
-    return ret;
 }
 
 int av_hwframe_transfer_get_formats(AVBufferRef *hwframe_ref,

Places

File ffmpeg-CVE-2024-31578.patch of Package ffmpeg.35105

Places