File ffmpeg-6-CVE-2024-32228.patch of Package ffmpeg-6

Overview Repositories Revisions Requests Users Attributes Meta

File ffmpeg-6-CVE-2024-32228.patch of Package ffmpeg-6 (Revision a77a268a1e4e0db85b18cc2caa800c56)

Currently displaying revision a77a268a1e4e0db85b18cc2caa800c56 , Show latest

From 459648761f5412acdc3317d5bac982ceaa257584 Mon Sep 17 00:00:00 2001
Author: Niklas Haas <git@haasn.dev>
Date: Sat Apr 6 13:11:09 2024 +0200
Subject: avcodec/hevcdec: fix segfault on invalid film grain metadata
References: CVE-2024-32228
References: bsc#1227277
Upstream: Backport from upstream

Invalid input files may contain film grain metadata which survives
ff_h274_film_grain_params_supported() but does not pass
av_film_grain_params_select(), leading to a SIGSEGV on hevc_frame_end().

Fix this by duplicating the av_film_grain_params_select() check at frame
init time.

An alternative solution here would be to defer the incompatibility check
to hevc_frame_end(), but this has the downside of allocating a film
grain buffer even when we already know we can't apply film grain.

Fixes: https://trac.ffmpeg.org/ticket/10951

diff --git a/libavcodec/hevcdec.c b/libavcodec/hevcdec.c
index 727b02f0f4..d3b668af00 100644
--- a/libavcodec/hevcdec.c
+++ b/libavcodec/hevcdec.c
@@ -2893,10 +2893,15 @@ static int hevc_frame_start(HEVCContext *s)
         !(s->avctx->export_side_data & AV_CODEC_EXPORT_DATA_FILM_GRAIN) &&
         !s->avctx->hwaccel;
 
+    ret = set_side_data(s);
+    if (ret < 0)
+        goto fail;
+
     if (s->ref->needs_fg &&
-        s->sei.common.film_grain_characteristics.present &&
-        !ff_h274_film_grain_params_supported(s->sei.common.film_grain_characteristics.model_id,
-                                             s->ref->frame->format)) {
+        ( s->sei.common.film_grain_characteristics.present &&
+          !ff_h274_film_grain_params_supported(s->sei.common.film_grain_characteristics.model_id,
+                                             s->ref->frame->format))
+          || !av_film_grain_params_select(s->ref->frame)) {
         av_log_once(s->avctx, AV_LOG_WARNING, AV_LOG_DEBUG, &s->film_grain_warning_shown,
                     "Unsupported film grain parameters. Ignoring film grain.\n");
         s->ref->needs_fg = 0;
@@ -2910,10 +2915,6 @@ static int hevc_frame_start(HEVCContext *s)
             goto fail;
     }
 
-    ret = set_side_data(s);
-    if (ret < 0)
-        goto fail;
-
     s->frame->pict_type = 3 - s->sh.slice_type;
 
     if (!IS_IRAP(s))
-- 
2.41.0

Places

File ffmpeg-6-CVE-2024-32228.patch of Package ffmpeg-6 (Revision a77a268a1e4e0db85b18cc2caa800c56)

Places