ffmpeg: backport patches to fix 12 CVEs

new file mode 100644
index 0000000..e8baa18
@@ -0,0 +1,39 @@
+From 124eb202e70678539544f6268efc98131f19fa49 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=E5=AD=99=E6=B5=A9=20and=20=E5=BC=A0=E6=B4=AA=E4=BA=AE=28?=
+ =?UTF-8?q?=E6=9C=9B=E5=88=9D=29?= <tony.sh and [email protected]>
+Date: Fri, 25 Aug 2017 01:15:28 +0200
+Subject: [PATCH] avformat/rmdec: Fix DoS due to lack of eof check
+
+Fixes: loop.ivr
+
+Found-by: Xiaohei and Wangchu from Alibaba Security Team
+Signed-off-by: Michael Niedermayer <[email protected]>
+
+CVE: CVE-2017-14054
+Upstream-Status: Backport
+
+Signed-off-by: Chen Qi <[email protected]>
+---
+ libavformat/rmdec.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
+index 178eaea..d6d7d9c 100644
+--- a/libavformat/rmdec.c
++++ b/libavformat/rmdec.c
+@@ -1223,8 +1223,11 @@ static int ivr_read_header(AVFormatContext *s)
+             av_log(s, AV_LOG_DEBUG, "%s = '%s'\n", key, val);
+         } else if (type == 4) {
+             av_log(s, AV_LOG_DEBUG, "%s = '0x", key);
+-            for (j = 0; j < len; j++)
++            for (j = 0; j < len; j++) {
++                if (avio_feof(pb))
++                    return AVERROR_INVALIDDATA;
+                 av_log(s, AV_LOG_DEBUG, "%X", avio_r8(pb));
++            }
+             av_log(s, AV_LOG_DEBUG, "'\n");
+         } else if (len == 4 && type == 3 && !strncmp(key, "StreamCount", tlen)) {
+             nb_streams = value = avio_rb32(pb);
+-- 
+2.1.0
+

new file mode 100644
index 0000000..37d0d1a
@@ -0,0 +1,34 @@
+From 4f05e2e2dc1a89f38cd9f0960a6561083d714f1e Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <[email protected]>
+Date: Fri, 25 Aug 2017 01:15:30 +0200
+Subject: [PATCH] avformat/mvdec: Fix DoS due to lack of eof check
+
+Fixes: loop.mv
+
+Found-by: Xiaohei and Wangchu from Alibaba Security Team
+Signed-off-by: Michael Niedermayer <[email protected]>
+
+CVE: CVE-2017-14055
+Upstream-Status: Backport
+
+Signed-off-by: Chen Qi <[email protected]>
+---
+ libavformat/mvdec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/libavformat/mvdec.c b/libavformat/mvdec.c
+index 0e12c8c..f7aa4cb 100644
+--- a/libavformat/mvdec.c
++++ b/libavformat/mvdec.c
+@@ -342,6 +342,8 @@ static int mv_read_header(AVFormatContext *avctx)
+             uint32_t pos   = avio_rb32(pb);
+             uint32_t asize = avio_rb32(pb);
+             uint32_t vsize = avio_rb32(pb);
++            if (avio_feof(pb))
++                return AVERROR_INVALIDDATA;
+             avio_skip(pb, 8);
+             av_add_index_entry(ast, pos, timestamp, asize, 0, AVINDEX_KEYFRAME);
+             av_add_index_entry(vst, pos + asize, i, vsize, 0, AVINDEX_KEYFRAME);
+-- 
+2.1.0
+

51 lines not on this page · raw message

44 lines not on this page · raw message

94 lines not on this page · raw message

new file mode 100644
index 0000000..34fde0b
@@ -0,0 +1,40 @@
+From 7e80b63ecd259d69d383623e75b318bf2bd491f6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=E5=AD=99=E6=B5=A9=20and=20=E5=BC=A0=E6=B4=AA=E4=BA=AE=28?=
+ =?UTF-8?q?=E6=9C=9B=E5=88=9D=29?= <tony.sh and [email protected]>
+Date: Fri, 25 Aug 2017 01:15:27 +0200
+Subject: [PATCH] avformat/cinedec: Fix DoS due to lack of eof check
+
+Fixes: loop.cine
+
+Found-by: Xiaohei and Wangchu from Alibaba Security Team
+Signed-off-by: Michael Niedermayer <[email protected]>
+
+CVE: CVE-2017-14059
+Upstream-Status: Backport
+
+Signed-off-by: Chen Qi <[email protected]>
+---
+ libavformat/cinedec.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/libavformat/cinedec.c b/libavformat/cinedec.c
+index 763b93b..de34fb9 100644
+--- a/libavformat/cinedec.c
++++ b/libavformat/cinedec.c
+@@ -267,8 +267,12 @@ static int cine_read_header(AVFormatContext *avctx)
+ 
+     /* parse image offsets */
+     avio_seek(pb, offImageOffsets, SEEK_SET);
+-    for (i = 0; i < st->duration; i++)
++    for (i = 0; i < st->duration; i++) {
++        if (avio_feof(pb))
++            return AVERROR_INVALIDDATA;
++
+         av_add_index_entry(st, avio_rl64(pb), i, 0, 0, AVINDEX_KEYFRAME);
++    }
+ 
+     return 0;
+ }
+-- 
+2.1.0
+

new file mode 100644
index 0000000..e1284fa
@@ -0,0 +1,39 @@
+From 9d00fb9d70ee8c0cc7002b89318c5be00f1bbdad Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=E5=AD=99=E6=B5=A9=28=E6=99=93=E9=BB=91=29?=
+ <[email protected]>
+Date: Tue, 29 Aug 2017 23:59:21 +0200
+Subject: [PATCH] avformat/mxfdec: Fix Sign error in mxf_read_primer_pack()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes: 20170829B.mxf
+
+Co-Author: 张洪亮(望初)" <[email protected]>
+Found-by: Xiaohei and Wangchu from Alibaba Security Team
+Signed-off-by: Michael Niedermayer <[email protected]>
+
+CVE: CVE-2017-14169
+Upstream-Status: Backport
+
+Signed-off-by: Chen Qi <[email protected]>
+---
+ libavformat/mxfdec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c
+index 6adb77d..91731a7 100644
+--- a/libavformat/mxfdec.c
++++ b/libavformat/mxfdec.c
+@@ -500,7 +500,7 @@ static int mxf_read_primer_pack(void *arg, AVIOContext *pb, int tag, int size, U
+         avpriv_request_sample(pb, "Primer pack item length %d", item_len);
+         return AVERROR_PATCHWELCOME;
+     }
+-    if (item_num > 65536) {
++    if (item_num > 65536 || item_num < 0) {
+         av_log(mxf->fc, AV_LOG_ERROR, "item_num %d is too large\n", item_num);
+         return AVERROR_INVALIDDATA;
+     }
+-- 
+2.1.0
+

49 lines not on this page · raw message

44 lines not on this page · raw message

new file mode 100644
index 0000000..ee02037
@@ -0,0 +1,40 @@
+From 9cb4eb772839c5e1de2855d126bf74ff16d13382 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <[email protected]>
+Date: Tue, 5 Sep 2017 00:16:29 +0200
+Subject: [PATCH] avformat/mov: Fix DoS in read_tfra()
+
+Fixes: Missing EOF check in loop
+No testcase
+
+Found-by: Xiaohei and Wangchu from Alibaba Security Team
+Signed-off-by: Michael Niedermayer <[email protected]>
+
+CVE: CVE-2017-14222
+Upstream-Status: Backport
+
+Signed-off-by: Chen Qi <[email protected]>
+---
+ libavformat/mov.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/libavformat/mov.c b/libavformat/mov.c
+index 994e9c6..2519707 100644
+--- a/libavformat/mov.c
++++ b/libavformat/mov.c
+@@ -6094,6 +6094,13 @@ static int read_tfra(MOVContext *mov, AVIOContext *f)
+     }
+     for (i = 0; i < index->item_count; i++) {
+         int64_t time, offset;
++
++        if (avio_feof(f)) {
++            index->item_count = 0;
++            av_freep(&index->items);
++            return AVERROR_INVALIDDATA;
++        }
++
+         if (version == 1) {
+             time   = avio_rb64(f);
+             offset = avio_rb64(f);
+-- 
+2.1.0
+

new file mode 100644
index 0000000..d1fef6b
@@ -0,0 +1,38 @@
+From afc9c683ed9db01edb357bc8c19edad4282b3a97 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <[email protected]>
+Date: Tue, 5 Sep 2017 00:16:29 +0200
+Subject: [PATCH] avformat/asfdec: Fix DoS in asf_build_simple_index()
+
+Fixes: Missing EOF check in loop
+No testcase
+
+Found-by: Xiaohei and Wangchu from Alibaba Security Team
+Signed-off-by: Michael Niedermayer <[email protected]>
+
+CVE: CVE-2017-14223
+Upstream-Status: Backport
+
+Signed-off-by: Chen Qi <[email protected]>
+---
+ libavformat/asfdec_f.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/libavformat/asfdec_f.c b/libavformat/asfdec_f.c
+index f3acbae..cc648b9 100644
+--- a/libavformat/asfdec_f.c
++++ b/libavformat/asfdec_f.c
+@@ -1610,6 +1610,11 @@ static int asf_build_simple_index(AVFormatContext *s, int stream_index)
+             int64_t pos       = s->internal->data_offset + s->packet_size * (int64_t)pktnum;
+             int64_t index_pts = FFMAX(av_rescale(itime, i, 10000) - asf->hdr.preroll, 0);
+ 
++            if (avio_feof(s->pb)) {
++                ret = AVERROR_INVALIDDATA;
++                goto end;
++            }
++
+             if (pos != last_pos) {
+                 av_log(s, AV_LOG_DEBUG, "pktnum:%d, pktct:%d  pts: %"PRId64"\n",
+                        pktnum, pktct, index_pts);
+-- 
+2.1.0
+

49 lines not on this page · raw message

index b4de973..c1ebecf 100644
@@ -26,6 +26,18 @@ LIC_FILES_CHKSUM = "file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
 SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \
            file://mips64_cpu_detection.patch \
            file://0001-build-fix-for-mips.patch \
+           file://CVE-2017-14054.patch \
+           file://CVE-2017-14055.patch \
+           file://CVE-2017-14056.patch \
+           file://CVE-2017-14057.patch \
+           file://CVE-2017-14058.patch \
+           file://CVE-2017-14059.patch \
+           file://CVE-2017-14169.patch \
+           file://CVE-2017-14170.patch \
+           file://CVE-2017-14171.patch \
+           file://CVE-2017-14222.patch \
+           file://CVE-2017-14223.patch \
+           file://CVE-2017-14225.patch \
           "
 SRC_URI[md5sum] = "743dc66ebe67180283b92d029f690d0f"
 SRC_URI[sha256sum] = "d2a9002cdc6b533b59728827186c044ad02ba64841f1b7cd6c21779875453a1e"