From 729dba35d2a6f5896a1f570678636c102ef062e8 Mon Sep 17 00:00:00 2001 From: yangjinlin01 Date: Fri, 17 Apr 2026 09:38:45 +0800 Subject: [PATCH] [CVE] [upstream] FIX CVE-2026-40962 to #33276 add patch to fix CVE-2026-40962 commit e392fb8c9c3949d975531d2b23c645d2465a7ebc upstream. Project: TC2024080204 Signed-off-by: yangjinlin01 --- 0001-bugfix-CVE-2026-40962.patch | 34 ++++++++++++++++++++++++++++++++ ffmpeg.spec | 7 ++++++- 2 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 0001-bugfix-CVE-2026-40962.patch diff --git a/0001-bugfix-CVE-2026-40962.patch b/0001-bugfix-CVE-2026-40962.patch new file mode 100644 index 0000000..9694be9 --- /dev/null +++ b/0001-bugfix-CVE-2026-40962.patch @@ -0,0 +1,34 @@ +From e392fb8c9c3949d975531d2b23c645d2465a7ebc Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Tue, 24 Feb 2026 03:47:15 +0100 +Subject: [PATCH] avformat/mov: use 64bit in CENC subsample bounds checks + +Found-by: Quang Luong +Found-by: PrymEvol +Signed-off-by: Michael Niedermayer +--- + libavformat/mov.c | 4 ++++---- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/libavformat/mov.c b/libavformat/mov.c +index 311aff7d14..396a559fa4 100644 +--- a/libavformat/mov.c ++++ b/libavformat/mov.c +@@ -8201,7 +8201,7 @@ static int cenc_scheme_decrypt(MOVContext *c, MOVStreamContext *sc, AVEncryption + } + + for (i = 0; i < sample->subsample_count; i++) { +- if (sample->subsamples[i].bytes_of_clear_data + sample->subsamples[i].bytes_of_protected_data > size) { ++ if (sample->subsamples[i].bytes_of_clear_data + (int64_t)sample->subsamples[i].bytes_of_protected_data > size) { + av_log(c->fc, AV_LOG_ERROR, "subsample size exceeds the packet size left\n"); + return AVERROR_INVALIDDATA; + } +@@ -8262,7 +8262,7 @@ static int cbc1_scheme_decrypt(MOVContext *c, MOVStreamContext *sc, AVEncryption + } + + for (i = 0; i < sample->subsample_count; i++) { +- if (sample->subsamples[i].bytes_of_clear_data + sample->subsamples[i].bytes_of_protected_data > size) { ++ if (sample->subsamples[i].bytes_of_clear_data + (int64_t)sample->subsamples[i].bytes_of_protected_data > size) { + av_log(c->fc, AV_LOG_ERROR, "subsample size exceeds the packet size left\n"); + return AVERROR_INVALIDDATA; + } diff --git a/ffmpeg.spec b/ffmpeg.spec index 8a086ef..7088bf6 100644 --- a/ffmpeg.spec +++ b/ffmpeg.spec @@ -1,4 +1,4 @@ -%define anolis_release 1 +%define anolis_release 2 %global av_codec_soversion 62 %global av_device_soversion 62 @@ -19,6 +19,8 @@ Summary: A complete, cross-platform solution to record, convert and strea License: GPL-3.0-or-later URL: https://ffmpeg.org Source0: https://ffmpeg.org/releases/%{name}-%{version}.tar.xz +# https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e392fb8c9c3949d975531d2b23c645d2465a7ebc +Patch0: 0001-bugfix-CVE-2026-40962.patch BuildRequires: lame-devel >= 3.98.3 BuildRequires: libtool @@ -373,6 +375,9 @@ rm -rf %{buildroot}%{_datadir}/%{name}/examples %changelog +* Fri Apr 17 2026 yangjinlin01 - 8.0.1-2 +- Add patch to fix CVE-2026-40962 + * Sat Feb 28 2026 lzq11122 - 8.0.1-1 - Update to 8.0.1 to fix CVE-2025-59732,CVE-2025-59734,CVE-2025-9951,CVE-2025-59729,CVE-2025-59730,CVE-2025-22919,CVE-2025-63757 - Remove patch for new version include -- Gitee