diff --git a/0001-bugfix-for-CVE-2026-8461.patch b/0001-bugfix-for-CVE-2026-8461.patch new file mode 100644 index 0000000000000000000000000000000000000000..1262a5bf9b76e77a02a90cd8ec9ff4fa44a99b0a --- /dev/null +++ b/0001-bugfix-for-CVE-2026-8461.patch @@ -0,0 +1,103 @@ +From ed834bd0a291eca7b7093632a6995f3a27077376 Mon Sep 17 00:00:00 2001 +From: Ori Hollander +Date: Sat, 9 May 2026 00:00:00 +0000 +Subject: [PATCH 1/3] avcodec/magicyuv: reject slice_height misaligned with + chroma vshift + +Fixes: poc_magicyuv.avi +Fixes: out of array access + +Found-by: Ori Hollander of the JFrog Vulnerability Research team +--- + libavcodec/magicyuv.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/libavcodec/magicyuv.c b/libavcodec/magicyuv.c +index 46d474a24b..ea8a4007b6 100644 +--- a/libavcodec/magicyuv.c ++++ b/libavcodec/magicyuv.c +@@ -553,6 +553,13 @@ static int magy_decode_frame(AVCodecContext *avctx, AVFrame *p, + "invalid slice height: %d\n", s->slice_height); + return AVERROR_INVALIDDATA; + } ++ if (s->vshift[1] && (s->slice_height & ((1 << s->vshift[1]) - 1))) { ++ av_log(avctx, AV_LOG_ERROR, ++ "slice_height %d is not aligned to chroma vertical " ++ "subsampling (must be a multiple of %d)\n", ++ s->slice_height, 1 << s->vshift[1]); ++ return AVERROR_INVALIDDATA; ++ } + + bytestream2_skipu(&gb, 4); + +-- +2.52.0 + + +From aa7b8bd2a32d3d24b650649efd5be8bb51d4a43c Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Sat, 9 May 2026 00:00:00 +0000 +Subject: [PATCH 2/3] avcodec/magicyuv: Expand the s->interlaced slice-height + sanity check + +Fixes: poc_magicyuv.avi +Fixes: out of array access + +Found-by: Ori Hollander of the JFrog Vulnerability Research team +--- + libavcodec/magicyuv.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/libavcodec/magicyuv.c b/libavcodec/magicyuv.c +index ea8a4007b6..aaff4df175 100644 +--- a/libavcodec/magicyuv.c ++++ b/libavcodec/magicyuv.c +@@ -570,11 +570,11 @@ static int magy_decode_frame(AVCodecContext *avctx, AVFrame *p, + return AVERROR_INVALIDDATA; + } + ++ if ((s->slice_height >> s->vshift[1]) <= s->interlaced) { ++ av_log(avctx, AV_LOG_ERROR, "impossible slice height\n"); ++ return AVERROR_INVALIDDATA; ++ } + if (s->interlaced) { +- if ((s->slice_height >> s->vshift[1]) < 2) { +- av_log(avctx, AV_LOG_ERROR, "impossible slice height\n"); +- return AVERROR_INVALIDDATA; +- } + if ((avctx->coded_height % s->slice_height) && ((avctx->coded_height % s->slice_height) >> s->vshift[1]) < 2) { + av_log(avctx, AV_LOG_ERROR, "impossible height\n"); + return AVERROR_INVALIDDATA; +-- +2.52.0 + + +From b8f8dac0cf49918c19f5612c9d2bd4461a6efd99 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Tue, 19 May 2026 19:49:42 +0200 +Subject: [PATCH 3/3] avcodec/magicyuv: Fix 1 line MEDIAN slices + +No testcase + +Signed-off-by: Michael Niedermayer +--- + libavcodec/magicyuv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/libavcodec/magicyuv.c b/libavcodec/magicyuv.c +index aaff4df175..04fb6cc147 100644 +--- a/libavcodec/magicyuv.c ++++ b/libavcodec/magicyuv.c +@@ -225,7 +225,8 @@ static int magy_decode_slice10(AVCodecContext *avctx, void *tdata, + s->llviddsp.add_left_pred_int16(dst, dst, max, width, 0); + dst += stride; + } +- lefttop = left = dst[0]; ++ if (1 + interlaced < height) ++ lefttop = left = dst[0]; + for (k = 1 + interlaced; k < height; k++) { + magicyuv_median_pred16(dst, dst - fake_stride, dst, width, &left, &lefttop, max); + lefttop = left = dst[0]; +-- +2.52.0 + diff --git a/0002-bugfix-for-CVE-2026-12706.patch b/0002-bugfix-for-CVE-2026-12706.patch new file mode 100644 index 0000000000000000000000000000000000000000..27da6aa6221c8e7d0fe7ab270dc9dcdf8f2c61aa --- /dev/null +++ b/0002-bugfix-for-CVE-2026-12706.patch @@ -0,0 +1,54 @@ +From 102c590a5f5c38fdbb2368672abda608727874dc Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Fri, 1 May 2026 20:31:57 +0200 +Subject: [PATCH] avcodec/rasc: fix heap use-after-free in decode_move() + +Use a separate scratch buffer (s->mv_scratch) for the type-0 pixel +copy so s->delta and mc are not disturbed for the lifetime of +decode_move(). The new buffer is freed in decode_close(). + +Found-by: Seung Min Shin +Patch based on suggsted fix by Seung Min Shin + +Signed-off-by: Michael Niedermayer +(cherry picked from commit 2f60af465ad78ae4be85e0bbde4067846d80b582) +Signed-off-by: Michael Niedermayer +--- + libavcodec/rasc.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/libavcodec/rasc.c b/libavcodec/rasc.c +index a8e00a41a6..5f956a9b2c 100644 +--- a/libavcodec/rasc.c ++++ b/libavcodec/rasc.c +@@ -51,6 +51,8 @@ typedef struct RASCContext { + GetByteContext gb; + uint8_t *delta; + int delta_size; ++ uint8_t *mv_scratch; ++ unsigned int mv_scratch_size; + uint8_t *cursor; + int cursor_size; + unsigned cursor_w; +@@ -294,10 +296,8 @@ static int decode_move(AVCodecContext *avctx, + b2 -= s->frame2->linesize[0]; + } + } else if (type == 0) { +- uint8_t *buffer; +- +- av_fast_padded_malloc(&s->delta, &s->delta_size, w * h * s->bpp); +- buffer = s->delta; ++ av_fast_padded_malloc(&s->mv_scratch, &s->mv_scratch_size, w * h * s->bpp); ++ uint8_t *buffer = s->mv_scratch; + if (!buffer) + return AVERROR(ENOMEM); + +@@ -772,6 +772,8 @@ static av_cold int decode_close(AVCodecContext *avctx) + s->cursor_size = 0; + av_freep(&s->delta); + s->delta_size = 0; ++ av_freep(&s->mv_scratch); ++ s->mv_scratch_size = 0; + av_frame_free(&s->frame1); + av_frame_free(&s->frame2); + ff_inflate_end(&s->zstream); diff --git a/download b/download new file mode 100644 index 0000000000000000000000000000000000000000..6d43d40a8f1a1460482eff49847ebb603a627931 --- /dev/null +++ b/download @@ -0,0 +1 @@ +b4e86cef7b3333034977ae9df391896d ffmpeg-8.0.1.tar.xz diff --git a/ffmpeg-8.0.1.tar.xz b/ffmpeg-8.0.1.tar.xz deleted file mode 100644 index b7eff8a151fff41ebaea4dd9fabeba9ce3dcf6f4..0000000000000000000000000000000000000000 Binary files a/ffmpeg-8.0.1.tar.xz and /dev/null differ diff --git a/ffmpeg.spec b/ffmpeg.spec index 7088bf68f130d3e512ed0da1541217c95506c045..ed0d120f3076ab2175b987184c5d691b0ddab47b 100644 --- a/ffmpeg.spec +++ b/ffmpeg.spec @@ -1,4 +1,4 @@ -%define anolis_release 2 +%define anolis_release 3 %global av_codec_soversion 62 %global av_device_soversion 62 @@ -22,6 +22,12 @@ Source0: https://ffmpeg.org/releases/%{name}-%{version}.tar.xz # https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e392fb8c9c3949d975531d2b23c645d2465a7ebc Patch0: 0001-bugfix-CVE-2026-40962.patch +# CVE-2026-8461 https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159.patch +Patch0001: 0001-bugfix-for-CVE-2026-8461.patch + +# CVE-2026-12706 https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/102c590a5f5c38fdbb2368672abda608727874dc.patch +Patch0002: 0002-bugfix-for-CVE-2026-12706.patch + BuildRequires: lame-devel >= 3.98.3 BuildRequires: libtool BuildRequires: make @@ -375,6 +381,9 @@ rm -rf %{buildroot}%{_datadir}/%{name}/examples %changelog +* Mon Jul 20 2026 tomcruiseqi - 8.0.1-3 +- Fix CVE-2026-8461,CVE-2026-12706 + * Fri Apr 17 2026 yangjinlin01 - 8.0.1-2 - Add patch to fix CVE-2026-40962