]> git.ipfire.org Git - thirdparty/openembedded/openembedded-core.git/commit
ffmpeg: fix for CVE-2022-3965
authorNarpat Mali <narpat.mali@windriver.com>
Wed, 23 Nov 2022 14:21:38 +0000 (14:21 +0000)
committerSteve Sakoman <steve@sakoman.com>
Tue, 29 Nov 2022 16:30:24 +0000 (06:30 -1000)
commit81b75c0331eadc920d27f7115fa9ec99e089bb5a
treee33e061e6f7545980112119f9207d3b3c4a85949
parent4d2eec66fb3979b9676466258a1af5321a68b237
ffmpeg: fix for CVE-2022-3965

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function
smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The
manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely.
The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to
fix this issue. The identifier of this vulnerability is VDB-213544.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-3965

Upstream Fix:
https://github.com/FFmpeg/FFmpeg/commit/13c13109759090b7f7182480d075e13b36ed8edd

Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit b88c96fe8964614978aa25a65dd34fc3c05c664c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
meta/recipes-multimedia/ffmpeg/ffmpeg/0001-avcodec-smcenc-stop-accessing-out-of-bounds-frame.patch [new file with mode: 0644]
meta/recipes-multimedia/ffmpeg/ffmpeg_5.1.2.bb