File ffmpeg-CVE-2023-50010.patch of Package 15.5-ffmpeg-4

Overview Repositories Revisions Requests Users Attributes Meta

File ffmpeg-CVE-2023-50010.patch of Package 15.5-ffmpeg-4 (Revision 344d313ac24174d5cfca3e0352768ed0)

Currently displaying revision 344d313ac24174d5cfca3e0352768ed0 , Show latest

ffmpeg 19:02:56 FFmpeg> # git show e4d2666bdc3dbd177a81bbf428654a5f2fa3787a
commit e4d2666bdc3dbd177a81bbf428654a5f2fa3787a (20231224_CVE-2023-50010_e4d2666bdc3dbd177a81bbf428654a5f2fa3787a)
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Sun Dec 24 20:50:51 2023 +0100

avfilter/vf_gradfun: Do not overread last line
    
    The code works in steps of 2 lines and lacks support for odd height
    Implementing odd height support is better but for now this fixes the
    out of array access
    
    Fixes: out of array access
    Fixes: tickets/10702/poc6ffmpe
    
    Found-by: Zeng Yunxiang
    Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

diff -Nura ffmpeg-4.4/libavfilter/vf_gradfun.c ffmpeg-4.4_new/libavfilter/vf_gradfun.c
--- ffmpeg-4.4/libavfilter/vf_gradfun.c	2021-04-09 05:28:40.000000000 +0800
+++ ffmpeg-4.4_new/libavfilter/vf_gradfun.c	2024-05-07 20:37:25.515158254 +0800
@@ -93,7 +93,7 @@
     for (y = 0; y < r; y++)
         ctx->blur_line(dc, buf + y * bstride, buf + (y - 1) * bstride, src + 2 * y * src_linesize, src_linesize, width / 2);
     for (;;) {
-        if (y < height - r) {
+        if (y + 1 < height - r) {
             int mod = ((y + r) / 2) % r;
             uint16_t *buf0 = buf + mod * bstride;
             uint16_t *buf1 = buf + (mod ? mod - 1 : r - 1) * bstride;

Places

File ffmpeg-CVE-2023-50010.patch of Package 15.5-ffmpeg-4 (Revision 344d313ac24174d5cfca3e0352768ed0)

Places