已开启
Fix CVE-2026-40962 in ffmpeg for openEuler-25.09 #377
jixiang创建于 7月11日
Fix CVE-2026-40962 in ffmpeg for openEuler-25.09 #377
已开启
共 2 个文件变更+57-1
| @@ -0,0 +1,51 @@ | |||
| 1 | +From: FFmpeg upstream contributors | ||
| 2 | +Subject: [PATCH] avformat/mov: use 64bit in CENC subsample bounds checks | ||
| 3 | + | ||
| 4 | +Backport the integer-overflow fix for CENC subsample bounds checks. | ||
| 5 | +This prevents 32-bit addition of clear and protected subsample sizes from | ||
| 6 | +wrapping before comparing against the remaining packet size. | ||
| 7 | + | ||
| 8 | +Fixes: CVE-2026-40962 | ||
| 9 | +Upstream reference: | ||
| 10 | +- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22348 | ||
| 11 | +--- | ||
| 12 | +diff --git a/libavformat/mov.c b/libavformat/mov.c | ||
| 13 | +index a2333ac..fe04e77 100644 | ||
| 14 | +--- a/libavformat/mov.c | ||
| 15 | ++++ b/libavformat/mov.c | ||
| 16 | + static int cenc_scheme_decrypt(MOVContext *c, MOVStreamContext *sc, AVEncryption | ||
| 17 | + } | ||
| 18 | + | ||
| 19 | + for (i = 0; i < sample->subsample_count; i++) { | ||
| 20 | +- if (sample->subsamples[i].bytes_of_clear_data + sample->subsamples[i].bytes_of_protected_data > size) { | ||
| 21 | ++ if (sample->subsamples[i].bytes_of_clear_data + (int64_t)sample->subsamples[i].bytes_of_protected_data > size) { | ||
| 22 | + av_log(c->fc, AV_LOG_ERROR, "subsample size exceeds the packet size left\n"); | ||
| 23 | + return AVERROR_INVALIDDATA; | ||
| 24 | + } | ||
| 25 | + static int cbc1_scheme_decrypt(MOVContext *c, MOVStreamContext *sc, AVEncryption | ||
| 26 | + } | ||
| 27 | + | ||
| 28 | + for (i = 0; i < sample->subsample_count; i++) { | ||
| 29 | +- if (sample->subsamples[i].bytes_of_clear_data + sample->subsamples[i].bytes_of_protected_data > size) { | ||
| 30 | ++ if (sample->subsamples[i].bytes_of_clear_data + (int64_t)sample->subsamples[i].bytes_of_protected_data > size) { | ||
| 31 | + av_log(c->fc, AV_LOG_ERROR, "subsample size exceeds the packet size left\n"); | ||
| 32 | + return AVERROR_INVALIDDATA; | ||
| 33 | + } | ||
| 34 | + static int cens_scheme_decrypt(MOVContext *c, MOVStreamContext *sc, AVEncryption | ||
| 35 | + } | ||
| 36 | + | ||
| 37 | + for (i = 0; i < sample->subsample_count; i++) { | ||
| 38 | +- if (sample->subsamples[i].bytes_of_clear_data + sample->subsamples[i].bytes_of_protected_data > size) { | ||
| 39 | ++ if (sample->subsamples[i].bytes_of_clear_data + (int64_t)sample->subsamples[i].bytes_of_protected_data > size) { | ||
| 40 | + av_log(c->fc, AV_LOG_ERROR, "subsample size exceeds the packet size left\n"); | ||
| 41 | + return AVERROR_INVALIDDATA; | ||
| 42 | + } | ||
| 43 | + static int cbcs_scheme_decrypt(MOVContext *c, MOVStreamContext *sc, AVEncryption | ||
| 44 | + } | ||
| 45 | + | ||
| 46 | + for (i = 0; i < sample->subsample_count; i++) { | ||
| 47 | +- if (sample->subsamples[i].bytes_of_clear_data + sample->subsamples[i].bytes_of_protected_data > size) { | ||
| 48 | ++ if (sample->subsamples[i].bytes_of_clear_data + (int64_t)sample->subsamples[i].bytes_of_protected_data > size) { | ||
| 49 | + av_log(c->fc, AV_LOG_ERROR, "subsample size exceeds the packet size left\n"); | ||
| 50 | + return AVERROR_INVALIDDATA; | ||
| 51 | + } | ||
| @@ -73,7 +73,7 @@ | |||
| 73 | Summary: Digital VCR and streaming server | 73 | Summary: Digital VCR and streaming server |
| 74 | Name: ffmpeg%{?flavor} | 74 | Name: ffmpeg%{?flavor} |
| 75 | Version: 7.1 | 75 | Version: 7.1 |
| 76 | -Release: 9 | 76 | +Release: 10 |
| 77 | License: GPL-3.0-or-later | 77 | License: GPL-3.0-or-later |
| 78 | URL: https://ffmpeg.org/ | 78 | URL: https://ffmpeg.org/ |
| 79 | Source0: https://ffmpeg.org/releases/ffmpeg-%{version}.tar.xz | 79 | Source0: https://ffmpeg.org/releases/ffmpeg-%{version}.tar.xz |
| @@ -89,6 +89,7 @@ Patch10: CVE-2025-25473.patch | |||
| 89 | Patch11: CVE-2024-55069.patch | 89 | Patch11: CVE-2024-55069.patch |
| 90 | Patch12: fix-CVE-2025-22919.patch | 90 | Patch12: fix-CVE-2025-22919.patch |
| 91 | 91 | ||
| 92 | +Patch13: CVE-2026-40962.patch | ||
| 92 | Requires: %{name}-libs%{?_isa} = %{version}-%{release} | 93 | Requires: %{name}-libs%{?_isa} = %{version}-%{release} |
| 93 | %{?_with_cuda:BuildRequires: cuda-minimal-build-%{_cuda_version_rpm} cuda-drivers-devel} | 94 | %{?_with_cuda:BuildRequires: cuda-minimal-build-%{_cuda_version_rpm} cuda-drivers-devel} |
| 94 | %{?_with_libnpp:BuildRequires: pkgconfig(nppc-%{_cuda_version})} | 95 | %{?_with_libnpp:BuildRequires: pkgconfig(nppc-%{_cuda_version})} |
| @@ -411,6 +412,10 @@ install -pm755 tools/qt-faststart %{buildroot}%{_bindir} | |||
| 411 | %{_libdir}/lib*.so | 412 | %{_libdir}/lib*.so |
| 412 | 413 | ||
| 413 | %changelog | 414 | %changelog |
| 415 | +* Sat Jul 11 2026 Ji Xiang <qfmy_250803@qq.com> - 7.1-10 | ||
| 416 | +- fix CVE-2026-40962 | ||
| 417 | + | ||
| 418 | + | ||
| 414 | * Tue Jul 15 2025 happyworker <208suo@208suo.com> - 7.1-9 | 419 | * Tue Jul 15 2025 happyworker <208suo@208suo.com> - 7.1-9 |
| 415 | - fix-CVE-2025-22919 | 420 | - fix-CVE-2025-22919 |
| 416 | 421 | ||