Star1
26
代码
代码
Issues14
Pull Requests3
项目讨论
Wiki
分析
Star1
26
已开启
fix CVE-2023-6604 #487
Funda Wang创建于 3 天前
fix CVE-2023-6604 #487
已开启
Funda Wang创建于 3 天前
从fundawang/ffmpegfix-cve-2023-6604-sp424合入到src-openeuler/ffmpegopenEuler-24.03-LTS-SP4
共 2 个文件变更+96-1
ACVE-2023-6604.patch+88-0
@@ -0,0 +1,88 @@
1+From f60c294f6d4450eab500f18c17bd748e981c9493 Mon Sep 17 00:00:00 2001
2+From: Michael Niedermayer <michael@niedermayer.cc>
3+Date: Thu, 11 Jul 2024 18:10:00 +0200
4+Subject: [PATCH] avformat/bintext: Check avio_size() return
5+ 
6+Fixes: CID1604503 Overflowed constant
7+Fixes: CID1604566 Overflowed constant
8+ 
9+Sponsored-by: Sovereign Tech Fund
10+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
11+(cherry picked from commit bf61f811e73dc62d1b53ed4ef6044b4e9e195113)
12+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
13+---
14+ libavformat/bintext.c | 26 ++++++++++++++++++++------
15+ 1 file changed, 20 insertions(+), 6 deletions(-)
16+ 
17+diff --git a/libavformat/bintext.c b/libavformat/bintext.c
18+index b6f14a03e5..a691018080 100644
19+--- a/libavformat/bintext.c
20++++ b/libavformat/bintext.c
21+@@ -92,9 +92,12 @@ static int next_tag_read(AVFormatContext *avctx, uint64_t *fsize)
22+ AVIOContext *pb = avctx->pb;
23+ char buf[36];
24+ int len;
25+- uint64_t start_pos = avio_size(pb) - 256;
26++ int64_t start_pos = avio_size(pb);
27+
28+- avio_seek(pb, start_pos, SEEK_SET);
29++ if (start_pos < 256)
30++ return AVERROR_INVALIDDATA;
31++
32++ avio_seek(pb, start_pos - 256, SEEK_SET);
33+ if (avio_read(pb, buf, sizeof(next_magic)) != sizeof(next_magic))
34+ return -1;
35+ if (memcmp(buf, next_magic, sizeof(next_magic)))
36+@@ -244,7 +247,10 @@ static int xbin_read_header(AVFormatContext *s)
37+ return AVERROR(EIO);
38+
39+ if (pb->seekable & AVIO_SEEKABLE_NORMAL) {
40+- bin->fsize = avio_size(pb) - 9 - st->codecpar->extradata_size;
41++ int64_t fsize = avio_size(pb);
42++ if (fsize < 9 + st->codecpar->extradata_size)
43++ return 0;
44++ bin->fsize = fsize - 9 - st->codecpar->extradata_size;
45+ ff_sauce_read(s, &bin->fsize, NULL, 0);
46+ avio_seek(pb, 9 + st->codecpar->extradata_size, SEEK_SET);
47+ }
48+@@ -284,7 +290,10 @@ static int adf_read_header(AVFormatContext *s)
49+
50+ if (pb->seekable & AVIO_SEEKABLE_NORMAL) {
51+ int got_width = 0;
52+- bin->fsize = avio_size(pb) - 1 - 192 - 4096;
53++ int64_t fsize = avio_size(pb);
54++ if (fsize < 1 + 192 + 4096)
55++ return 0;
56++ bin->fsize = fsize - 1 - 192 - 4096;
57+ st->codecpar->width = 80<<3;
58+ ff_sauce_read(s, &bin->fsize, &got_width, 0);
59+ if (st->codecpar->width < 8)
60+@@ -317,6 +326,7 @@ static int idf_read_header(AVFormatContext *s)
61+ AVIOContext *pb = s->pb;
62+ AVStream *st;
63+ int got_width = 0, ret;
64++ int64_t fsize;
65+
66+ if (!(pb->seekable & AVIO_SEEKABLE_NORMAL))
67+ return AVERROR(EIO);
68+@@ -331,14 +341,18 @@ static int idf_read_header(AVFormatContext *s)
69+ st->codecpar->extradata[0] = 16;
70+ st->codecpar->extradata[1] = BINTEXT_PALETTE|BINTEXT_FONT;
71+
72+- avio_seek(pb, avio_size(pb) - 4096 - 48, SEEK_SET);
73++ fsize = avio_size(pb);
74++ if (fsize < 12 + 4096 + 48)
75++ return AVERROR_INVALIDDATA;
76++ bin->fsize = fsize - 12 - 4096 - 48;
77++
78++ avio_seek(pb, bin->fsize + 12, SEEK_SET);
79+
80+ if (avio_read(pb, st->codecpar->extradata + 2 + 48, 4096) < 0)
81+ return AVERROR(EIO);
82+ if (avio_read(pb, st->codecpar->extradata + 2, 48) < 0)
83+ return AVERROR(EIO);
84+
85+- bin->fsize = avio_size(pb) - 12 - 4096 - 48;
86+ ff_sauce_read(s, &bin->fsize, &got_width, 0);
87+ if (st->codecpar->width < 8)
88+ return AVERROR_INVALIDDATA;
Mffmpeg.spec+8-1
@@ -64,7 +64,7 @@
64Summary: Digital VCR and streaming server64Summary: Digital VCR and streaming server
65Name: ffmpeg%{?flavor}65Name: ffmpeg%{?flavor}
66Version: 6.1.166Version: 6.1.1
67-Release: 4967+Release: 50
68License: GPL-3.0-or-later68License: GPL-3.0-or-later
69URL: http://ffmpeg.org/69URL: http://ffmpeg.org/
70Source0: http://ffmpeg.org/releases/ffmpeg-%{version}.tar.xz70Source0: http://ffmpeg.org/releases/ffmpeg-%{version}.tar.xz
@@ -142,6 +142,7 @@ Patch69: CVE-2026-38346.patch
142Patch70: CVE-2026-38347.patch142Patch70: CVE-2026-38347.patch
143Patch71: CVE-2026-38348.patch143Patch71: CVE-2026-38348.patch
144Patch72: CVE-2026-38349.patch144Patch72: CVE-2026-38349.patch
145+Patch73: CVE-2023-6604.patch
145 146 
146Requires: %{name}-libs%{?_isa} = %{version}-%{release}147Requires: %{name}-libs%{?_isa} = %{version}-%{release}
147%{?_with_cuda:BuildRequires: cuda-minimal-build-%{_cuda_version_rpm} cuda-drivers-devel}148%{?_with_cuda:BuildRequires: cuda-minimal-build-%{_cuda_version_rpm} cuda-drivers-devel}
@@ -475,6 +476,12 @@ install -pm755 tools/qt-faststart %{buildroot}%{_bindir}
475 476 
476 477 
477%changelog478%changelog
479+* Thu Sep 4 2026 Funda Wang <fundawang@yeah.net> - 6.1.1-50
480+- Type: CVE
481+- ID: CVE-2023-6604
482+- SUG: NA
483+- DESC: fix CVE-2023-6604 (XBIN demuxer DoS amplification: arbitrary data demuxed as XBIN without format validation, causing unexpected CPU load and storage consumption)
484+ 
478* Sun Aug 30 2026 Funda Wang <fundawang@yeah.net> - 6.1.1-49485* Sun Aug 30 2026 Funda Wang <fundawang@yeah.net> - 6.1.1-49
479- Type: CVE486- Type: CVE
480- ID: CVE-2026-18393, CVE-2026-38343, CVE-2026-38344, CVE-2026-38346, CVE-2026-38347, CVE-2026-38348, CVE-2026-38349487- ID: CVE-2026-18393, CVE-2026-38343, CVE-2026-38344, CVE-2026-38346, CVE-2026-38347, CVE-2026-38348, CVE-2026-38349