diff mbox series

[wrynose,4/5] ffmpeg: Fix for CVE-2026-66039

Message ID 20260922070209.2770399-4-bhavesh.maheshwari@einfochips.com
State New
Headers show
Series [wrynose,1/5] ffmpeg: Fix for CVE-2026-66036 | expand

Commit Message

Bhavesh Rajesh Maheshwari Sept. 22, 2026, 7:01 a.m. UTC 
From: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>

Pick the patch from [1], also referenced in the NVD report [2].

[1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718
[2] https://nvd.nist.gov/vuln/detail/cve-2026-66039

Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
---
 .../ffmpeg/ffmpeg/CVE-2026-66039.patch        | 38 +++++++++++++++++++
 .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb |  1 +
 2 files changed, 39 insertions(+)
 create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66039.patch
diff mbox series

Patch

diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66039.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66039.patch
new file mode 100644
index 0000000000..2e34923eda
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66039.patch
@@ -0,0 +1,38 @@ 
+From b3562273e37397669fdb3f4ec933e2fa57e28dbd Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michael@niedermayer.cc>
+Date: Mon, 29 Jun 2026 01:16:44 +0200
+Subject: [PATCH] avcodec/mace: reject sample counts that overflow int
+
+Fixes: heap buffer overflow
+Fixes: FmXBI2dbgvgD
+Fixes: 0eea212943544d40f99b05571aa7159d78667154 (Add avcodec_decode_audio4().)
+Found-by: Adrian Junge (vurlo)
+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
+
+CVE: CVE-2026-66039
+Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718]
+
+Signed-off-by: Bhavesh R Maheshwari <bhavesh.maheshwari@einfochips.com>
+---
+ libavcodec/mace.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/libavcodec/mace.c b/libavcodec/mace.c
+index 2aa54fb548..716dd0c00a 100644
+--- a/libavcodec/mace.c
++++ b/libavcodec/mace.c
+@@ -252,7 +252,10 @@ static int mace_decode_frame(AVCodecContext *avctx, AVFrame *frame,
+     }
+ 
+     /* get output buffer */
+-    frame->nb_samples = 3 * (buf_size << (1 - is_mace3)) / channels;
++    int64_t nb_samples = 3 * ((int64_t)buf_size << (1 - is_mace3)) / channels;
++    if (nb_samples > INT_MAX)
++        return AVERROR_INVALIDDATA;
++    frame->nb_samples = nb_samples;
+     if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
+         return ret;
+     samples = (int16_t **)frame->extended_data;
+-- 
+2.53.0
+
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
index cbb436a9a1..3043cf638f 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb
@@ -41,6 +41,7 @@  SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \
            file://CVE-2026-66036_p2.patch \
            file://CVE-2026-66037.patch \
            file://CVE-2026-66038.patch \
+           file://CVE-2026-66039.patch \
            "
 
 SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818"