diff mbox series

[scarthgap] ffmpeg: fix CVE-2026-75143

Message ID 20261104095328.2295613-1-Abinivesh.GA@windriver.com
State New
Delegated to: Yoann Congal
Headers show
Series [scarthgap] ffmpeg: fix CVE-2026-75143 | expand

Commit Message

Abinivesh G A Nov. 4, 2026, 9:53 a.m. UTC 
FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST
protocol reader (libavformat/librist.c). librist_read() ignored its size
argument and copied the full payload length into the caller-provided
buffer, overflowing it when the payload exceeds the destination size.

Backport the upstream fix that clamps the copy to the caller buffer size.

Upstream fix:
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602

CVE: CVE-2026-75143

Signed-off-by: Abinivesh G A <Abinivesh.GA@windriver.com>
---
 .../ffmpeg/ffmpeg/CVE-2026-75143.patch        | 32 +++++++++++++++++++
 .../recipes-multimedia/ffmpeg/ffmpeg_6.1.4.bb |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-75143.patch
diff mbox series

Patch

diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-75143.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-75143.patch
new file mode 100644
index 0000000000..418fcf029a
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-75143.patch
@@ -0,0 +1,32 @@ 
+From 1c10bcc2e17255dacb717a25ab3db142ce390602 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <MegaManSec@users.noreply.github.com>
+Date: Tue, 4 Aug 2026 12:11:55 +0000
+Subject: [PATCH] avformat/librist: honor the caller buffer size in
+ librist_read
+
+librist_read() ignored its size argument and copied the full payload_len,
+overflowing a smaller destination (e.g. via the async: wrapper). Clamp the
+copy to the caller-provided buffer size.
+
+Fixes: out of array access
+
+Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602]
+CVE: CVE-2026-75143
+Signed-off-by: Abinivesh G A <Abinivesh.GA@windriver.com>
+---
+ libavformat/librist.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libavformat/librist.c b/libavformat/librist.c
+index 9669d5b5df5a5..3c4b5e3e5b96f 100644
+--- a/libavformat/librist.c
++++ b/libavformat/librist.c
+@@ -226,7 +226,7 @@ static int librist_read(URLContext *h, uint8_t *buf, int size)
+         }
+     }
+ 
+-    size = data_block->payload_len;
++    size = FFMIN(data_block->payload_len, size);
+     memcpy(buf, data_block->payload, size);
+ out_free:
+     rist_receiver_data_block_free2(&data_block);
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.4.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.4.bb
index 849835c849..cae84d044e 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.4.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.4.bb
@@ -32,6 +32,7 @@  SRC_URI = " \
     file://CVE-2024-35369.patch \
     file://CVE-2025-25473.patch \
     file://CVE-2025-22921.patch \
+    file://CVE-2026-75143.patch \
 "
 
 SRC_URI[sha256sum] = "a231e3d5742c44b1cdaebfb98ad7b6200d12763e0b6db9e1e2c5891f2c083a18"