diff mbox series

[meta-multimedia,scarthgap] openh264: patch CVE-2025-27091

Message ID 20251216071840.3180374-1-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-multimedia,scarthgap] openh264: patch CVE-2025-27091 | expand

Commit Message

Ankur Tyagi Dec. 16, 2025, 7:18 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details https://nvd.nist.gov/vuln/detail/CVE-2025-27091

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../openh264/openh264/CVE-2025-27091.patch    | 28 +++++++++++++++++++
 .../openh264/openh264_2.3.1.bb                |  1 +
 2 files changed, 29 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/openh264/openh264/CVE-2025-27091.patch
diff mbox series

Patch

diff --git a/meta-multimedia/recipes-multimedia/openh264/openh264/CVE-2025-27091.patch b/meta-multimedia/recipes-multimedia/openh264/openh264/CVE-2025-27091.patch
new file mode 100644
index 0000000000..fc7ccceec7
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/openh264/openh264/CVE-2025-27091.patch
@@ -0,0 +1,28 @@ 
+From 09672b2fe25ca0ca6537412eb835209b6c7c791b Mon Sep 17 00:00:00 2001
+From: BenzhengZhang <140143892+BenzhengZhang@users.noreply.github.com>
+Date: Thu, 19 Dec 2024 17:12:42 +0800
+Subject: [PATCH] Potential bug fix (#3818)
+
+CVE: CVE-2025-27091
+Upstream-Status: Backport [https://github.com/cisco/openh264/commit/63db555e30986e3a5f07871368dc90ae78c27449]
+(cherry picked from commit 63db555e30986e3a5f07871368dc90ae78c27449)
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ codec/decoder/core/src/decoder.cpp | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/codec/decoder/core/src/decoder.cpp b/codec/decoder/core/src/decoder.cpp
+index dba6711b..c639cf7c 100644
+--- a/codec/decoder/core/src/decoder.cpp
++++ b/codec/decoder/core/src/decoder.cpp
+@@ -848,6 +848,10 @@ int32_t WelsDecodeBs (PWelsDecoderContext pCtx, const uint8_t* kpBsBuf, const in
+             return pCtx->iErrorCode;
+           }
+ 
++          if (pCtx->iErrorCode != ERR_NONE && !(pCtx->iErrorCode & dsDataErrorConcealed)) {
++              return pCtx->iErrorCode;
++          }
++
+           pDstNal += (iDstIdx + 4); //init, increase 4 reserved zero bytes, used to store the next NAL
+           if ((iSrcLength - iSrcConsumed + 4) > (pRawData->pEnd - pDstNal)) {
+             pDstNal = pRawData->pCurPos = pRawData->pHead;
diff --git a/meta-multimedia/recipes-multimedia/openh264/openh264_2.3.1.bb b/meta-multimedia/recipes-multimedia/openh264/openh264_2.3.1.bb
index 6dfd759355..f0fe4f874f 100644
--- a/meta-multimedia/recipes-multimedia/openh264/openh264_2.3.1.bb
+++ b/meta-multimedia/recipes-multimedia/openh264/openh264_2.3.1.bb
@@ -17,6 +17,7 @@  BRANCH = "openh264v${PV}"
 SRC_URI = "git://github.com/cisco/openh264.git;protocol=https;branch=${BRANCH} \
            file://0001-Makefile-Use-cp-options-to-preserve-file-mode.patch \
            file://0002-Makefile-add-possibility-to-disable-NEON-extension.patch \
+           file://CVE-2025-27091.patch \
            "
 
 COMPATIBLE_MACHINE:armv7a = "(.*)"