From patchwork Wed Sep 16 12:09:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98416 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44F8AC88E77 for ; Wed, 16 Sep 2026 12:13:07 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13334.1789560785946635924 for ; Wed, 16 Sep 2026 05:13:06 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=glOqY0V4; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=3863; q=dns/txt; s=NAESA-Selector1; t=1789560784; x=1821096784; h=from:to:subject:date:message-id:mime-version: content-transfer-encoding; bh=pY3nH7zdKuSqVDiH00XsD6za1yrrEKsjwwKsTsW3ONY=; b=glOqY0V45jVCB0k80f24oi7XykHobl5R0n1phW5Bf4Aj1gbn5XO4UADn SpgVLDFV17/p0uwlJigmjIlLzI7XHQq8svJqsauExkq58To9CL9Wxvqfh Tj2rfU7598CDyE5qzVivpCI/t1cUKqGWatUSPNxCsnDp3We4uNBJeambJ 3pPeiCmDC8Wkf8GOxP4n6SP4rBK1+RwK5uXGz20OQnrvorO4/9zt4TlR8 xXDnt46sEdfctAsjE1tC6piexYRntmaBRoeTa2qGX3g7oJoPWMQcSa9jK 2RG5HfwkMEO+VO3NcHXP1oE9RhrKWtqixzhKVkyqFcJCjQI4nS52CS7J3 w==; X-CSE-ConnectionGUID: nmW014ubSVGjWCuGUJTAtA== X-CSE-MsgGUID: mCy1Qmm0RV+HgWdT4w8QTQ== X-IronPort-AV: E=Sophos;i="6.27,103,1787032800"; d="scan'208";a="63580008" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 16 Sep 2026 06:13:03 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose,v2][oe-core][PATCH 01/10] ffmpeg: Fix for CVE-2026-64830 Date: Wed, 16 Sep 2026 17:39:24 +0530 Message-ID: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 16 Sep 2026 12:13:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245955 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-64830 Signed-off-by: Bhavesh R Maheshwari --- changes in v2: - this patch does not have any changes, but later patches in this series has some changes or are rebased. Hence created v2 for this patch also. --- .../ffmpeg/ffmpeg/CVE-2026-64830.patch | 65 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 1 + 2 files changed, 66 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64830.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64830.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64830.patch new file mode 100644 index 0000000000..79ed6a45f1 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64830.patch @@ -0,0 +1,65 @@ +From 0ae68ee7e1bc6e2bfde10c78ccc59aa9d99f4d43 Mon Sep 17 00:00:00 2001 +From: Pavel Kohout +Date: Mon, 29 Jun 2026 23:30:41 +0200 +Subject: [PATCH 1/9] avformat/vobsub: reuse subtitle streams and bound the + stream count + +Fixes: heap buffer overflow +Fixes: lqaO5R1BaZGO +Fixes: dbfe61100b (avformat/vobsub: fix several issues.) +Found-by: Pavel Kohout (Aisle Research) +Signed-off-by: Michael Niedermayer + +CVE: CVE-2026-64830 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavformat/mpeg.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/libavformat/mpeg.c b/libavformat/mpeg.c +index a7a2ef7..1ce4bf9 100644 +--- a/libavformat/mpeg.c ++++ b/libavformat/mpeg.c +@@ -841,6 +841,20 @@ static int vobsub_read_header(AVFormatContext *s) + } + + if (!st || st->id != stream_id) { ++ st = NULL; ++ for (i = 0; i < s->nb_streams; i++) { ++ if (s->streams[i]->id == stream_id) { ++ st = s->streams[i]; ++ break; ++ } ++ } ++ } ++ if (!st) { ++ if (s->nb_streams >= FF_ARRAY_ELEMS(vobsub->q)) { ++ av_log(s, AV_LOG_ERROR, "Maximum number of subtitle streams reached\n"); ++ ret = AVERROR_INVALIDDATA; ++ goto end; ++ } + st = avformat_new_stream(s, NULL); + if (!st) { + ret = AVERROR(ENOMEM); +@@ -865,14 +879,14 @@ static int vobsub_read_header(AVFormatContext *s) + timestamp = (hh*3600LL + mm*60LL + ss) * 1000LL + ms + delay; + timestamp = av_rescale_q(timestamp, av_make_q(1, 1000), st->time_base); + +- sub = ff_subtitles_queue_insert(&vobsub->q[s->nb_streams - 1], "", 0, 0); ++ sub = ff_subtitles_queue_insert(&vobsub->q[st->index], "", 0, 0); + if (!sub) { + ret = AVERROR(ENOMEM); + goto end; + } + sub->pos = pos; + sub->pts = timestamp; +- sub->stream_index = s->nb_streams - 1; ++ sub->stream_index = st->index; + + } else if (!strncmp(line, "alt:", 4)) { + const char *p = line + 4; +-- +2.43.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index 8a6eb4eb86..8c1969369b 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -26,6 +26,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://0001-fftools-resources-Fix-double-build-by-disabling-.d-f.patch \ file://0001-ffbuild-commonmak-Consolidate-pattern-rules-for-comp.patch \ file://0002-ffbuild-common.mak-ensure-target-directories-are-cre.patch \ + file://CVE-2026-64830.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" From patchwork Wed Sep 16 12:09:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98418 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C079C88E5C for ; Wed, 16 Sep 2026 12:13:17 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13334.1789560785946635924 for ; Wed, 16 Sep 2026 05:13:08 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=pCm3sl71; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=3000; q=dns/txt; s=NAESA-Selector1; t=1789560786; x=1821096786; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=h2RByESo+A2GajYNmvVS+vKjh/Pun1O2OSrNB9uNPjQ=; b=pCm3sl71DVfrb0+1V7UIAZIEMz2maTpxmI3UYnN/IP6/HR4GZ7LrbrkV ocsv1WC5sUDqtKVmMBkdeY4zwE8uXY/DU8+zvPMAacsvPhfO+9CwWs/53 o5aEzmFxo2d2pnlGcuPfjtkp5eNGxakdQGbjb45f70xAMt5NbCRJO7Ebr kcGuAkM+FXLlRyZdAR/mAtw3ckRNpd8CQ6ehKC5tMyANp2aOIZDfVmB1N /uER+W32U96I3efDkmMHfUvDIV+cq7OBHzplx66HhnKi2mADgROeAQwJR /PlY/QYe5pCPzWtKTCbFe+HyKI+Il2ggO/SjdSEdqRykif+B3it9sTOzk g==; X-CSE-ConnectionGUID: QizNeJujSKuuAYU/9QvkOQ== X-CSE-MsgGUID: h/l6jwVUQUWkzdoMGhm3Xw== X-IronPort-AV: E=Sophos;i="6.27,103,1787032800"; d="scan'208";a="63580012" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 16 Sep 2026 06:13:05 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose,v2][oe-core][PATCH 02/10] ffmpeg: Fix for CVE-2026-64831 Date: Wed, 16 Sep 2026 17:39:25 +0530 Message-ID: <20260916121258.1699611-2-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> References: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 16 Sep 2026 12:13:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245956 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed [2] https://nvd.nist.gov/vuln/detail/CVE-2026-64831 Signed-off-by: Bhavesh R Maheshwari --- changes in v2: - previously CVE_STATUS was set, created new patch with proper fix --- .../ffmpeg/ffmpeg/CVE-2026-64831.patch | 36 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64831.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64831.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64831.patch new file mode 100644 index 0000000000..29218b3608 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64831.patch @@ -0,0 +1,36 @@ +From 60044ad2b2dbd9a728a1471b0e36eed3157a6ad5 Mon Sep 17 00:00:00 2001 +From: Pavel Kohout +Date: Tue, 30 Jun 2026 21:55:49 +0200 +Subject: [PATCH] avcodec/vulkan_hevc: reject too many VPS HRD parameter sets + +Fixes: stack buffer overflow +Fixes: tD7Mj0ST7ND3 +Fixes: 82864c21112157951ce91b4430a9018edd02f5ab (vulkan_hevc: use VK_KHR_video_maintenance2 if available) +Found-by: Pavel Kohout (Aisle Research) +Signed-off-by: Michael Niedermayer + +CVE: CVE-2026-64831 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/92737390dc133daadce47dd7d2ec8ef3d9ebcbed] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavcodec/vulkan_hevc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/libavcodec/vulkan_hevc.c b/libavcodec/vulkan_hevc.c +index 5e15c6b931..34676113a9 100644 +--- a/libavcodec/vulkan_hevc.c ++++ b/libavcodec/vulkan_hevc.c +@@ -875,6 +875,9 @@ static int vk_hevc_end_frame(AVCodecContext *avctx) + vksps_p.vcl_hdr, &vksps_p.ptl, &vksps_p.dpbm, + &vksps_p.pal, vksps_p.str, &vksps_p.ltr); + ++ if (sps->vps->vps_num_hrd_parameters > HEVC_MAX_SUB_LAYERS) ++ return AVERROR_INVALIDDATA; ++ + vkvps_p.sls = vkvps_ps; + set_vps(sps->vps, &vkvps, &vkvps_p.ptl, &vkvps_p.dpbm, + vkvps_p.hdr, vkvps_p.sls); +-- +2.43.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index 8c1969369b..02b9cf65a5 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -27,6 +27,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://0001-ffbuild-commonmak-Consolidate-pattern-rules-for-comp.patch \ file://0002-ffbuild-common.mak-ensure-target-directories-are-cre.patch \ file://CVE-2026-64830.patch \ + file://CVE-2026-64831.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" From patchwork Wed Sep 16 12:09:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98417 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40B72C88E77 for ; Wed, 16 Sep 2026 12:13:17 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13334.1789560785946635924 for ; Wed, 16 Sep 2026 05:13:10 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=IbufvioT; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=3187; q=dns/txt; s=NAESA-Selector1; t=1789560789; x=1821096789; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=f+6bROkHb0h/BlxA6L27znqTG13mfgDBMFLZfgNGuMs=; b=IbufvioTyZWIix2jH9S/7/fpOfLMD0QwFvLhqbFs5oaoHppts4H/IA7L 5pR6cJbcyrfTSs3GTSPoUzHfuLjbko1a6KJeI8qL2ZSspKekeXWkpaXtD Q1jRpOzhPpOOrEnvUUQQef4UMSbfuSUXwBb1Bn96T8ekdsQZh8Xh+2SYe 25eFe7FEAAzqeinTeoMdecMISl8/ev69pep0ClKolArQs5fYVj49/P71n LTMFI8fpwIT91WHcqW4NWij8XpGABN0DP5pmj+hl8dd5aAMARujCy/sr3 xzqSVieTDvzVprVrQD+WmTdIiuykTdKIIOahlV/YwUfIIsM5bevr5b3z2 g==; X-CSE-ConnectionGUID: 0IfROtZzTlKg+pulRLGBLA== X-CSE-MsgGUID: fGaFQ6jVTBGvKZS/d8pjqQ== X-IronPort-AV: E=Sophos;i="6.27,103,1787032800"; d="scan'208";a="63580017" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 16 Sep 2026 06:13:08 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose,v2][oe-core][PATCH 03/10] ffmpeg: Fix for CVE-2026-64832 Date: Wed, 16 Sep 2026 17:39:26 +0530 Message-ID: <20260916121258.1699611-3-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> References: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 16 Sep 2026 12:13:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245957 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-64832 Signed-off-by: Bhavesh R Maheshwari --- changes in v2: - previously CVE_STATUS was set, created new patch with proper fix --- .../ffmpeg/ffmpeg/CVE-2026-64832.patch | 47 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 1 + 2 files changed, 48 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64832.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64832.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64832.patch new file mode 100644 index 0000000000..28d6c0343f --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64832.patch @@ -0,0 +1,47 @@ +From 55645f03fa9dc2e5ef5f79b875950391e920506b Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Tue, 30 Jun 2026 00:24:07 +0200 +Subject: [PATCH] avcodec/nvdec: don't double free the fdd-owned context on the + sep_ref error path + +Fixes: double free +Fixes: rpSz7v3yq2u8 +Fixes: 72982f8cb5dad6252a14226d28128313eed4a5ff (avcodec/nvdec: add support for separate reference frame) +Found-by: Pavel Kohout (Aisle Research) +Signed-off-by: Michael Niedermayer + +CVE: CVE-2026-64832 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavcodec/nvdec.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/libavcodec/nvdec.c b/libavcodec/nvdec.c +index 7c29f25718..787a9d7c28 100644 +--- a/libavcodec/nvdec.c ++++ b/libavcodec/nvdec.c +@@ -628,8 +628,7 @@ int ff_nvdec_start_frame_sep_ref(AVCodecContext *avctx, AVFrame *frame, int has_ + cf->ref_idx_ref = av_refstruct_pool_get(ctx->decoder_pool); + if (!cf->ref_idx_ref) { + av_log(avctx, AV_LOG_ERROR, "No decoder surfaces left\n"); +- ret = AVERROR(ENOMEM); +- goto fail; ++ return AVERROR(ENOMEM); + } + } + cf->ref_idx = *cf->ref_idx_ref; +@@ -639,9 +638,6 @@ int ff_nvdec_start_frame_sep_ref(AVCodecContext *avctx, AVFrame *frame, int has_ + } + + return 0; +-fail: +- nvdec_fdd_priv_free(cf); +- return ret; + } + + int ff_nvdec_end_frame(AVCodecContext *avctx) +-- +2.43.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index 02b9cf65a5..4192b1a5c9 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -28,6 +28,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://0002-ffbuild-common.mak-ensure-target-directories-are-cre.patch \ file://CVE-2026-64830.patch \ file://CVE-2026-64831.patch \ + file://CVE-2026-64832.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" From patchwork Wed Sep 16 12:09:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98421 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5AAB4C982C4 for ; Wed, 16 Sep 2026 12:13:17 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13334.1789560785946635924 for ; Wed, 16 Sep 2026 05:13:12 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=OhgYJBlG; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=2827; q=dns/txt; s=NAESA-Selector1; t=1789560791; x=1821096791; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=QJE4wRst3Tv+8V9j8Dobc2C2q23zUqDlPMlIRNiLlpI=; b=OhgYJBlGPngVD2bpDC3AjPZMcKh42vmJhwvKph3j9/si8TdVPQuEla/q u7vjvntYTh4XEKefUR0WXLOXQo5H5MOBf/7pnhgUYJuJAybrEfw6zPkdN dsbiKr5RQE+lYMekh2Kk83ABhrryuf6RBsx+cQiv9V1izhGUMs7ZGhv3P QRNRutgwNa6pptvybNDrrJK3FY0Rr9zmrL3pxHRfH8pDdJQKV1Tne78qH O+KfS3h/c9ucS4wd8lKDb10Suo6yp2mxPNXMFLGRwJFTJBoXw67ZOQnQd 32z8CpAFnzTw0fcDnWilV88kmen+cfZfk60wi7IhFxbiHR2B0iLKjP/mD Q==; X-CSE-ConnectionGUID: c3wLPcuTRfujEQj5vgAcmg== X-CSE-MsgGUID: W/U5h5HLTvSehSJDHw0Lcg== X-IronPort-AV: E=Sophos;i="6.27,103,1787032800"; d="scan'208";a="63580020" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 16 Sep 2026 06:13:10 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose,v2][oe-core][PATCH 04/10] ffmpeg: Fix for CVE-2026-64833 Date: Wed, 16 Sep 2026 17:39:27 +0530 Message-ID: <20260916121258.1699611-4-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> References: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 16 Sep 2026 12:13:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245958 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-64833 Signed-off-by: Bhavesh R Maheshwari --- changes in v2: - rebased on new CVE fix --- .../ffmpeg/ffmpeg/CVE-2026-64833.patch | 36 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64833.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64833.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64833.patch new file mode 100644 index 0000000000..407ebf0ece --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64833.patch @@ -0,0 +1,36 @@ +From 9d412e4715b17404b5e4c6d9f0d2b5c1a100aa74 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Tue, 30 Jun 2026 00:11:50 +0200 +Subject: [PATCH 2/9] avformat/spdifenc: bound DTS core_size against the packet + size in the HD path + +Fixes: out of array read +Fixes: yBSax492UIB9 +Fixes: 482d98f69b2 (spdifenc: IEC 61937 encapsulation of DTS-HD for HDMI) +Found-by: Pavel Kohout (Aisle Research) +Signed-off-by: Michael Niedermayer + +CVE: CVE-2026-64833 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavformat/spdifenc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libavformat/spdifenc.c b/libavformat/spdifenc.c +index ab3f73d..16eebda 100644 +--- a/libavformat/spdifenc.c ++++ b/libavformat/spdifenc.c +@@ -225,7 +225,7 @@ static int spdif_header_dts4(AVFormatContext *s, AVPacket *pkt, int core_size, + * (dtshd_fallback == 0) */ + ctx->dtshd_skip = 1; + } +- if (ctx->dtshd_skip && core_size) { ++ if (ctx->dtshd_skip && core_size && core_size <= pkt->size) { + pkt_size = core_size; + if (ctx->dtshd_fallback >= 0) + --ctx->dtshd_skip; +-- +2.43.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index 4192b1a5c9..35153b81a9 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -29,6 +29,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2026-64830.patch \ file://CVE-2026-64831.patch \ file://CVE-2026-64832.patch \ + file://CVE-2026-64833.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" From patchwork Wed Sep 16 12:09:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98419 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84C84C982C3 for ; Wed, 16 Sep 2026 12:13:17 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13334.1789560785946635924 for ; Wed, 16 Sep 2026 05:13:14 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=j6hdNRsa; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=2834; q=dns/txt; s=NAESA-Selector1; t=1789560793; x=1821096793; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=hw5fgZe/sFV5aS0VEuFa099h0M2Jvkv+GZJCe1zh4hk=; b=j6hdNRsaD0OOjvlFsuUb4Kt3mMNsloSJHN2axhsGp48lEYS9pAtoH9m7 vZQdOYSUpoP0nILkiDa/1hcIhICRhl28kWLMWyvB5KcGqpAyZmsMvb5qV Zp8REXGbXI1IhASSV0695qxVO9j2dRI//z8+61ptB6hrp2bHtVV+wmHwQ nLzOzwbYuvqs5MWyjUbxWoJ6o/OwbwrAz1AfdaSIseexe68Al3bqtmEGB vXIG5gkvI1UH/K27dvs8E63hUluJ8UeFd+5E2WC34SMGX5fUtsZ1dlOBX B0RBrFZKQdw2BSW4Z82Pp+U2HqLDIWacsI2a/nznUhc4Nx5Jdj/g2EXaS g==; X-CSE-ConnectionGUID: W9ZQUbDFR9qsqWI3RS3ing== X-CSE-MsgGUID: SleASL9fQ+eB1aL2A+QKlw== X-IronPort-AV: E=Sophos;i="6.27,103,1787032800"; d="scan'208";a="63580023" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 16 Sep 2026 06:13:12 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose,v2][oe-core][PATCH 05/10] ffmpeg: Fix for CVE-2026-64834 Date: Wed, 16 Sep 2026 17:39:28 +0530 Message-ID: <20260916121258.1699611-5-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> References: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 16 Sep 2026 12:13:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245959 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-64834 Signed-off-by: Bhavesh R Maheshwari --- changes in v2: - rebased on new CVE fix --- .../ffmpeg/ffmpeg/CVE-2026-64834.patch | 36 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64834.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64834.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64834.patch new file mode 100644 index 0000000000..d4a44d293c --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64834.patch @@ -0,0 +1,36 @@ +From 9ac8fe453e443c3fc07bf85099cc93ca100d302f Mon Sep 17 00:00:00 2001 +From: Pavel Kohout +Date: Tue, 30 Jun 2026 21:55:16 +0200 +Subject: [PATCH 3/9] avformat/rtpdec_asf: reject ASF objects smaller than + their header + +Fixes: infinite loop +Fixes: MzWwJdpZF2Ls +Fixes: c2f3eec445389d67afc8c699ba23915a20cae51c (Implement RTSP-MS/ASF packet parsing.) +Found-by: Pavel Kohout (Aisle Research) +Signed-off-by: Michael Niedermayer + +CVE: CVE-2026-64834 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavformat/rtpdec_asf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/libavformat/rtpdec_asf.c b/libavformat/rtpdec_asf.c +index b3b346f..f7fa69e 100644 +--- a/libavformat/rtpdec_asf.c ++++ b/libavformat/rtpdec_asf.c +@@ -56,6 +56,8 @@ static int rtp_asf_fix_header(uint8_t *buf, int len) + uint64_t chunksize = AV_RL64(p + sizeof(ff_asf_guid)); + int skip = 6 * 8 + 3 * 4 + sizeof(ff_asf_guid) * 2; + if (memcmp(p, ff_asf_file_header, sizeof(ff_asf_guid))) { ++ if (chunksize < sizeof(ff_asf_guid) + 8) ++ return -1; + if (chunksize > end - p) + return -1; + p += chunksize; +-- +2.43.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index 35153b81a9..c00c3f32b7 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -30,6 +30,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2026-64831.patch \ file://CVE-2026-64832.patch \ file://CVE-2026-64833.patch \ + file://CVE-2026-64834.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" From patchwork Wed Sep 16 12:09:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98420 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 982D8C982C5 for ; Wed, 16 Sep 2026 12:13:17 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13334.1789560785946635924 for ; Wed, 16 Sep 2026 05:13:16 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=GrE9c9tC; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=3122; q=dns/txt; s=NAESA-Selector1; t=1789560795; x=1821096795; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=qwY6+tthqFqojtd1Ir3v0R6aMK1OUCzds47TZ4j5q7s=; b=GrE9c9tCtZAfKmoNeIfU7jFXgSrPsktMWU/vURW3KnT/R9rdLq8sukd4 YJ8G5bp0sww1IgUAvJHrt9ZYF0tE5iCkcD2xiufOhYTf8T830Yp0ZbuYT Ja9+7o3IXM8pLU67a1T5innzxJcjv1gcr1mmNnBD1nyyEXj5N7IA6l0+A dyliG03yfczbvHIiaCzSOd2lyrj7R/F0SAKicaKYsfDcZSoe6PBQ1Aw4R lpX9eRUcka+wGa3O38VOAa6VO/LUNnbjsMhls5ICbKmYa4G7isrHQJwiw B8UELkDamcIC1X93fD4INGtKTavxarROo6OLI4qFJ8FrKotbWseMlQzko Q==; X-CSE-ConnectionGUID: QE4TKtiKSrqeUGfBXWH/Sg== X-CSE-MsgGUID: QhUUozJnSJiYpWOzMLazKA== X-IronPort-AV: E=Sophos;i="6.27,103,1787032800"; d="scan'208";a="63580028" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 16 Sep 2026 06:13:14 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose,v2][oe-core][PATCH 06/10] ffmpeg: Fix for CVE-2026-64835 Date: Wed, 16 Sep 2026 17:39:29 +0530 Message-ID: <20260916121258.1699611-6-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> References: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 16 Sep 2026 12:13:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245960 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e [2] https://nvd.nist.gov/vuln/detail/CVE-2026-64835 Signed-off-by: Bhavesh R Maheshwari --- changes in v2: - rebased on new CVE fix --- .../ffmpeg/ffmpeg/CVE-2026-64835.patch | 45 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64835.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64835.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64835.patch new file mode 100644 index 0000000000..735bd1176f --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-64835.patch @@ -0,0 +1,45 @@ +From 99c7dfd80d63bf009a102d3278a9f98b2fe68002 Mon Sep 17 00:00:00 2001 +From: Pavel Kohout +Date: Mon, 29 Jun 2026 23:46:16 +0200 +Subject: [PATCH 4/9] avcodec/adx: sync decoder channel state on NEW_EXTRADATA + +Fixes: out of array access +Fixes: heaNtmHvklpe +Fixes: 92396cee602320c714713ca2d93b53684ad57000 (avformat: add CRI AAX demuxer) +Found-by: Pavel Kohout (Aisle Research) +Signed-off-by: Michael Niedermayer + +CVE: CVE-2026-64835 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavcodec/adxdec.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libavcodec/adxdec.c b/libavcodec/adxdec.c +index 21be6fe..10fd81d 100644 +--- a/libavcodec/adxdec.c ++++ b/libavcodec/adxdec.c +@@ -172,6 +172,7 @@ static int adx_decode_frame(AVCodecContext *avctx, AVFrame *frame, + new_extradata = av_packet_get_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA, + &new_extradata_size); + if (new_extradata && new_extradata_size > 0) { ++ int old_channels = c->channels; + int header_size; + if ((ret = adx_decode_header(avctx, new_extradata, + new_extradata_size, &header_size, +@@ -180,6 +181,10 @@ static int adx_decode_frame(AVCodecContext *avctx, AVFrame *frame, + return AVERROR_INVALIDDATA; + } + ++ c->channels = avctx->ch_layout.nb_channels; ++ c->header_parsed = 1; ++ if (old_channels != c->channels) ++ memset(c->prev, 0, sizeof(c->prev)); + c->eof = 0; + } + +-- +2.43.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index c00c3f32b7..8d3b0dd79e 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -31,6 +31,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2026-64832.patch \ file://CVE-2026-64833.patch \ file://CVE-2026-64834.patch \ + file://CVE-2026-64835.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" From patchwork Wed Sep 16 12:09:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98423 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86DF7C88E77 for ; Wed, 16 Sep 2026 12:13:27 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13334.1789560785946635924 for ; Wed, 16 Sep 2026 05:13:18 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=mRQni9oe; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=3137; q=dns/txt; s=NAESA-Selector1; t=1789560797; x=1821096797; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=93o5dwEyMu3DBrUctgglcpBqqeoGFSvdQ5f8ntigxr8=; b=mRQni9oeqmC8QgZU2PK6exu5Hco4wNW50t2kQp5Ye/WoM5R0M62s2Mnv VZhQOVTYtghnu62XRil5wqhf1iDi/BkkUBTWlCLlPg0YjJmsC6DGsuZVn IdlpFQVuZSXf2UGbHnlzsoAFYo7PPunTRyqQQuBI/Omg4e5YXQ2Y0JqJJ un8IrF7OG8XcW40np5ATEXDLLPHLTvZVBCK3Oi+ALxcehQYbnLnmqGFGy WWHUM/l+BZit1hnXUclmuAyJ27ZTjNqT2O4w7M2ygDiE151ioUtvYJglb UtWK3FaM45tVUOskeCRkiTh/7y03Gr01CzisXjT85puyL8MTqQxtplX3a w==; X-CSE-ConnectionGUID: ExRpxpuVTGeRB9mWG5hUxA== X-CSE-MsgGUID: 6mYC9eIoSdeXZ3/CwFMtag== X-IronPort-AV: E=Sophos;i="6.27,103,1787032800"; d="scan'208";a="63580033" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 16 Sep 2026 06:13:16 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose,v2][oe-core][PATCH 07/10] ffmpeg: Fix for CVE-2026-65703 Date: Wed, 16 Sep 2026 17:39:30 +0530 Message-ID: <20260916121258.1699611-7-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> References: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 16 Sep 2026 12:13:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245961 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c [2] https://nvd.nist.gov/vuln/detail/CVE-2026-65703 Signed-off-by: Bhavesh R Maheshwari --- changes in v2: - rebased on new CVE fix --- .../ffmpeg/ffmpeg/CVE-2026-65703.patch | 47 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 1 + 2 files changed, 48 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65703.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65703.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65703.patch new file mode 100644 index 0000000000..67c319f17e --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65703.patch @@ -0,0 +1,47 @@ +From d15f021e27bd2eb4b7aaeb4cc4f2f49ec3435f48 Mon Sep 17 00:00:00 2001 +From: Cloud-LHY +Date: Fri, 10 Jul 2026 04:07:04 +0200 +Subject: [PATCH 5/9] avcodec/tdsc: unref the reference frame before + reallocating on size change + +Fixes: out of array access +Fixes: tdsc_poc/ffmpeg-tdsc-linesize-report/poc.avi / gen_poc.py +Fixes: tdsc_resize_jpeg_oob.avi / tdsc-resize-stale-linesize-jpeg-oob-generate-poc.py +Fixes: p9xG4xGf9P7H +Fixes: HQL7a1WgTdHZ +Found-by: Cloud-LHY / Clouditera Security, Z.ai Security, NSFOCUS +Found-by: Adrian Junge (vurlo) + +CVE: CVE-2026-65703 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavcodec/tdsc.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/libavcodec/tdsc.c b/libavcodec/tdsc.c +index 8baf8e9..ecd67da 100644 +--- a/libavcodec/tdsc.c ++++ b/libavcodec/tdsc.c +@@ -482,11 +482,15 @@ static int tdsc_parse_tdsf(AVCodecContext *avctx, int number_tiles) + return ret; + init_refframe = 1; + } +- ctx->refframe->width = ctx->width = w; +- ctx->refframe->height = ctx->height = h; ++ ctx->width = w; ++ ctx->height = h; + + /* Allocate the reference frame if not already done or on size change */ + if (init_refframe) { ++ av_frame_unref(ctx->refframe); ++ ctx->refframe->format = avctx->pix_fmt; ++ ctx->refframe->width = w; ++ ctx->refframe->height = h; + ret = av_frame_get_buffer(ctx->refframe, 0); + if (ret < 0) + return ret; +-- +2.43.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index 8d3b0dd79e..8be6b423f7 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -32,6 +32,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2026-64833.patch \ file://CVE-2026-64834.patch \ file://CVE-2026-64835.patch \ + file://CVE-2026-65703.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" From patchwork Wed Sep 16 12:09:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98422 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 96C85C88E5C for ; Wed, 16 Sep 2026 12:13:27 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13334.1789560785946635924 for ; Wed, 16 Sep 2026 05:13:20 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=AYpuKbDN; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=2733; q=dns/txt; s=NAESA-Selector1; t=1789560798; x=1821096798; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=1mScRa7ePnkmWmSIMN5tZXQmQuQaTVgPUX9MavOw7S8=; b=AYpuKbDNzA1ssUjzFw1qHXBk3MjTEv9INGBKUbJz3NTqQd4RbmcX5Qqg GhU3mBKb4CVWLNmFh/jtsVP95bdHz7Nz62q+r3pDJMG6DKjeYkFh0gRCU JE4qCskVEanM0AoJFySIYaDDPjL1tiOhhfQ33EHFyxNTNS2AxGGi9N7LA OLoBDwpcHNdEP/DD4qvSAWGjE35hnMwOAHghZS3y68Fqe4MLpjfVvhwRC +DKhAw7r8TxF8q/015XptfcEXHfMk8XDuIl7g8elYotmvdHuN0jJYdc7N HW1Fcd/1wknLPlIW03SEaeYxZgFwM/1JS7zJ9agTTuqsZMJiHBWbnttnC w==; X-CSE-ConnectionGUID: M3hGnIv+Q5aQTnCV9mbZQg== X-CSE-MsgGUID: Gy9GWlSqQ/+Owekiodi/5Q== X-IronPort-AV: E=Sophos;i="6.27,103,1787032800"; d="scan'208";a="63580036" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 16 Sep 2026 06:13:17 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose,v2][oe-core][PATCH 08/10] ffmpeg: Fix for CVE-2026-65704 Date: Wed, 16 Sep 2026 17:39:31 +0530 Message-ID: <20260916121258.1699611-8-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> References: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 16 Sep 2026 12:13:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245962 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-65704 Signed-off-by: Bhavesh R Maheshwari --- changes in v2: - rebased on new CVE fix --- .../ffmpeg/ffmpeg/CVE-2026-65704.patch | 35 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65704.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65704.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65704.patch new file mode 100644 index 0000000000..223fd03c33 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65704.patch @@ -0,0 +1,35 @@ +From e6f2209a3ab20ef0489395697a1882e97658b5b9 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Fri, 10 Jul 2026 04:07:35 +0200 +Subject: [PATCH 6/9] avformat/ty: don't let the Series2 AC3 trim underflow the + packet size + +Fixes: negative-size-param +Fixes: ty-s2-ac3-negative-size-single-file.ffconcat / create_poc.py +Fixes: g0qeE6KvrjZi +Found-by: Adrian Junge (vurlo) + +CVE: CVE-2026-65704 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c82e56995a1ef40df7] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavformat/ty.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libavformat/ty.c b/libavformat/ty.c +index 596e4cc..1f2b6f8 100644 +--- a/libavformat/ty.c ++++ b/libavformat/ty.c +@@ -577,7 +577,7 @@ static int demux_audio(AVFormatContext *s, TyRecHdr *rec_hdr, AVPacket *pkt) + if (ty->audio_type == TIVO_AUDIO_AC3 && + ty->tivo_series == TIVO_SERIES2) { + if (ty->ac3_pkt_size + pkt->size > AC3_PKT_LENGTH) { +- pkt->size -= 2; ++ pkt->size -= FFMIN(pkt->size, 2); + ty->ac3_pkt_size = 0; + } else { + ty->ac3_pkt_size += pkt->size; +-- +2.43.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index 8be6b423f7..82f4b221b7 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -33,6 +33,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2026-64834.patch \ file://CVE-2026-64835.patch \ file://CVE-2026-65703.patch \ + file://CVE-2026-65704.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" From patchwork Wed Sep 16 12:09:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98425 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AAE7DC982C3 for ; Wed, 16 Sep 2026 12:13:27 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13334.1789560785946635924 for ; Wed, 16 Sep 2026 05:13:21 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=Cyu38Smq; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=7573; q=dns/txt; s=NAESA-Selector1; t=1789560800; x=1821096800; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=iWkSOSITDCwdZjaZla1dq8i031dzdtfY8Xu65JE2MRU=; b=Cyu38SmqFDTpF37Cnn+hNBqSC8QTmeGt8cSSV9pTwSahO3e0Q6nUy025 KgDM9tpUqZxjeBNEo3h6m131D4Kjn+7QpswMtXnhtxCUE/LxUsb9oQtTm 3VRxHDJO6qWY3q/rdcO6njl5G6o4Q78YnpmDg9u0efPhp2S8re6/YFIQw S1LnQ2125lfAE5BTll/nKnpS6YiRFzlSykfiHGHLFGGHfu4GqkwX5GmsE AEQbIrv6hYA4pn44ITIYWEj6znKPmsxJmI9QBCP8jGQuujrh3eTGp2B1p 1M2g7MhPBSsIl2TGAqLw5ZAYjCyWMTtqdE/wPmoRzIEDyzrVKorBxh1gd A==; X-CSE-ConnectionGUID: 0lRzMN2gTcm8/OQo5duYRQ== X-CSE-MsgGUID: +Et3awMkT9mgEKNFSAN2yA== X-IronPort-AV: E=Sophos;i="6.27,103,1787032800"; d="scan'208";a="63580045" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 16 Sep 2026 06:13:19 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose,v2][oe-core][PATCH 09/10] ffmpeg: Fix for CVE-2026-65705 Date: Wed, 16 Sep 2026 17:39:32 +0530 Message-ID: <20260916121258.1699611-9-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> References: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 16 Sep 2026 12:13:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245963 From: Bhavesh R Maheshwari Pick the patch from [1] and [2], mentioned in PR#23780 [3] which is referenced in the NVD report [4] [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/24c322fdb232d0a3f3790d544dcb64e5c2138e79 [2] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c [3] https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23780 [4] https://nvd.nist.gov/vuln/detail/cve-2026-65705 Signed-off-by: Bhavesh R Maheshwari --- changes in v2: - rebased on new CVE fix --- .../ffmpeg/ffmpeg/CVE-2026-65705_p1.patch | 68 +++++++++++ .../ffmpeg/ffmpeg/CVE-2026-65705_p2.patch | 115 ++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 2 + 3 files changed, 185 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65705_p1.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65705_p2.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65705_p1.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65705_p1.patch new file mode 100644 index 0000000000..e331cb9646 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65705_p1.patch @@ -0,0 +1,68 @@ +From f73f6cd9a5f230ce02afbc6a74172400b92b1127 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Sat, 11 Jul 2026 16:47:28 +0200 +Subject: [PATCH 7/9] avfilter/vf_floodfill: size the point stack for the + current frame + +Fixes: out of array access +Fixes: 8aj_floodfill_dynamic_size.pgm / 8aj_generate_floodfill_dynamic_size_pgm.py +Fixes: 3MleMXjGZvu3 +Found-by: Adrian Junge (vurlo) + +CVE: CVE-2026-65705 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/24c322fdb232d0a3f3790d544dcb64e5c2138e79] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavfilter/vf_floodfill.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/libavfilter/vf_floodfill.c b/libavfilter/vf_floodfill.c +index 6d89963..e569d5f 100644 +--- a/libavfilter/vf_floodfill.c ++++ b/libavfilter/vf_floodfill.c +@@ -41,6 +41,7 @@ typedef struct FloodfillContext { + int nb_planes; + int back, front; + Points *points; ++ unsigned int points_size; + + int (*is_same)(const AVFrame *frame, int x, int y, + unsigned s0, unsigned s1, unsigned s2, unsigned s3); +@@ -271,9 +272,6 @@ static int config_input(AVFilterLink *inlink) + } + + s->front = s->back = 0; +- s->points = av_calloc(inlink->w * inlink->h, 4 * sizeof(Points)); +- if (!s->points) +- return AVERROR(ENOMEM); + + return 0; + } +@@ -292,8 +290,23 @@ static int filter_frame(AVFilterLink *link, AVFrame *frame) + int s3 = s->s[3]; + const int w = frame->width; + const int h = frame->height; ++ size_t nb_points, points_size; + int i, ret; + ++ if (w > UINT16_MAX + 1 || h > UINT16_MAX + 1 || ++ av_size_mult(w, h, &nb_points) < 0 || ++ av_size_mult(nb_points, 4 * sizeof(*s->points), &points_size) < 0) { ++ av_frame_free(&frame); ++ return AVERROR(EINVAL); ++ } ++ ++ av_fast_malloc(&s->points, &s->points_size, points_size); ++ if (!s->points) { ++ av_frame_free(&frame); ++ return AVERROR(ENOMEM); ++ } ++ s->front = s->back = 0; ++ + if (is_inside(s->x, s->y, w, h)) { + s->pick_pixel(frame, s->x, s->y, &s0, &s1, &s2, &s3); + +-- +2.43.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65705_p2.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65705_p2.patch new file mode 100644 index 0000000000..91a304015f --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65705_p2.patch @@ -0,0 +1,115 @@ +From 7f99588c7fc27526a2d73dddc91e4cd57a3b401c Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Sun, 12 Jul 2026 03:27:47 +0200 +Subject: [PATCH 8/9] avfilter/vf_floodfill: remove unneeded variables + +Signed-off-by: Michael Niedermayer + +CVE: CVE-2026-65705 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a29059cb22ca3f2d59201c] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavfilter/vf_floodfill.c | 35 ++++++++++++++++------------------- + 1 file changed, 16 insertions(+), 19 deletions(-) + +diff --git a/libavfilter/vf_floodfill.c b/libavfilter/vf_floodfill.c +index e569d5f..9bc72e2 100644 +--- a/libavfilter/vf_floodfill.c ++++ b/libavfilter/vf_floodfill.c +@@ -39,7 +39,6 @@ typedef struct FloodfillContext { + int d[4]; + + int nb_planes; +- int back, front; + Points *points; + unsigned int points_size; + +@@ -271,8 +270,6 @@ static int config_input(AVFilterLink *inlink) + } + } + +- s->front = s->back = 0; +- + return 0; + } + +@@ -292,6 +289,7 @@ static int filter_frame(AVFilterLink *link, AVFrame *frame) + const int h = frame->height; + size_t nb_points, points_size; + int i, ret; ++ int front = 0; + + if (w > UINT16_MAX + 1 || h > UINT16_MAX + 1 || + av_size_mult(w, h, &nb_points) < 0 || +@@ -305,7 +303,6 @@ static int filter_frame(AVFilterLink *link, AVFrame *frame) + av_frame_free(&frame); + return AVERROR(ENOMEM); + } +- s->front = s->back = 0; + + if (is_inside(s->x, s->y, w, h)) { + s->pick_pixel(frame, s->x, s->y, &s0, &s1, &s2, &s3); +@@ -323,9 +320,9 @@ static int filter_frame(AVFilterLink *link, AVFrame *frame) + goto end; + + if (s->is_same(frame, s->x, s->y, s0, s1, s2, s3)) { +- s->points[s->front].x = s->x; +- s->points[s->front].y = s->y; +- s->front++; ++ s->points[front].x = s->x; ++ s->points[front].y = s->y; ++ front++; + } + + if (ret = ff_inlink_make_frame_writable(link, &frame)) { +@@ -333,34 +330,34 @@ static int filter_frame(AVFilterLink *link, AVFrame *frame) + return ret; + } + +- while (s->front > s->back) { ++ while (front > 0) { + int x, y; + +- s->front--; +- x = s->points[s->front].x; +- y = s->points[s->front].y; ++ front--; ++ x = s->points[front].x; ++ y = s->points[front].y; + + if (s->is_same(frame, x, y, s0, s1, s2, s3)) { + s->set_pixel(frame, x, y, d0, d1, d2, d3); + + if (is_inside(x + 1, y, w, h)) { +- s->points[s->front] .x = x + 1; +- s->points[s->front++].y = y; ++ s->points[front] .x = x + 1; ++ s->points[front++].y = y; + } + + if (is_inside(x - 1, y, w, h)) { +- s->points[s->front] .x = x - 1; +- s->points[s->front++].y = y; ++ s->points[front] .x = x - 1; ++ s->points[front++].y = y; + } + + if (is_inside(x, y + 1, w, h)) { +- s->points[s->front] .x = x; +- s->points[s->front++].y = y + 1; ++ s->points[front] .x = x; ++ s->points[front++].y = y + 1; + } + + if (is_inside(x, y - 1, w, h)) { +- s->points[s->front] .x = x; +- s->points[s->front++].y = y - 1; ++ s->points[front] .x = x; ++ s->points[front++].y = y - 1; + } + } + } +-- +2.43.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index 82f4b221b7..e39961c649 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -34,6 +34,8 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2026-64835.patch \ file://CVE-2026-65703.patch \ file://CVE-2026-65704.patch \ + file://CVE-2026-65705_p1.patch \ + file://CVE-2026-65705_p2.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" From patchwork Wed Sep 16 12:09:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98424 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B870FC982C4 for ; Wed, 16 Sep 2026 12:13:27 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.13334.1789560785946635924 for ; Wed, 16 Sep 2026 05:13:23 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=YbeVW98D; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=3287; q=dns/txt; s=NAESA-Selector1; t=1789560802; x=1821096802; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=moVZQwlcPtvFknR2SZnaTgJR/nMj2T31Xh2nF4OEjN0=; b=YbeVW98DmKEldVEtxS1HzsTdCQlondy7n7JkYhZySHI7BKv6500BlUKW J3z+47f2YHbgvq1OVadwCUdmgsZm9yGiApc/l5FcSKD9BOf9rLxZUq9Dj WuAWlKkecLyToipglavKvp2fhZ/g1FO27Om8HFdoDf/7KQUicdtlY8dZp Z9VdrWIKHlHiBL6a5ZRTB3KGymqipoH/EquZBepp8KnCyRsL9KuM/tYi2 HS5ciW2P3/JLw5vqAlB1pOSCfmIj2ju03UcYPi5QEe/207iEOv5ZbCIui F+S5uEuXFHwq4qU2bcyHnTRFOYcRrOyVgjXKp9cIrTb6Q/TOTiEs4AsSm Q==; X-CSE-ConnectionGUID: YGNv7KunRwmfDTiZhTeYwQ== X-CSE-MsgGUID: 66jAAk6pS6SgOfJBfP6z7Q== X-IronPort-AV: E=Sophos;i="6.27,103,1787032800"; d="scan'208";a="63580047" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 16 Sep 2026 06:13:21 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose,v2][oe-core][PATCH 10/10] ffmpeg: Fix for CVE-2026-65706 Date: Wed, 16 Sep 2026 17:39:33 +0530 Message-ID: <20260916121258.1699611-10-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> References: <20260916121258.1699611-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 16 Sep 2026 12:13:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245964 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-65706 Signed-off-by: Bhavesh R Maheshwari --- changes in v2: - rebased on new CVE fix --- .../ffmpeg/ffmpeg/CVE-2026-65706.patch | 52 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65706.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65706.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65706.patch new file mode 100644 index 0000000000..7311ed71c0 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-65706.patch @@ -0,0 +1,52 @@ +From 825f9e837f88c0c6983b5ccb70f91a32e9168f3c Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Sat, 11 Jul 2026 16:46:39 +0200 +Subject: [PATCH 9/9] avfilter/vf_swaprect: size the temp row buffer for the + widest plane + +Fixes: out of array access +Fixes: 7aj_swaprect_odd17_nv12.nut / 7aj_generate_swaprect_odd17_nv12.py +Fixes: VRAXYvKtmKa8 +Found-by: Adrian Junge (vurlo) + +CVE: CVE-2026-65706 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371bbf04b39907d7a527] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavfilter/vf_swaprect.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/libavfilter/vf_swaprect.c b/libavfilter/vf_swaprect.c +index 5d93f51..fe007ee 100644 +--- a/libavfilter/vf_swaprect.c ++++ b/libavfilter/vf_swaprect.c +@@ -200,6 +200,7 @@ static int config_input(AVFilterLink *inlink) + { + AVFilterContext *ctx = inlink->dst; + SwapRectContext *s = ctx->priv; ++ int size = 0; + + if (!s->w || !s->h || + !s->x1 || !s->y1 || +@@ -210,7 +211,16 @@ static int config_input(AVFilterLink *inlink) + av_image_fill_max_pixsteps(s->pixsteps, NULL, s->desc); + s->nb_planes = av_pix_fmt_count_planes(inlink->format); + +- s->temp = av_malloc_array(inlink->w, s->pixsteps[0]); ++ for (int p = 0; p < s->nb_planes; p++) { ++ int shift = p == 1 || p == 2 ? s->desc->log2_chroma_w : 0; ++ int width = AV_CEIL_RSHIFT(inlink->w, shift); ++ ++ if (width > INT_MAX / s->pixsteps[p]) ++ return AVERROR(EINVAL); ++ size = FFMAX(size, width * s->pixsteps[p]); ++ } ++ ++ s->temp = av_malloc(size); + if (!s->temp) + return AVERROR(ENOMEM); + +-- +2.43.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index e39961c649..48ece24760 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -36,6 +36,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2026-65704.patch \ file://CVE-2026-65705_p1.patch \ file://CVE-2026-65705_p2.patch \ + file://CVE-2026-65706.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818"