From patchwork Tue Sep 22 07:01:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98875 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9AC97C982FA for ; Tue, 22 Sep 2026 07:02:27 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4480.1790060539506240679 for ; Tue, 22 Sep 2026 00:02:19 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=bdPOTxnx; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=8352; q=dns/txt; s=NAESA-Selector1; t=1790060539; x=1821596539; h=from:to:subject:date:message-id:mime-version: content-transfer-encoding; bh=8keTQj80m+HpQgxQ6083QP1ZBKmJtCiOZTlk9KzrLlU=; b=bdPOTxnxj+TGdA8CVw+1Xe6G9KlZPXWrL/hVCZnH4KIxrt+H/faq3O6j 3hzoBmidNHjpPrm+dRr4eBk7FuD5Fwac0fFX3WRYYUB37e4oCXLLjtvJi JY/951QhBi7od4LQ0sX3l3v80qNSu93V69CwwfHRaCihZBQC0dha55dAh jwMz/omiJtRP66Y89MYZqC4Q1dkxs7OTN8O2iwkZ6PZSybR1QYvuPdNO0 L+oKahbY80Lb9O1XMTlgNiJIm7frJlZ4y3N5bEmG7TrjanWDdOAV5NgN9 GIxtGtz/P1We9E+CbvmVCxI/2EnzsaBRJKn234Uk/sIDWo5MfHqnNG8t0 w==; X-CSE-ConnectionGUID: WtfMs4F2QAqeo9uRc7CEjA== X-CSE-MsgGUID: jXt4j3bzQKiUFuP8jX2DJg== X-IronPort-AV: E=Sophos;i="6.27,116,1787032800"; d="scan'208";a="63995888" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 22 Sep 2026 01:02:12 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose][oe-core][PATCH 1/5] ffmpeg: Fix for CVE-2026-66036 Date: Tue, 22 Sep 2026 12:31:25 +0530 Message-ID: <20260922070209.2770399-1-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 22 Sep 2026 07:02:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246382 From: Bhavesh R Maheshwari Pick the patch from [1] and [2], mentioned in PR#23783 [3] which is referenced in the NVD report [4] [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f0f634b6585fdc7bbb43ab3ae461499bfca9ad2e [2] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c [3] https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783 [4] https://nvd.nist.gov/vuln/detail/cve-2026-66036 Signed-off-by: Bhavesh R Maheshwari --- .../ffmpeg/ffmpeg/CVE-2026-66036_p1.patch | 120 ++++++++++++++++++ .../ffmpeg/ffmpeg/CVE-2026-66036_p2.patch | 71 +++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 2 + 3 files changed, 193 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p1.patch create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p2.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p1.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p1.patch new file mode 100644 index 0000000000..bce0265114 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p1.patch @@ -0,0 +1,120 @@ +From 7ac88955c4678fc10cc44a786ff9bf724bb12deb Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Sun, 12 Jul 2026 13:05:07 +0200 +Subject: [PATCH 1/2] avfilter/vf_hqdn3d: reject unsupported frame parameter + changes + +Fixes: out of array access +Fixes: 9aj_hqdn3d_dynamic_res.mjpg / 9aj_generate_hqdn3d_dynamic_res_mjpg.py +Fixes: wWDsy2oDvMuR +Found-by: Adrian Junge (vurlo) + +CVE: CVE-2026-66036 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f0f634b6585fdc7bbb43ab3ae461499bfca9ad2e] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavfilter/vf_hqdn3d.c | 34 +++++++++++++++++++++++++--------- + libavfilter/vf_hqdn3d.h | 2 ++ + 2 files changed, 27 insertions(+), 9 deletions(-) + +diff --git a/libavfilter/vf_hqdn3d.c b/libavfilter/vf_hqdn3d.c +index 1136931b9b..44fb3574a0 100644 +--- a/libavfilter/vf_hqdn3d.c ++++ b/libavfilter/vf_hqdn3d.c +@@ -165,12 +165,8 @@ static int denoise_depth(HQDN3DContext *s, + case 14: ret = denoise_depth(__VA_ARGS__, 14); break; \ + case 16: ret = denoise_depth(__VA_ARGS__, 16); break; \ + } \ +- if (ret < 0) { \ +- av_frame_free(&out); \ +- if (!direct) \ +- av_frame_free(&in); \ ++ if (ret < 0) \ + return ret; \ +- } \ + } while (0) + + static void precalc_coefs(double dist25, int depth, int16_t *ct) +@@ -283,12 +279,15 @@ static int config_input(AVFilterLink *inlink) + ff_hqdn3d_init_x86(s); + #endif + ++ s->format = inlink->format; ++ s->width = inlink->w; ++ s->height = inlink->h; ++ + return 0; + } + + typedef struct ThreadData { + AVFrame *in, *out; +- int direct; + } ThreadData; + + static int do_denoise(AVFilterContext *ctx, void *data, int job_nr, int n_jobs) +@@ -297,7 +296,6 @@ static int do_denoise(AVFilterContext *ctx, void *data, int job_nr, int n_jobs) + const ThreadData *td = data; + AVFrame *out = td->out; + AVFrame *in = td->in; +- int direct = td->direct; + + denoise(s, in->data[job_nr], out->data[job_nr], + s->line[job_nr], &s->frame_prev[job_nr], +@@ -314,10 +312,21 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) + { + AVFilterContext *ctx = inlink->dst; + AVFilterLink *outlink = ctx->outputs[0]; ++ HQDN3DContext *s = ctx->priv; + + AVFrame *out; + int direct = av_frame_is_writable(in) && !ctx->is_disabled; + ThreadData td; ++ int ret[3]; ++ ++ if (in->format != s->format || ++ in->width != s->width || ++ in->height != s->height) { ++ av_log(ctx, AV_LOG_ERROR, ++ "Frame size or format changed without filter graph reinitialization\n"); ++ av_frame_free(&in); ++ return AVERROR(EINVAL); ++ } + + if (direct) { + out = in; +@@ -333,9 +342,16 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) + + td.in = in; + td.out = out; +- td.direct = direct; + /* one thread per plane */ +- ff_filter_execute(ctx, do_denoise, &td, NULL, 3); ++ ff_filter_execute(ctx, do_denoise, &td, ret, 3); ++ for (int i = 0; i < FF_ARRAY_ELEMS(ret); i++) { ++ if (ret[i] < 0) { ++ av_frame_free(&out); ++ if (!direct) ++ av_frame_free(&in); ++ return ret[i]; ++ } ++ } + + if (ctx->is_disabled) { + av_frame_free(&out); +diff --git a/libavfilter/vf_hqdn3d.h b/libavfilter/vf_hqdn3d.h +index 3279bbcc77..3467f27145 100644 +--- a/libavfilter/vf_hqdn3d.h ++++ b/libavfilter/vf_hqdn3d.h +@@ -36,6 +36,8 @@ typedef struct HQDN3DContext { + double strength[4]; + int hsub, vsub; + int depth; ++ int width, height; ++ enum AVPixelFormat format; + void (*denoise_row[17])(uint8_t *src, uint8_t *dst, uint16_t *line_ant, uint16_t *frame_ant, ptrdiff_t w, int16_t *spatial, int16_t *temporal); + } HQDN3DContext; + +-- +2.53.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p2.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p2.patch new file mode 100644 index 0000000000..e5148e8629 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66036_p2.patch @@ -0,0 +1,71 @@ +From 6e2b4a7713d9fd4ddfc0e2775af9ba6a03e77d55 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Sun, 12 Jul 2026 13:05:33 +0200 +Subject: [PATCH 2/2] avfilter/vf_hqdn3d: support dynamic frame sizes + +CVE: CVE-2026-66036 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavfilter/avfilter.c | 3 ++- + libavfilter/vf_hqdn3d.c | 21 ++++++++++++++------- + 2 files changed, 16 insertions(+), 8 deletions(-) + +diff --git a/libavfilter/avfilter.c b/libavfilter/avfilter.c +index 5bcf0b4ef7..c039f3a1ff 100644 +--- a/libavfilter/avfilter.c ++++ b/libavfilter/avfilter.c +@@ -1072,7 +1072,8 @@ int ff_filter_frame(AVFilterLink *link, AVFrame *frame) + strcmp(link->dst->filter->name, "idet") && + strcmp(link->dst->filter->name, "null") && + strcmp(link->dst->filter->name, "scale") && +- strcmp(link->dst->filter->name, "libplacebo")) { ++ strcmp(link->dst->filter->name, "libplacebo") && ++ strcmp(link->dst->filter->name, "hqdn3d")) { + av_assert1(frame->format == link->format); + av_assert1(frame->width == link->w); + av_assert1(frame->height == link->h); +diff --git a/libavfilter/vf_hqdn3d.c b/libavfilter/vf_hqdn3d.c +index 44fb3574a0..92163042eb 100644 +--- a/libavfilter/vf_hqdn3d.c ++++ b/libavfilter/vf_hqdn3d.c +@@ -317,21 +317,28 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) + AVFrame *out; + int direct = av_frame_is_writable(in) && !ctx->is_disabled; + ThreadData td; +- int ret[3]; ++ int err, ret[3]; + +- if (in->format != s->format || +- in->width != s->width || +- in->height != s->height) { +- av_log(ctx, AV_LOG_ERROR, +- "Frame size or format changed without filter graph reinitialization\n"); ++ if (in->format != s->format) { + av_frame_free(&in); + return AVERROR(EINVAL); + } + ++ if (in->width != s->width || in->height != s->height) { ++ inlink->w = in->width; ++ inlink->h = in->height; ++ if ((err = config_input(inlink)) < 0) { ++ av_frame_free(&in); ++ return err; ++ } ++ outlink->w = in->width; ++ outlink->h = in->height; ++ } ++ + if (direct) { + out = in; + } else { +- out = ff_get_video_buffer(outlink, outlink->w, outlink->h); ++ out = ff_get_video_buffer(outlink, in->width, in->height); + if (!out) { + av_frame_free(&in); + return AVERROR(ENOMEM); +-- +2.53.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index 48ece24760..42ec15bf81 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -37,6 +37,8 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2026-65705_p1.patch \ file://CVE-2026-65705_p2.patch \ file://CVE-2026-65706.patch \ + file://CVE-2026-66036_p1.patch \ + file://CVE-2026-66036_p2.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" From patchwork Tue Sep 22 07:01:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98874 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B40BFC982F1 for ; Tue, 22 Sep 2026 07:02:27 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4480.1790060539506240679 for ; Tue, 22 Sep 2026 00:02:20 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=nrWLXHCz; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=2962; q=dns/txt; s=NAESA-Selector1; t=1790060540; x=1821596540; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=PaLDfXdM1we6eVWyG33XAKEmfgZajOohT16vPIDOUME=; b=nrWLXHCzyQP0Zt9IJIIuTgJ8GVOvBTd3WlIO6V6TvtzoHIdmVdnX6xRl S14B5eCvUCnoUuWqPcH3PmOV02sJpcKJ3B0GKNCh3xJsQmeIPrJZVhbFm saYFPrfyAKaGxNdL+rdGeJQdZPvF8SUZetxTHA9WiQdpqMKaailnFUl6e LYIfEdrwdksJ+FB7rggIi+BK4arW47yuIFTq7r/Xe5B9rUCoe3ovAnGqr ku3a5NueuJsJLG0OcOCYtEHfKXG7HeYAqf47Jhtw4NUsvWl8A0oY2Af9q r59t6pvkCfbVMmZcmpFARzUaoK5ADaUwzEvpZjeAazHZVfYFuqlVs9c88 Q==; X-CSE-ConnectionGUID: 4IyMTYLuSTKp+VCc943i7A== X-CSE-MsgGUID: lksnmqvxSuaEocXF9UEDRA== X-IronPort-AV: E=Sophos;i="6.27,116,1787032800"; d="scan'208";a="63995890" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 22 Sep 2026 01:02:15 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose][oe-core][PATCH 2/5] ffmpeg: Fix for CVE-2026-66037 Date: Tue, 22 Sep 2026 12:31:26 +0530 Message-ID: <20260922070209.2770399-2-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260922070209.2770399-1-bhavesh.maheshwari@einfochips.com> References: <20260922070209.2770399-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 22 Sep 2026 07:02:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246383 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5 [2] https://nvd.nist.gov/vuln/detail/cve-2026-66037 Signed-off-by: Bhavesh R Maheshwari --- .../ffmpeg/ffmpeg/CVE-2026-66037.patch | 39 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 1 + 2 files changed, 40 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66037.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66037.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66037.patch new file mode 100644 index 0000000000..1b93c0ca86 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66037.patch @@ -0,0 +1,39 @@ +From f02c8cd37dee2b333de229c6ac6834322f56e2c9 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Sun, 28 Jun 2026 22:05:28 +0200 +Subject: [PATCH] avformat/iamf_parse: check count_label against the available + bytes + +Fixes: unbounded allocation / denial of service +Fixes: tP59h4cpaFyg +Fixes: 4ee05182b7 (avformat: Immersive Audio Model and Formats demuxer) +Found-by: Adrian Junge (vurlo) +Signed-off-by: Michael Niedermayer + +CVE: CVE-2026-66037 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/86708357d126af84c16f80d9c57335d1e8c845c5] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavformat/iamf_parse.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libavformat/iamf_parse.c b/libavformat/iamf_parse.c +index 29b8acd351..a36759e282 100644 +--- a/libavformat/iamf_parse.c ++++ b/libavformat/iamf_parse.c +@@ -969,6 +969,11 @@ static int mix_presentation_obu(void *s, IAMFContext *c, AVIOContext *pb, int le + mix_presentation->cmix = mix; + + mix_presentation->count_label = ffio_read_leb(pbc); ++ if (mix_presentation->count_label > len - avio_tell(pbc)) { ++ mix_presentation->count_label = 0; ++ ret = AVERROR_INVALIDDATA; ++ goto fail; ++ } + mix_presentation->language_label = av_calloc(mix_presentation->count_label, + sizeof(*mix_presentation->language_label)); + if (!mix_presentation->language_label) { +-- +2.53.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index 42ec15bf81..c0623987f4 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -39,6 +39,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2026-65706.patch \ file://CVE-2026-66036_p1.patch \ file://CVE-2026-66036_p2.patch \ + file://CVE-2026-66037.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" From patchwork Tue Sep 22 07:01:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98876 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C664DC982FE for ; Tue, 22 Sep 2026 07:02:27 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4480.1790060539506240679 for ; Tue, 22 Sep 2026 00:02:21 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=kJ8puNlr; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=3238; q=dns/txt; s=NAESA-Selector1; t=1790060541; x=1821596541; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=M428ofpeM1XIFZWmtCySgP+x5829pz4I9scjp0+sOMs=; b=kJ8puNlrt1XqF3dMsiKeL049Wv8rKflEFSbFjSNhM+/gG+R+hRB5yI3w RlQTE5oJqTOBZw9AXB6iWtCgttCaBqJx5IgWlhIoqAMvoxyrwMXfinZmw 65ZZyce0CqRzaQv+zfNdFY5NUvtwotXNmDqCbXQjGWzULWuj7S11kpT6W EI0Gb5zUkfAFAXZhgM/hSJDvmukWhygHEnAGilb5KMicdJPvOABef5YF9 pmsr9Ecu+LRZ2dA9HMGufBD8U7Vq25KThgmqTFxkL3ThA3kjjP38Eh+WA aKA2X1FjgNh73X8KM01WRHaLmRiRgIq9ScmahrtrMPt5ftsxTcCCnFAKm Q==; X-CSE-ConnectionGUID: zxxGmLW/SS6pTL4kcucF/g== X-CSE-MsgGUID: dsjwdqTPSJK9y/tFv9DEJg== X-IronPort-AV: E=Sophos;i="6.27,116,1787032800"; d="scan'208";a="63995894" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 22 Sep 2026 01:02:20 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose][oe-core][PATCH 3/5] ffmpeg: Fix for CVE-2026-66038 Date: Tue, 22 Sep 2026 12:31:27 +0530 Message-ID: <20260922070209.2770399-3-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260922070209.2770399-1-bhavesh.maheshwari@einfochips.com> References: <20260922070209.2770399-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 22 Sep 2026 07:02:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246384 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c [2] https://nvd.nist.gov/vuln/detail/cve-2026-66038 Signed-off-by: Bhavesh R Maheshwari --- .../ffmpeg/ffmpeg/CVE-2026-66038.patch | 50 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 1 + 2 files changed, 51 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66038.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66038.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66038.patch new file mode 100644 index 0000000000..4c2be95590 --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66038.patch @@ -0,0 +1,50 @@ +From 5fc1e9d8af5019a83a5683e30d92c41c7a606c2d Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Sun, 28 Jun 2026 19:04:07 +0200 +Subject: [PATCH] avcodec/lcldec: zero the not-decoded tail to avoid heap + disclosure + +Fixes: use of uninitialized memory +Fixes: CsNDKB1K1U0C +Fixes: e2c3aa8e2b (avcodec/lcldec: More space for rgb24) +Found-by: Adrian Junge (vurlo) +Signed-off-by: Michael Niedermayer + +CVE: CVE-2026-66038 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavcodec/lcldec.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c +index e9d4283eef..71c6d070e2 100644 +--- a/libavcodec/lcldec.c ++++ b/libavcodec/lcldec.c +@@ -119,6 +119,9 @@ static unsigned int mszh_decomp(const unsigned char * srcptr, int srclen, unsign + } + } + ++ if (destptr < destptr_end) ++ memset(destptr, 0, destptr_end - destptr); ++ + return destptr - destptr_bak; + } + +@@ -152,8 +155,11 @@ static int zlib_decomp(AVCodecContext *avctx, const uint8_t *src, int src_len, i + if (expected != (unsigned int)zstream->total_out) { + av_log(avctx, AV_LOG_ERROR, "Decoded size differs (%d != %lu)\n", + expected, zstream->total_out); +- if (expected > (unsigned int)zstream->total_out) ++ if (expected > (unsigned int)zstream->total_out) { ++ memset(c->decomp_buf + offset + zstream->total_out, 0, ++ c->decomp_size - offset - zstream->total_out); + return (unsigned int)zstream->total_out; ++ } + return AVERROR_UNKNOWN; + } + return zstream->total_out; +-- +2.53.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index c0623987f4..cbb436a9a1 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -40,6 +40,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2026-66036_p1.patch \ file://CVE-2026-66036_p2.patch \ file://CVE-2026-66037.patch \ + file://CVE-2026-66038.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" From patchwork Tue Sep 22 07:01:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98877 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0CD3C98305 for ; Tue, 22 Sep 2026 07:02:27 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4480.1790060539506240679 for ; Tue, 22 Sep 2026 00:02:24 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=SkZUq0Nq; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=2874; q=dns/txt; s=NAESA-Selector1; t=1790060544; x=1821596544; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=+2XeG4CX+ED2/EzNtgZDpPUiAqD/v0nzET+Pwm+wGXk=; b=SkZUq0Nqy9vvDI/6VMXkX9YFzSGbam/Qb1yOtmaf1c5wVBFOYxueow07 CeNjfSOjibssfZbBNPWfPT4f2snN+eUUls7AMNDfub76xYj+INbPzbiqF MctIePjQOkMC7dwIjGN/qpqFge3dELJJiHkyGOGF2vT9tNypM4g/fcXDw YYGZ6CpPkTmfEbjAdHd4bI4x+dR4CMUYF4SdMbBG0U5Qlcc2Hri5mL4wi /XhijUvkx+cjP2rLY72TjR2B8/w7YkF5ufzZBclDwRdgN5cjGssfVtbVz pGX+TJw26s+1RARDULHTtQzWEGd4zTqc7NDKQSU56w0uJqe0Lk8qGRFU/ g==; X-CSE-ConnectionGUID: loh7lX+YQVCkGH31lWL92w== X-CSE-MsgGUID: TW/yEmPGSWeG31GI8XErKA== X-IronPort-AV: E=Sophos;i="6.27,116,1787032800"; d="scan'208";a="63995898" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 22 Sep 2026 01:02:22 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose][oe-core][PATCH 4/5] ffmpeg: Fix for CVE-2026-66039 Date: Tue, 22 Sep 2026 12:31:28 +0530 Message-ID: <20260922070209.2770399-4-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260922070209.2770399-1-bhavesh.maheshwari@einfochips.com> References: <20260922070209.2770399-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 22 Sep 2026 07:02:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246385 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718 [2] https://nvd.nist.gov/vuln/detail/cve-2026-66039 Signed-off-by: Bhavesh R Maheshwari --- .../ffmpeg/ffmpeg/CVE-2026-66039.patch | 38 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 1 + 2 files changed, 39 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66039.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66039.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66039.patch new file mode 100644 index 0000000000..2e34923eda --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66039.patch @@ -0,0 +1,38 @@ +From b3562273e37397669fdb3f4ec933e2fa57e28dbd Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Mon, 29 Jun 2026 01:16:44 +0200 +Subject: [PATCH] avcodec/mace: reject sample counts that overflow int + +Fixes: heap buffer overflow +Fixes: FmXBI2dbgvgD +Fixes: 0eea212943544d40f99b05571aa7159d78667154 (Add avcodec_decode_audio4().) +Found-by: Adrian Junge (vurlo) +Signed-off-by: Michael Niedermayer + +CVE: CVE-2026-66039 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavcodec/mace.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/libavcodec/mace.c b/libavcodec/mace.c +index 2aa54fb548..716dd0c00a 100644 +--- a/libavcodec/mace.c ++++ b/libavcodec/mace.c +@@ -252,7 +252,10 @@ static int mace_decode_frame(AVCodecContext *avctx, AVFrame *frame, + } + + /* get output buffer */ +- frame->nb_samples = 3 * (buf_size << (1 - is_mace3)) / channels; ++ int64_t nb_samples = 3 * ((int64_t)buf_size << (1 - is_mace3)) / channels; ++ if (nb_samples > INT_MAX) ++ return AVERROR_INVALIDDATA; ++ frame->nb_samples = nb_samples; + if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) + return ret; + samples = (int16_t **)frame->extended_data; +-- +2.53.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index cbb436a9a1..3043cf638f 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -41,6 +41,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2026-66036_p2.patch \ file://CVE-2026-66037.patch \ file://CVE-2026-66038.patch \ + file://CVE-2026-66039.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818" From patchwork Tue Sep 22 07:01:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bhavesh Rajesh Maheshwari X-Patchwork-Id: 98878 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E819C98306 for ; Tue, 22 Sep 2026 07:02:29 +0000 (UTC) Received: from naesa06.arrow.com (naesa06.arrow.com [216.150.161.27]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4480.1790060539506240679 for ; Tue, 22 Sep 2026 00:02:26 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@einfochips.com header.s=NAESA-Selector1 header.b=j/G5zlTR; spf=pass (domain: einfochips.com, ip: 216.150.161.27, mailfrom: bhavesh.maheshwari@einfochips.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=einfochips.com; i=@einfochips.com; l=3308; q=dns/txt; s=NAESA-Selector1; t=1790060546; x=1821596546; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=29NHfsJvxt+2CJhlQu9gkBYwwEHzcRQuWyU2S+47q0E=; b=j/G5zlTRlBrzCNBWZ/NFIF8jzJj0dGLz+aHmB+D2qKzioPksj+v9tfLx yKh+QTmKkj9uJQnL41IBoqUPG1y3Dh/riCRuBSJ7jVe5gdx8r60cfNJN8 03rEe2y9cXFy3V2Sz3blNyu83DvMHKZdcSV4Mc9qb9nt93YaIjeZ0BDTd RWuGT4TrNS1PsXeXFAVa7Li+W0lH3ocMVgeMr2URzHDDPxrXhuVuFCYj8 0hm7bekvIFqP+JcZyfYUvrgCg3ESk7u/sdDRaVGW7JQCZNuukv7y27XOM ZmMpB2k/nS5Yva1R31ETlhbfrnuNdmNBWuMQy/e7RJ2sIWrlYABRXTKhB Q==; X-CSE-ConnectionGUID: vKoEkl/UTk6VeOcXOubaJg== X-CSE-MsgGUID: /xSWxVVFSxKtmHmnCgLg0w== X-IronPort-AV: E=Sophos;i="6.27,116,1787032800"; d="scan'208";a="63995900" Received: from unknown (HELO 6T8J9X2.ap.corp.arrow.com) ([10.126.18.101]) by naesa06out.arrow.com with ESMTP; 22 Sep 2026 01:02:25 -0600 From: bhavesh.maheshwari@einfochips.com To: openembedded-core@lists.openembedded.org Subject: [wrynose][oe-core][PATCH 5/5] ffmpeg: Fix for CVE-2026-66041 Date: Tue, 22 Sep 2026 12:31:29 +0530 Message-ID: <20260922070209.2770399-5-bhavesh.maheshwari@einfochips.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260922070209.2770399-1-bhavesh.maheshwari@einfochips.com> References: <20260922070209.2770399-1-bhavesh.maheshwari@einfochips.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 22 Sep 2026 07:02:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246386 From: Bhavesh R Maheshwari Pick the patch from [1], also referenced in the NVD report [2]. [1] https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5 [2] https://nvd.nist.gov/vuln/detail/cve-2026-66041 Signed-off-by: Bhavesh R Maheshwari --- .../ffmpeg/ffmpeg/CVE-2026-66041.patch | 60 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66041.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66041.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66041.patch new file mode 100644 index 0000000000..7a8c4e0c8b --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2026-66041.patch @@ -0,0 +1,60 @@ +From 9db6b5816516b85e981e177863b2eb361dbec3c8 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Sun, 28 Jun 2026 15:33:38 +0200 +Subject: [PATCH] avfilter/vf_quirc: resize the quirc buffers when the input + size changes + +Fixes: out of array access +Fixes: JbvzNObhorBp +Fixes: 030e140145 (lavfi: add quirc filter) +Found-by: Adrian Junge (vurlo) +Signed-off-by: Michael Niedermayer + +CVE: CVE-2026-66041 +Upstream-Status: Backport [https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4da9812e25894fb51d62a8875cfa8eb39b5e20f5] + +Signed-off-by: Bhavesh R Maheshwari +--- + libavfilter/vf_quirc.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/libavfilter/vf_quirc.c b/libavfilter/vf_quirc.c +index 59dc84caa8..d2ba48e7bc 100644 +--- a/libavfilter/vf_quirc.c ++++ b/libavfilter/vf_quirc.c +@@ -36,6 +36,7 @@ typedef struct QuircContext { + const AVClass *class; + + struct quirc *quirc; ++ int width, height; + } QuircContext; + + static av_cold int init(AVFilterContext *ctx) +@@ -67,6 +68,8 @@ static int config_input(AVFilterLink *inlink) + if (err == -1) { + return AVERROR(ENOMEM); + } ++ quirc->width = inlink->w; ++ quirc->height = inlink->h; + + return 0; + } +@@ -80,6 +83,15 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame) + int codes_count; + uint8_t *image; + ++ if (quirc->width != inlink->w || quirc->height != inlink->h) { ++ if (quirc_resize(quirc->quirc, inlink->w, inlink->h) < 0) { ++ av_frame_free(&frame); ++ return AVERROR(ENOMEM); ++ } ++ quirc->width = inlink->w; ++ quirc->height = inlink->h; ++ } ++ + /* copy input image to quirc buffer */ + image = quirc_begin(quirc->quirc, NULL, NULL); + av_image_copy_plane(image, inlink->w, +-- +2.53.0 + diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb index 3043cf638f..a7b6237c62 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.3.bb @@ -42,6 +42,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2026-66037.patch \ file://CVE-2026-66038.patch \ file://CVE-2026-66039.patch \ + file://CVE-2026-66041.patch \ " SRC_URI[sha256sum] = "6136812ea6d4e68bdba27e33c2a94382711cdf4f8602ffef056ff792bd6f9818"