diff --git a/multimedia/ffmpeg/Makefile b/multimedia/ffmpeg/Makefile index e63609f39707..ea7766e14708 100644 --- a/multimedia/ffmpeg/Makefile +++ b/multimedia/ffmpeg/Makefile @@ -3,6 +3,7 @@ PORTNAME= ffmpeg PORTVERSION= 3.4.2 +PORTREVISION= 1 PORTEPOCH= 1 CATEGORIES= multimedia audio ipv6 net MASTER_SITES= https://ffmpeg.org/releases/ diff --git a/multimedia/ffmpeg/files/patch-CVE-2018-12458 b/multimedia/ffmpeg/files/patch-CVE-2018-12458 new file mode 100644 index 000000000000..d06118589adb --- /dev/null +++ b/multimedia/ffmpeg/files/patch-CVE-2018-12458 @@ -0,0 +1,32 @@ +commit bd1fd3ff4b0437153a6c4717f59ce31a7bba8ca0 +Author: Michael Niedermayer +Date: Mon May 21 23:08:05 2018 +0200 + + avcodec/mpeg4videoenc: Use 64 bit for times in mpeg4_encode_gop_header() + + Fixes truncation + Fixes Assertion n <= 31 && value < (1U << n) failed at libavcodec/put_bits.h:169 + Fixes: ffmpeg_crash_2.avi + + Found-by: Thuan Pham , Marcel Böhme, Andrew Santosa and Alexandru RazvanCaciulescu with AFLSmart + + Signed-off-by: Michael Niedermayer + (cherry picked from commit e1182fac1afba92a4975917823a5f644bee7e6e8) + Signed-off-by: Michael Niedermayer +--- + libavcodec/mpeg4videoenc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git libavcodec/mpeg4videoenc.c libavcodec/mpeg4videoenc.c +index 494452c938..f6a5992df7 100644 +--- libavcodec/mpeg4videoenc.c ++++ libavcodec/mpeg4videoenc.c +@@ -882,7 +882,7 @@ void ff_set_mpeg4_time(MpegEncContext *s) + + static void mpeg4_encode_gop_header(MpegEncContext *s) + { +- int hours, minutes, seconds; ++ int64_t hours, minutes, seconds; + int64_t time; + + put_bits(&s->pb, 16, 0); diff --git a/multimedia/ffmpeg/files/patch-CVE-2018-7557 b/multimedia/ffmpeg/files/patch-CVE-2018-7557 new file mode 100644 index 000000000000..c1a6d78d9cb6 --- /dev/null +++ b/multimedia/ffmpeg/files/patch-CVE-2018-7557 @@ -0,0 +1,51 @@ +commit ae49cc73f265a155e5c4b1715570aab3d9741b4d +Author: Michael Niedermayer +Date: Mon Feb 26 03:02:48 2018 +0100 + + avcodec/utvideodec: Check subsample factors + + Fixes: Out of array read + Fixes: heap_poc + + Found-by: GwanYeong Kim + Signed-off-by: Michael Niedermayer + (cherry picked from commit 7414d0bda7763f9bd69c26c068e482ab297c1c96) + Signed-off-by: Michael Niedermayer +--- + libavcodec/utvideodec.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git libavcodec/utvideodec.c libavcodec/utvideodec.c +index d888cc3cdf..ebd9d55cf2 100644 +--- libavcodec/utvideodec.c ++++ libavcodec/utvideodec.c +@@ -30,6 +30,7 @@ + #define UNCHECKED_BITSTREAM_READER 1 + + #include "libavutil/intreadwrite.h" ++#include "libavutil/pixdesc.h" + #include "avcodec.h" + #include "bswapdsp.h" + #include "bytestream.h" +@@ -789,6 +790,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, + static av_cold int decode_init(AVCodecContext *avctx) + { + UtvideoContext * const c = avctx->priv_data; ++ int h_shift, v_shift; + + c->avctx = avctx; + +@@ -886,6 +888,13 @@ static av_cold int decode_init(AVCodecContext *avctx) + return AVERROR_INVALIDDATA; + } + ++ av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &h_shift, &v_shift); ++ if ((avctx->width & ((1<height & ((1< +Date: Sat Mar 10 01:40:36 2018 +0100 + + avformat/img2dec: fix infinite loop + + Fixes: kira-poc + + Found-by: Kira + Change suggested by Kira + Signed-off-by: Michael Niedermayer + (cherry picked from commit a6cba062051f345e8ebfdff34aba071ed73d923f) + Signed-off-by: Michael Niedermayer +--- + libavformat/img2dec.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git libavformat/img2dec.c libavformat/img2dec.c +index ecf64eaffa..2585634e7c 100644 +--- libavformat/img2dec.c ++++ libavformat/img2dec.c +@@ -878,10 +878,14 @@ static int svg_probe(AVProbeData *p) + { + const uint8_t *b = p->buf; + const uint8_t *end = p->buf + p->buf_size; ++ + if (memcmp(p->buf, "= end - 4) + return 0; + if (!memcmp(b, " +Date: Fri Mar 30 02:16:31 2018 +0200 + + avfilter/vf_signature: use av_strlcpy() + + Fixes: out of array access + + Found-by: Kira + Signed-off-by: Michael Niedermayer + (cherry picked from commit 35eeff30caf34df835206f1c12bcf4b7c2bd6758) + Signed-off-by: Michael Niedermayer +--- + libavfilter/vf_signature.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git libavfilter/vf_signature.c libavfilter/vf_signature.c +index f0078ba1a6..d07b213f31 100644 +--- libavfilter/vf_signature.c ++++ libavfilter/vf_signature.c +@@ -576,7 +576,8 @@ static int export(AVFilterContext *ctx, StreamContext *sc, int input) + /* error already handled */ + av_assert0(av_get_frame_filename(filename, sizeof(filename), sic->filename, input) == 0); + } else { +- strcpy(filename, sic->filename); ++ if (av_strlcpy(filename, sic->filename, sizeof(filename)) >= sizeof(filename)) ++ return AVERROR(EINVAL); + } + if (sic->format == FORMAT_XML) { + return xml_export(ctx, sc, filename);