From dc2979fb9a6ae34d97a39b361517c5756ad12714 Mon Sep 17 00:00:00 2001 From: happyworker <208suo@208suo.com> Date: Tue, 8 Jul 2025 14:06:53 +0800 Subject: [PATCH] sync CVE-2025-25473 update (cherry picked from commit 50f26229c24b1e97e382ad99fa1c591b0175465d) --- CVE-2025-25473.patch | 24 +++++++++++++++ backport-CVE-2024-35365.patch | 57 ----------------------------------- backport-CVE-2024-36613.patch | 2 +- ffmpeg.spec | 16 +++++----- 4 files changed, 33 insertions(+), 66 deletions(-) create mode 100644 CVE-2025-25473.patch delete mode 100644 backport-CVE-2024-35365.patch diff --git a/CVE-2025-25473.patch b/CVE-2025-25473.patch new file mode 100644 index 0000000..47084f3 --- /dev/null +++ b/CVE-2025-25473.patch @@ -0,0 +1,24 @@ +From d16fbdcf14998e7da4288969c4220de11d0b3cb4 Mon Sep 17 00:00:00 2001 +From: happyworker <208suo@208suo.com> +Date: Tue, 22 Apr 2025 16:56:17 +0800 +Subject: [PATCH] createpath + +--- + libavformat/avformat.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libavformat/avformat.c b/libavformat/avformat.c +index 5b8bb78..73f31cd 100644 +--- a/libavformat/avformat.c ++++ b/libavformat/avformat.c +@@ -138,6 +138,7 @@ void avformat_free_context(AVFormatContext *s) + av_dict_free(&si->id3v2_meta); + av_packet_free(&si->pkt); + av_packet_free(&si->parse_pkt); ++ avpriv_packet_list_free(&si->packet_buffer); + av_freep(&s->streams); + ff_flush_packet_queue(s); + av_freep(&s->url); +-- +2.43.0 + diff --git a/backport-CVE-2024-35365.patch b/backport-CVE-2024-35365.patch deleted file mode 100644 index 9a488db..0000000 --- a/backport-CVE-2024-35365.patch +++ /dev/null @@ -1,57 +0,0 @@ -From ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5 Mon Sep 17 00:00:00 2001 -From: Andreas Rheinhardt -Date: Mon, 25 Mar 2024 16:54:25 +0100 -Subject: [PATCH] fftools/ffmpeg_mux_init: Fix double-free on error - -MATCH_PER_STREAM_OPT iterates over all options of a given -OptionDef and tests whether they apply to the current stream; -if so, they are set to ost->apad, otherwise, the code errors -out. If no error happens, ost->apad is av_strdup'ed in order -to take ownership of this pointer. - -But this means that setting it originally was premature, -as it leads to double-frees when an error happens lateron. -This can simply be reproduced with -ffmpeg -filter_complex anullsrc -apad bar -apad:n baz -f null - -This is a regression since 83ace80bfd80fcdba2c65fa1d554923ea931d5bd. - -Fix this by using a temporary variable instead of directly -setting ost->apad. Also only strdup the string if it actually -is != NULL. - -Reviewed-by: Marth64 -Signed-off-by: Andreas Rheinhardt ---- - fftools/ffmpeg_mux_init.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/fftools/ffmpeg_mux_init.c b/fftools/ffmpeg_mux_init.c -index 63a25a3..e0220ef 100644 ---- a/fftools/ffmpeg_mux_init.c -+++ b/fftools/ffmpeg_mux_init.c -@@ -845,6 +845,7 @@ static int new_stream_audio(Muxer *mux, const OptionsContext *o, - int channels = 0; - char *layout = NULL; - char *sample_fmt = NULL; -+ const char *apad = NULL; - - MATCH_PER_STREAM_OPT(audio_channels, i, channels, oc, st); - if (channels) { -@@ -882,8 +883,12 @@ static int new_stream_audio(Muxer *mux, const OptionsContext *o, - - MATCH_PER_STREAM_OPT(audio_sample_rate, i, audio_enc->sample_rate, oc, st); - -- MATCH_PER_STREAM_OPT(apad, str, ost->apad, oc, st); -- ost->apad = av_strdup(ost->apad); -+ MATCH_PER_STREAM_OPT(apad, str, apad, oc, st); -+ if (apad) { -+ ost->apad = av_strdup(apad); -+ if (!ost->apad) -+ return AVERROR(ENOMEM); -+ } - - #if FFMPEG_OPT_MAP_CHANNEL - /* check for channel mapping for this audio stream */ --- -2.46.0 - diff --git a/backport-CVE-2024-36613.patch b/backport-CVE-2024-36613.patch index d828554..c67da5b 100644 --- a/backport-CVE-2024-36613.patch +++ b/backport-CVE-2024-36613.patch @@ -32,5 +32,5 @@ index 474b852..167241f 100644 c->bytes_left = fsize; c->wavpos = avio_tell(pb); -- -2.41.0 +2.46.0 diff --git a/ffmpeg.spec b/ffmpeg.spec index 83592a7..c0a25fb 100644 --- a/ffmpeg.spec +++ b/ffmpeg.spec @@ -62,7 +62,7 @@ Summary: Digital VCR and streaming server Name: ffmpeg%{?flavor} Version: 6.1.1 -Release: 20 +Release: 21 License: GPL-3.0-or-later URL: http://ffmpeg.org/ Source0: http://ffmpeg.org/releases/ffmpeg-%{version}.tar.xz @@ -87,7 +87,7 @@ Patch16: backport-CVE-2024-36617.patch Patch17: backport-CVE-2024-36619.patch Patch18: backport-CVE-2024-35369.patch Patch19: backport-CVE-2024-36613.patch -Patch20: backport-CVE-2024-35365.patch +Patch20: CVE-2025-25473.patch Requires: %{name}-libs%{?_isa} = %{version}-%{release} %{?_with_cuda:BuildRequires: cuda-minimal-build-%{_cuda_version_rpm} cuda-drivers-devel} @@ -360,6 +360,9 @@ cp -pr doc/examples/{*.c,Makefile,README} _doc/examples/ %ifarch armv7hnl --enable-neon \ %endif +%endif +%ifarch sw_64 + --disable-runtime-cpudetect \ %endif || cat ffbuild/config.log @@ -417,13 +420,10 @@ install -pm755 tools/qt-faststart %{buildroot}%{_bindir} %changelog -* Mon Jan 13 2025 changtao - 6.1.1-20 -- Type: CVE -- CVE: CVE-2024-35365 -- SUG: NA -- DESC: fix CVE-2024-35365 +* Tue Apr 22 2025 happyworker <208suo@208suo.com> - 6.1.1-21 +- fix CVE-2025-25473 -* Sun Jan 5 2025 changtao - 6.1.1-19 +* Mon Jan 13 2025 changtao - 6.1.1-20 - Type: CVE - CVE: CVE-2024-36613 - SUG: NA -- Gitee