!89 fix CVE-2023-50010

From: @happyworker 
Reviewed-by: @technology208 
Signed-off-by: @technology208

ffmpeg.spec

@@ -61,7 +61,7 @@ ExclusiveArch: armv7hnl
 Summary:        Digital VCR and streaming server
 Name:           ffmpeg%{?flavor}
 Version:        4.2.4
-Release:        9
+Release:        10
 License:        %{ffmpeg_license}
 URL:            http://ffmpeg.org/
 %if 0%{?date}
@@ -80,6 +80,7 @@ Patch7:         CVE-2023-51794.patch
 Patch8:         fix-CVE-2023-51798.patch
 Patch9:         CVE-2022-3341.patch
 Patch10:        fix-CVE-2023-51793.patch
+Patch11:        fix-CVE-2023-50010.patch
 Requires:       %{name}-libs%{?_isa} = %{version}-%{release}
 %{?_with_cuda:BuildRequires: cuda-minimal-build-%{_cuda_version_rpm} cuda-drivers-devel}
 %{?_with_libnpp:BuildRequires: pkgconfig(nppc-%{_cuda_version})}
@@ -412,6 +413,9 @@ install -pm755 tools/qt-faststart %{buildroot}%{_bindir}
 
 
 %changelog
+* Tue Jul 02 2024 happyworker <208suo@208suo.com> - 4.2.4-10
+- Fix CVE-2023-50010
+
 * Tue Jul 02 2024 happyworker <208suo@208suo.com> - 4.2.4-9
 - Fix CVE-2023-51793
 

fix-CVE-2023-50010.patch

@@ -0,0 +1,25 @@
+From fa8e9d837130cde3d0548b01aa9cb42e60e30a24 Mon Sep 17 00:00:00 2001
+From: Michael Niedermayer <michael@niedermayer.cc>
+Date: Fri, 28 Jun 2024 16:48:40 +0800
+Subject: [PATCH] fix CVE-2023-50010
+
+---
+ libavfilter/vf_gradfun.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libavfilter/vf_gradfun.c b/libavfilter/vf_gradfun.c
+index f63128d..da4c01a 100644
+--- a/libavfilter/vf_gradfun.c
++++ b/libavfilter/vf_gradfun.c
+@@ -92,7 +92,7 @@ static void filter(GradFunContext *ctx, uint8_t *dst, const uint8_t *src, int wi
+     for (y = 0; y < r; y++)
+         ctx->blur_line(dc, buf + y * bstride, buf + (y - 1) * bstride, src + 2 * y * src_linesize, src_linesize, width / 2);
+     for (;;) {
+-        if (y < height - r) {
++        if (y + 1 < height - r) {
+             int mod = ((y + r) / 2) % r;
+             uint16_t *buf0 = buf + mod * bstride;
+             uint16_t *buf1 = buf + (mod ? mod - 1 : r - 1) * bstride;
+-- 
+2.43.0
+