diff --git a/ffmpeg.spec b/ffmpeg.spec index db4b962..d15c5c7 100644 --- a/ffmpeg.spec +++ b/ffmpeg.spec @@ -61,7 +61,7 @@ ExclusiveArch: armv7hnl Summary: Digital VCR and streaming server Name: ffmpeg%{?flavor} Version: 4.2.4 -Release: 9 +Release: 10 License: %{ffmpeg_license} URL: http://ffmpeg.org/ %if 0%{?date} @@ -80,6 +80,7 @@ Patch7: CVE-2023-51794.patch Patch8: fix-CVE-2023-51798.patch Patch9: CVE-2022-3341.patch Patch10: fix-CVE-2023-51793.patch +Patch11: fix-CVE-2023-50010.patch Requires: %{name}-libs%{?_isa} = %{version}-%{release} %{?_with_cuda:BuildRequires: cuda-minimal-build-%{_cuda_version_rpm} cuda-drivers-devel} %{?_with_libnpp:BuildRequires: pkgconfig(nppc-%{_cuda_version})} @@ -412,6 +413,9 @@ install -pm755 tools/qt-faststart %{buildroot}%{_bindir} %changelog +* Tue Jul 02 2024 happyworker <208suo@208suo.com> - 4.2.4-10 +- Fix CVE-2023-50010 + * Tue Jul 02 2024 happyworker <208suo@208suo.com> - 4.2.4-9 - Fix CVE-2023-51793 diff --git a/fix-CVE-2023-50010.patch b/fix-CVE-2023-50010.patch new file mode 100644 index 0000000..6953414 --- /dev/null +++ b/fix-CVE-2023-50010.patch @@ -0,0 +1,25 @@ +From fa8e9d837130cde3d0548b01aa9cb42e60e30a24 Mon Sep 17 00:00:00 2001 +From: Michael Niedermayer +Date: Fri, 28 Jun 2024 16:48:40 +0800 +Subject: [PATCH] fix CVE-2023-50010 + +--- + libavfilter/vf_gradfun.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libavfilter/vf_gradfun.c b/libavfilter/vf_gradfun.c +index f63128d..da4c01a 100644 +--- a/libavfilter/vf_gradfun.c ++++ b/libavfilter/vf_gradfun.c +@@ -92,7 +92,7 @@ static void filter(GradFunContext *ctx, uint8_t *dst, const uint8_t *src, int wi + for (y = 0; y < r; y++) + ctx->blur_line(dc, buf + y * bstride, buf + (y - 1) * bstride, src + 2 * y * src_linesize, src_linesize, width / 2); + for (;;) { +- if (y < height - r) { ++ if (y + 1 < height - r) { + int mod = ((y + r) / 2) % r; + uint16_t *buf0 = buf + mod * bstride; + uint16_t *buf1 = buf + (mod ? mod - 1 : r - 1) * bstride; +-- +2.43.0 +