packages/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

CVE-2022-48434

Browse Source 
(cherry picked from commit ec3a427292b383c3db2ae16d74c14669c16aeafd)
This commit is contained in:
happyworker 2024-07-15 15:43:33 +08:00 committed by openeuler-sync-bot
parent a7bb976386
commit ff05d34a95
2 changed files with 127 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

122
CVE-2022-48434.patch Normal file
View File

@ -0,0 +1,122 @@
From 21f36cfb60b40d6be1501a69f2ad03cc26e5bb04 Mon Sep 17 00:00:00 2001
From: Anton Khirnov <anton@khirnov.net>
Date: Mon, 15 Jul 2024 16:20:43 +0800
Subject: [PATCH] lavc/pthread_frame: avoid leaving stale hwaccel state in worker threads
---
libavcodec/pthread_frame.c | 50 +++++++++++++++++++++++++++++---------
1 file changed, 39 insertions(+), 11 deletions(-)
diff --git a/libavcodec/pthread_frame.c b/libavcodec/pthread_frame.c
index 36ac0ac..0bdb0de 100644
--- a/libavcodec/pthread_frame.c
+++ b/libavcodec/pthread_frame.c
@@ -135,6 +135,12 @@ typedef struct FrameThreadContext {
* Set for the first N packets, where N is the number of threads.
* While it is set, ff_thread_en/decode_frame won't return any results.
*/
+ /* hwaccel state is temporarily stored here in order to transfer its ownership
+ * to the next decoding thread without the need for extra synchronization */
+ const AVHWAccel *stash_hwaccel;
+ void *stash_hwaccel_context;
+ void *stash_hwaccel_priv;
+
} FrameThreadContext;
#define THREAD_SAFE_CALLBACKS(avctx) \
@@ -211,9 +217,19 @@ static attribute_align_arg void *frame_worker_thread(void *arg)
ff_thread_finish_setup(avctx);
if (p->hwaccel_serializing) {
+
+ /* wipe hwaccel state to avoid stale pointers lying around;
+ * the state was transferred to FrameThreadContext in
+ * ff_thread_finish_setup(), so nothing is leaked */
+ avctx->hwaccel = NULL;
+ avctx->hwaccel_context = NULL;
+ avctx->internal->hwaccel_priv_data = NULL;
+
p->hwaccel_serializing = 0;
pthread_mutex_unlock(&p->parent->hwaccel_mutex);
}
+ av_assert0(!avctx->hwaccel);
+
if (p->async_serializing) {
p->async_serializing = 0;
@@ -275,14 +291,10 @@ static int update_context_from_thread(AVCodecContext *dst, AVCodecContext *src,
dst->color_range = src->color_range;
dst->chroma_sample_location = src->chroma_sample_location;
- dst->hwaccel = src->hwaccel;
- dst->hwaccel_context = src->hwaccel_context;
-
dst->channels = src->channels;
dst->sample_rate = src->sample_rate;
dst->sample_fmt = src->sample_fmt;
dst->channel_layout = src->channel_layout;
- dst->internal->hwaccel_priv_data = src->internal->hwaccel_priv_data;
if (!!dst->hw_frames_ctx != !!src->hw_frames_ctx ||
(dst->hw_frames_ctx && dst->hw_frames_ctx->data != src->hw_frames_ctx->data)) {
@@ -415,6 +427,12 @@ static int submit_packet(PerThreadContext *p, AVCodecContext *user_avctx,
pthread_mutex_unlock(&p->mutex);
return err;
}
+ /* transfer hwaccel state stashed from previous thread, if any */
+ av_assert0(!p->avctx->hwaccel);
+ FFSWAP(const AVHWAccel*, p->avctx->hwaccel, fctx->stash_hwaccel);
+ FFSWAP(void*, p->avctx->hwaccel_context, fctx->stash_hwaccel_context);
+ FFSWAP(void*, p->avctx->internal->hwaccel_priv_data, fctx->stash_hwaccel_priv);
+
}
av_packet_unref(&p->avpkt);
@@ -616,6 +634,15 @@ void ff_thread_finish_setup(AVCodecContext *avctx) {
async_lock(p->parent);
}
+ /* save hwaccel state for passing to the next thread;
+ * this is done here so that this worker thread can wipe its own hwaccel
+ * state after decoding, without requiring synchronization */
+ av_assert0(!p->parent->stash_hwaccel);
+ p->parent->stash_hwaccel = avctx->hwaccel;
+ p->parent->stash_hwaccel_context = avctx->hwaccel_context;
+ p->parent->stash_hwaccel_priv = avctx->internal->hwaccel_priv_data;
+
+
pthread_mutex_lock(&p->progress_mutex);
if(atomic_load(&p->state) == STATE_SETUP_FINISHED){
av_log(avctx, AV_LOG_WARNING, "Multiple ff_thread_finish_setup() calls\n");
@@ -657,13 +684,6 @@ void ff_frame_thread_free(AVCodecContext *avctx, int thread_count)
park_frame_worker_threads(fctx, thread_count);
- if (fctx->prev_thread && fctx->prev_thread != fctx->threads)
- if (update_context_from_thread(fctx->threads->avctx, fctx->prev_thread->avctx, 0) < 0) {
- av_log(avctx, AV_LOG_ERROR, "Final thread update failed\n");
- fctx->prev_thread->avctx->internal->is_copy = fctx->threads->avctx->internal->is_copy;
- fctx->threads->avctx->internal->is_copy = 1;
- }
-
for (i = 0; i < thread_count; i++) {
PerThreadContext *p = &fctx->threads[i];
@@ -713,6 +733,14 @@ void ff_frame_thread_free(AVCodecContext *avctx, int thread_count)
pthread_mutex_destroy(&fctx->async_mutex);
pthread_cond_destroy(&fctx->async_cond);
+ /* if we have stashed hwaccel state, move it to the user-facing context,
+ * so it will be freed in avcodec_close() */
+ av_assert0(!avctx->hwaccel);
+ FFSWAP(const AVHWAccel*, avctx->hwaccel, fctx->stash_hwaccel);
+ FFSWAP(void*, avctx->hwaccel_context, fctx->stash_hwaccel_context);
+ FFSWAP(void*, avctx->internal->hwaccel_priv_data, fctx->stash_hwaccel_priv);
+
+
av_freep(&avctx->internal->thread_ctx);
if (avctx->priv_data && avctx->codec && avctx->codec->priv_class)
--
2.27.0

6
ffmpeg.spec
View File

@ -60,7 +60,7 @@
Summary: Digital VCR and streaming server
Name: ffmpeg%{?flavor}
Version: 4.2.4
Release: 16
Release: 17
License: %{ffmpeg_license}
URL: http://ffmpeg.org/
%if 0%{?date}
@ -85,6 +85,7 @@ Patch13: CVE-2021-38171.patch
Patch14: CVE-2021-28429.patch
Patch15: fix-CVE-2024-32230.patch
Patch16: CVE-2022-1475.patch
Patch17: CVE-2022-48434.patch
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
%{?_with_cuda:BuildRequires: cuda-minimal-build-%{_cuda_version_rpm} cuda-drivers-devel}
@ -418,6 +419,9 @@ install -pm755 tools/qt-faststart %{buildroot}%{_bindir}
%changelog
* Mon Jul 15 2024 happyworker <208suo@208suo.com> - 4.2.4-17
- Fix CVE-2022-48434
* Fri Jul 12 2024 happyworker <208suo@208suo.com> - 4.2.4-16
- Fix CVE-2022-1475