From ca66d82a5cadaee4fddb09b3df119a5d4ffc7912 Mon Sep 17 00:00:00 2001
From: pangqing <pangqing@uniontech.com>
Date: Mon, 26 Aug 2024 18:15:45 +0800
Subject: [PATCH] fix CVE-2024-31578 and CVE-2024-31582

Signed-off-by: pangqing <pangqing@uniontech.com>
---
 CVE-2024-31578.patch | 35 +++++++++++++++++++++++++++++++++++
 CVE-2024-31582.patch | 27 +++++++++++++++++++++++++++
 ffmpeg.spec          | 10 ++++++++--
 3 files changed, 70 insertions(+), 2 deletions(-)
 create mode 100644 CVE-2024-31578.patch
 create mode 100644 CVE-2024-31582.patch

diff --git a/CVE-2024-31578.patch b/CVE-2024-31578.patch
new file mode 100644
index 0000000..93bf646
--- /dev/null
+++ b/CVE-2024-31578.patch
@@ -0,0 +1,35 @@
+---
+ libavutil/hwcontext.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/libavutil/hwcontext.c b/libavutil/hwcontext.c
+index 3650d46..0ef3479 100644
+--- a/libavutil/hwcontext.c
++++ b/libavutil/hwcontext.c
+@@ -363,7 +363,7 @@ int av_hwframe_ctx_init(AVBufferRef *ref)
+     if (ctx->internal->hw_type->frames_init) {
+         ret = ctx->internal->hw_type->frames_init(ctx);
+         if (ret < 0)
+-            goto fail;
++            return ret;
+     }
+ 
+     if (ctx->internal->pool_internal && !ctx->pool)
+@@ -373,14 +373,10 @@ int av_hwframe_ctx_init(AVBufferRef *ref)
+     if (ctx->initial_pool_size > 0) {
+         ret = hwframe_pool_prealloc(ref);
+         if (ret < 0)
+-            goto fail;
++            return ret;
+     }
+ 
+     return 0;
+-fail:
+-    if (ctx->internal->hw_type->frames_uninit)
+-        ctx->internal->hw_type->frames_uninit(ctx);
+-    return ret;
+ }
+ 
+ int av_hwframe_transfer_get_formats(AVBufferRef *hwframe_ref,
+-- 
+2.27.0
diff --git a/CVE-2024-31582.patch b/CVE-2024-31582.patch
new file mode 100644
index 0000000..d4b08ad
--- /dev/null
+++ b/CVE-2024-31582.patch
@@ -0,0 +1,27 @@
+From 99debe5f823f45a482e1dc08de35879aa9c74bd2 Mon Sep 17 00:00:00 2001
+From: Zhao Zhili <zhilizhao@tencent.com>
+Date: Mon, 29 Apr 2024 17:42:23 +0800
+Subject: [PATCH] avfilter/vf_codecview: fix heap buffer overflow.
+And improve the performance by a little bit.
+
+Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
+---
+ libavfilter/vf_codecview.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/libavfilter/vf_codecview.c b/libavfilter/vf_codecview.c
+index 55d9c8c..f65ccbd 100644
+--- a/libavfilter/vf_codecview.c
++++ b/libavfilter/vf_codecview.c
+@@ -216,9 +216,6 @@ static void draw_block_rectangle(uint8_t *buf, int sx, int sy, int w, int h, ptr
+         buf[sx + w - 1] = color;
+         buf += stride;
+     }
+-
+-    for (int x = sx; x < sx + w; x++)
+-        buf[x] = color;
+ }
+ 
+ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
+-- 
+2.27.0
diff --git a/ffmpeg.spec b/ffmpeg.spec
index 3d53162..5d4b60a 100644
--- a/ffmpeg.spec
+++ b/ffmpeg.spec
@@ -1,4 +1,4 @@
-%define anolis_release 3
+%define anolis_release 4
 
 %global av_codec_soversion 60
 %global av_device_soversion 60
@@ -21,6 +21,9 @@ License:        GPL-3.0-or-later
 URL:            https://ffmpeg.org
 Source0:        https://ffmpeg.org/releases/%{name}-%{version}.tar.xz
 
+Patch1:         CVE-2024-31582.patch
+Patch2:         CVE-2024-31578.patch
+
 BuildRequires: lame-devel >= 3.98.3
 BuildRequires: libtool
 BuildRequires: make
@@ -261,7 +264,7 @@ pixel format conversion operations.
 This subpackage contains the headers for FFmpeg libswscale.
 
 %prep
-%autosetup -n %{name}-%{version}
+%autosetup -p1 -n %{name}-%{version}
 sed -i "s|check_host_cflags -O3|check_host_cflags %{optflags}|" configure
 install -m0755 -d _doc/examples
 cp -a doc/examples/{*.c,Makefile,README} _doc/examples/
@@ -404,6 +407,9 @@ rm -rf %{buildroot}%{_datadir}/%{name}/examples
 
 
 %changelog
+* Mon Aug 26 2024 pangqing <pangqing@uniontech.com> - 6.1.1-4
+- fix CVE-2024-31582 and CVE-2024-31578 
+
 * Fri Jan 19 2024 Funda Wang <fundawang@yeah.net> - 6.1.1-3
 - Drop Recommends on openh264, as we do not dlopen it for now
 
-- 
Gitee