diff --git a/CVE-2023-44488.patch b/CVE-2023-44488.patch deleted file mode 100644 index a73a5c992676720f95d9433ca77d58a1f936b4ed..0000000000000000000000000000000000000000 --- a/CVE-2023-44488.patch +++ /dev/null @@ -1,100 +0,0 @@ -From df9fd9d5b7325060b2b921558a1eb20ca7880937 Mon Sep 17 00:00:00 2001 -From: Jerome Jiang -Date: Thu, 30 Jun 2022 13:48:56 -0400 -Subject: [PATCH] Fix bug with smaller width bigger size - -Fixed previous patch that clusterfuzz failed on. - -Local fuzzing passing overnight. - -Bug: webm:1642 -Change-Id: If0e08e72abd2e042efe4dcfac21e4cc51afdfdb9 -(cherry picked from commit 263682c9a29395055f3b3afe2d97be1828a6223f) ---- - vp9/common/vp9_alloccommon.c | 13 ++++++------- - vp9/encoder/vp9_encoder.c | 27 +++++++++++++++++++++++++-- - 2 files changed, 4 insertions(+), 2 deletions(-) - -diff --git a/vp9/common/vp9_alloccommon.c b/vp9/common/vp9_alloccommon.c -index e53883f621d..9e73e40ea09 100644 ---- a/vp9/common/vp9_alloccommon.c -+++ b/vp9/common/vp9_alloccommon.c -@@ -135,13 +135,6 @@ int vp9_alloc_context_buffers(VP9_COMMON *cm, int width, int height) { - cm->free_mi(cm); - if (cm->alloc_mi(cm, new_mi_size)) goto fail; - } -- -- if (cm->seg_map_alloc_size < cm->mi_rows * cm->mi_cols) { -- // Create the segmentation map structure and set to 0. -- free_seg_map(cm); -- if (alloc_seg_map(cm, cm->mi_rows * cm->mi_cols)) goto fail; -- } -- - if (cm->above_context_alloc_cols < cm->mi_cols) { - vpx_free(cm->above_context); - cm->above_context = (ENTROPY_CONTEXT *)vpx_calloc( -@@ -156,6 +149,12 @@ int vp9_alloc_context_buffers(VP9_COMMON *cm, int width, int height) { - cm->above_context_alloc_cols = cm->mi_cols; - } - -+ if (cm->seg_map_alloc_size < cm->mi_rows * cm->mi_cols) { -+ // Create the segmentation map structure and set to 0. -+ free_seg_map(cm); -+ if (alloc_seg_map(cm, cm->mi_rows * cm->mi_cols)) goto fail; -+ } -+ - if (vp9_alloc_loop_filter(cm)) goto fail; - - return 0; -diff --git a/vp9/encoder/vp9_encoder.c b/vp9/encoder/vp9_encoder.c -index b66fdc0bca3..e3850775455 100644 ---- a/vp9/encoder/vp9_encoder.c -+++ b/vp9/encoder/vp9_encoder.c -@@ -1973,6 +1973,17 @@ static void alloc_copy_partition_data(VP9_COMP *cpi) { - } - } - -+static void free_copy_partition_data(VP9_COMP *cpi) { -+ vpx_free(cpi->prev_partition); -+ cpi->prev_partition = NULL; -+ vpx_free(cpi->prev_segment_id); -+ cpi->prev_segment_id = NULL; -+ vpx_free(cpi->prev_variance_low); -+ cpi->prev_variance_low = NULL; -+ vpx_free(cpi->copied_frame_cnt); -+ cpi->copied_frame_cnt = NULL; -+} -+ - void vp9_change_config(struct VP9_COMP *cpi, const VP9EncoderConfig *oxcf) { - VP9_COMMON *const cm = &cpi->common; - RATE_CONTROL *const rc = &cpi->rc; -@@ -2052,6 +2063,8 @@ void vp9_change_config(struct VP9_COMP *cpi, const VP9EncoderConfig *oxcf) { - new_mi_size = cm->mi_stride * calc_mi_size(cm->mi_rows); - if (cm->mi_alloc_size < new_mi_size) { - vp9_free_context_buffers(cm); -+ vp9_free_pc_tree(&cpi->td); -+ vpx_free(cpi->mbmi_ext_base); - alloc_compressor_data(cpi); - realloc_segmentation_maps(cpi); - cpi->initial_width = cpi->initial_height = 0; -@@ -2070,8 +2083,18 @@ void vp9_change_config(struct VP9_COMP *cpi, const VP9EncoderConfig *oxcf) { - update_frame_size(cpi); - - if (last_w != cpi->oxcf.width || last_h != cpi->oxcf.height) { -- memset(cpi->consec_zero_mv, 0, -- cm->mi_rows * cm->mi_cols * sizeof(*cpi->consec_zero_mv)); -+ vpx_free(cpi->consec_zero_mv); -+ CHECK_MEM_ERROR( -+ cm, cpi->consec_zero_mv, -+ vpx_calloc(cm->mi_rows * cm->mi_cols, sizeof(*cpi->consec_zero_mv))); -+ -+ vpx_free(cpi->skin_map); -+ CHECK_MEM_ERROR( -+ cm, cpi->skin_map, -+ vpx_calloc(cm->mi_rows * cm->mi_cols, sizeof(cpi->skin_map[0]))); -+ -+ free_copy_partition_data(cpi); -+ alloc_copy_partition_data(cpi); - if (cpi->oxcf.aq_mode == CYCLIC_REFRESH_AQ) - vp9_cyclic_refresh_reset_resize(cpi); - rc->rc_1_frame = 0; diff --git a/CVE-2023-5217.patch b/CVE-2023-5217.patch deleted file mode 100644 index 269cacafbad28990de294cf5e41eae947e83ebca..0000000000000000000000000000000000000000 --- a/CVE-2023-5217.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 3fbd1dca6a4d2dad332a2110d646e4ffef36d590 Mon Sep 17 00:00:00 2001 -From: James Zern -Date: Mon, 25 Sep 2023 18:55:59 -0700 -Subject: [PATCH] VP8: disallow thread count changes - -Currently allocations are done at encoder creation time. Going from -threaded to non-threaded would cause a crash. - -Bug: chromium:1486441 -Change-Id: Ie301c2a70847dff2f0daae408fbef1e4d42e73d4 ---- - vp8/encoder/onyx_if.c | 5 +++++ - 1 files changed, 1 insertions(+), 0 deletions(-) - -diff --git a/vp8/encoder/onyx_if.c b/vp8/encoder/onyx_if.c -index c65afc643bf..c5e9970c3cc 100644 ---- a/vp8/encoder/onyx_if.c -+++ b/vp8/encoder/onyx_if.c -@@ -1447,6 +1447,11 @@ void vp8_change_config(VP8_COMP *cpi, VP8_CONFIG *oxcf) { - last_h = cpi->oxcf.Height; - prev_number_of_layers = cpi->oxcf.number_of_layers; - -+ if (cpi->initial_width) { -+ // TODO(https://crbug.com/1486441): Allow changing thread counts; the -+ // allocation is done once in vp8_create_compressor(). -+ oxcf->multi_threaded = cpi->oxcf.multi_threaded; -+ } - cpi->oxcf = *oxcf; - - switch (cpi->oxcf.Mode) { diff --git a/libvpx.spec b/libvpx.spec index bd2cccd0c3088eb37a5c0048b55a42797051ce11..8e6beb2c5a44729c0d6d184ec52f9132f0a33d0a 100644 --- a/libvpx.spec +++ b/libvpx.spec @@ -1,12 +1,10 @@ Name: libvpx -Version: 1.12.0 -Release: 4 +Version: 1.13.1 +Release: 1 Summary: VP8/VP9 Video Codec SDK -License: BSD +License: BSD-3-Clause Source0: https://github.com/webmproject/libvpx/archive/v%{version}.tar.gz Patch0: add-riscv64-arch.patch -Patch1: CVE-2023-5217.patch -Patch2: CVE-2023-44488.patch URL: http://www.webmproject.org/code/ BuildRequires: gcc gcc-c++ doxygen, php-cli, perl(Getopt::Long) %ifarch x86_64 @@ -112,6 +110,10 @@ mv %{buildroot}%{_prefix}/src/vpx_scale %{buildroot}%{_includedir}/ %{_libdir}/libvpx.so %changelog +* Sat Nov 25 2023 Jingwiw - 1.13.1-1 +- Update to 1.13.1 version +- Migrate to SPDX license + * Sun Oct 01 2023 Funda Wang - 1.12.0-4 - Fix CVE-2023-5217, CVE-2023-44488 diff --git a/v1.12.0.tar.gz b/v1.13.1.tar.gz similarity index 49% rename from v1.12.0.tar.gz rename to v1.13.1.tar.gz index 16213f83b4f75a020a12ef55c823584b42607a10..a2455c38a057f9d2ef9d155f44d055cb3aaa0e07 100644 Binary files a/v1.12.0.tar.gz and b/v1.13.1.tar.gz differ