From 4570909c29fd2210ab621108dfcbc2f36c1f97d4 Mon Sep 17 00:00:00 2001 From: starlet-dx <15929766099@163.com> Date: Thu, 29 May 2025 15:34:31 +0800 Subject: [PATCH] Fix CVE-2025-5283 (cherry picked from commit 08c270474f8d3c3c96c4d0f528ca765b370c336e) --- ...it_multi-fix-double-free-on-init-fai.patch | 62 +++++++++++++++++++ libvpx.spec | 6 +- 2 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 CVE-2025-5283-vpx_codec_enc_init_multi-fix-double-free-on-init-fai.patch diff --git a/CVE-2025-5283-vpx_codec_enc_init_multi-fix-double-free-on-init-fai.patch b/CVE-2025-5283-vpx_codec_enc_init_multi-fix-double-free-on-init-fai.patch new file mode 100644 index 0000000..99513d0 --- /dev/null +++ b/CVE-2025-5283-vpx_codec_enc_init_multi-fix-double-free-on-init-fai.patch @@ -0,0 +1,62 @@ +From 1c758781c428c0e895645b95b8ff1512b6bdcecb Mon Sep 17 00:00:00 2001 +From: James Zern +Date: Wed, 30 Apr 2025 19:28:48 -0700 +Subject: [PATCH] vpx_codec_enc_init_multi: fix double free on init failure + +In `vp8e_init()`, the encoder would take ownership of +`mr_cfg.mr_low_res_mode_info` even if `vp8_create_compressor()` failed. +This caused confusion at the call site as other failures in +`vp8e_init()` did not result in ownership transfer and the caller would +free the memory. In the case of `vp8_create_compressor()` failure both +the caller and `vpx_codec_destroy()` would free the memory, causing a +crash. `mr_*` related variables are now cleared on failure to prevent +this situation. + +Bug: webm:413411335 +Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1962421 +Change-Id: Ie951d42b9029a586bf9059b650bd8863db9f9ffc +--- + vp8/vp8_cx_iface.c | 12 +++++++++++- + vpx/src/vpx_encoder.c | 3 +++ + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/vp8/vp8_cx_iface.c b/vp8/vp8_cx_iface.c +index 38456d2b90c7..35c94fb04343 100644 +--- a/vp8/vp8_cx_iface.c ++++ b/vp8/vp8_cx_iface.c +@@ -732,7 +732,17 @@ static vpx_codec_err_t vp8e_init(vpx_codec_ctx_t *ctx, + + set_vp8e_config(&priv->oxcf, priv->cfg, priv->vp8_cfg, mr_cfg); + priv->cpi = vp8_create_compressor(&priv->oxcf); +- if (!priv->cpi) res = VPX_CODEC_MEM_ERROR; ++ if (!priv->cpi) { ++#if CONFIG_MULTI_RES_ENCODING ++ // Release ownership of mr_cfg->mr_low_res_mode_info on failure. This ++ // prevents ownership confusion with the caller and avoids a double ++ // free when vpx_codec_destroy() is called on this instance. ++ priv->oxcf.mr_total_resolutions = 0; ++ priv->oxcf.mr_encoder_id = 0; ++ priv->oxcf.mr_low_res_mode_info = NULL; ++#endif ++ res = VPX_CODEC_MEM_ERROR; ++ } + } + } + +diff --git a/vpx/src/vpx_encoder.c b/vpx/src/vpx_encoder.c +index 001d854abe9c..3af4cea3a70f 100644 +--- a/vpx/src/vpx_encoder.c ++++ b/vpx/src/vpx_encoder.c +@@ -114,6 +114,9 @@ vpx_codec_err_t vpx_codec_enc_init_multi_ver( + ctx->priv = NULL; + ctx->init_flags = flags; + ctx->config.enc = cfg; ++ // ctx takes ownership of mr_cfg.mr_low_res_mode_info if and only if ++ // this call succeeds. The first ctx entry in the array is ++ // responsible for freeing the memory. + res = ctx->iface->init(ctx, &mr_cfg); + } + +-- +2.49.0 + diff --git a/libvpx.spec b/libvpx.spec index 18608a0..91bbe0b 100644 --- a/libvpx.spec +++ b/libvpx.spec @@ -1,6 +1,6 @@ Name: libvpx Version: 1.13.1 -Release: 3 +Release: 4 Summary: VP8/VP9 Video Codec SDK License: BSD-3-Clause Source0: https://github.com/webmproject/libvpx/archive/v%{version}.tar.gz @@ -10,6 +10,7 @@ Patch2: CVE-2024-5197-1.patch Patch3: CVE-2024-5197-2.patch Patch4: CVE-2024-5197-3.patch Patch5: add-sw_64-support.patch +Patch6: CVE-2025-5283-vpx_codec_enc_init_multi-fix-double-free-on-init-fai.patch URL: http://www.webmproject.org/code/ BuildRequires: gcc gcc-c++ doxygen, php-cli, perl(Getopt::Long) %ifarch x86_64 @@ -119,6 +120,9 @@ mv %{buildroot}%{_prefix}/src/vpx_scale %{buildroot}%{_includedir}/ %{_libdir}/libvpx.so %changelog +* Thu May 29 2025 yaoxin <1024769339@qq.com> - 1.13.1-4 +- Fix CVE-2025-5283 + * Sat Mar 15 2025 mahailiang - 1.13.1-3 - add sw_64 support -- Gitee