diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000000000000000000000000000000000000..f087b429e2f81a9f37b28a8308e2210f84df6c9b --- /dev/null +++ b/.gitattributes @@ -0,0 +1 @@ +*.tar.gz filter=lfs diff=lfs merge=lfs -text diff --git a/.lfsconfig b/.lfsconfig new file mode 100644 index 0000000000000000000000000000000000000000..c20b74e95fd10d2ce246b60c6fee626ab1ce9d29 --- /dev/null +++ b/.lfsconfig @@ -0,0 +1,2 @@ +[lfs] + url = https://artlfs.openeuler.openatom.cn/src-openEuler/libvpx diff --git a/CVE-2025-5283-vpx_codec_enc_init_multi-fix-double-free-on-init-fai.patch b/CVE-2025-5283-vpx_codec_enc_init_multi-fix-double-free-on-init-fai.patch deleted file mode 100644 index 99513d013646acc45ea71b052719b780633fba77..0000000000000000000000000000000000000000 --- a/CVE-2025-5283-vpx_codec_enc_init_multi-fix-double-free-on-init-fai.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 1c758781c428c0e895645b95b8ff1512b6bdcecb Mon Sep 17 00:00:00 2001 -From: James Zern -Date: Wed, 30 Apr 2025 19:28:48 -0700 -Subject: [PATCH] vpx_codec_enc_init_multi: fix double free on init failure - -In `vp8e_init()`, the encoder would take ownership of -`mr_cfg.mr_low_res_mode_info` even if `vp8_create_compressor()` failed. -This caused confusion at the call site as other failures in -`vp8e_init()` did not result in ownership transfer and the caller would -free the memory. In the case of `vp8_create_compressor()` failure both -the caller and `vpx_codec_destroy()` would free the memory, causing a -crash. `mr_*` related variables are now cleared on failure to prevent -this situation. - -Bug: webm:413411335 -Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1962421 -Change-Id: Ie951d42b9029a586bf9059b650bd8863db9f9ffc ---- - vp8/vp8_cx_iface.c | 12 +++++++++++- - vpx/src/vpx_encoder.c | 3 +++ - 2 files changed, 14 insertions(+), 1 deletion(-) - -diff --git a/vp8/vp8_cx_iface.c b/vp8/vp8_cx_iface.c -index 38456d2b90c7..35c94fb04343 100644 ---- a/vp8/vp8_cx_iface.c -+++ b/vp8/vp8_cx_iface.c -@@ -732,7 +732,17 @@ static vpx_codec_err_t vp8e_init(vpx_codec_ctx_t *ctx, - - set_vp8e_config(&priv->oxcf, priv->cfg, priv->vp8_cfg, mr_cfg); - priv->cpi = vp8_create_compressor(&priv->oxcf); -- if (!priv->cpi) res = VPX_CODEC_MEM_ERROR; -+ if (!priv->cpi) { -+#if CONFIG_MULTI_RES_ENCODING -+ // Release ownership of mr_cfg->mr_low_res_mode_info on failure. This -+ // prevents ownership confusion with the caller and avoids a double -+ // free when vpx_codec_destroy() is called on this instance. -+ priv->oxcf.mr_total_resolutions = 0; -+ priv->oxcf.mr_encoder_id = 0; -+ priv->oxcf.mr_low_res_mode_info = NULL; -+#endif -+ res = VPX_CODEC_MEM_ERROR; -+ } - } - } - -diff --git a/vpx/src/vpx_encoder.c b/vpx/src/vpx_encoder.c -index 001d854abe9c..3af4cea3a70f 100644 ---- a/vpx/src/vpx_encoder.c -+++ b/vpx/src/vpx_encoder.c -@@ -114,6 +114,9 @@ vpx_codec_err_t vpx_codec_enc_init_multi_ver( - ctx->priv = NULL; - ctx->init_flags = flags; - ctx->config.enc = cfg; -+ // ctx takes ownership of mr_cfg.mr_low_res_mode_info if and only if -+ // this call succeeds. The first ctx entry in the array is -+ // responsible for freeing the memory. - res = ctx->iface->init(ctx, &mr_cfg); - } - --- -2.49.0 - diff --git a/libvpx.spec b/libvpx.spec index 54f6ff5380a0765e6f47288d642890f729317006..771db1876f3a8e14b672a09bcb8401a9bc480aa9 100644 --- a/libvpx.spec +++ b/libvpx.spec @@ -1,11 +1,10 @@ Name: libvpx -Version: 1.15.0 -Release: 2 +Version: 1.15.2 +Release: 1 Summary: VP8/VP9 Video Codec SDK License: BSD-3-Clause Source0: https://github.com/webmproject/libvpx/archive/v%{version}.tar.gz Patch0: add-riscv64-arch.patch -Patch1: CVE-2025-5283-vpx_codec_enc_init_multi-fix-double-free-on-init-fai.patch URL: http://www.webmproject.org/code/ BuildRequires: gcc gcc-c++ doxygen, perl(Getopt::Long) %ifarch %{ix86} x86_64 @@ -90,6 +89,11 @@ touch -r AUTHORS %{buildroot}%{_includedir}/vpx/vpx_config.h %{_libdir}/libvpx.so %changelog +* Tue Aug 26 2025 yaoxin <1024769339@qq.com> - 1.15.2-1 +- Update to 1.15.2: + * fixes CVE-2025-5283 + * bumps up the SO major version and fixes the language about ABI compatibility + * Thu May 29 2025 yaoxin <1024769339@qq.com> - 1.15.0-2 - Fix CVE-2025-5283 diff --git a/v1.15.0.tar.gz b/v1.15.0.tar.gz deleted file mode 100644 index 065f524950b1a322202ba27f2b5c586ba65b87bd..0000000000000000000000000000000000000000 Binary files a/v1.15.0.tar.gz and /dev/null differ diff --git a/v1.15.2.tar.gz b/v1.15.2.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..c22574e1838dc7fbede908536b9917f342a7f682 --- /dev/null +++ b/v1.15.2.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:26fcd3db88045dee380e581862a6ef106f49b74b6396ee95c2993a260b4636aa +size 5630368