[Buildroot] [PATCH 1/1] package/ffmpeg: fix CVE-2020-12284
Thomas Petazzoni
thomas.petazzoni at bootlin.com
Sat May 9 16:47:42 UTC 2020
On Thu, 7 May 2020 00:09:14 +0200
Fabrice Fontaine <fontaine.fabrice at gmail.com> wrote:
> cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.2.2 has a
> heap-based buffer overflow during JPEG_MARKER_SOS handling because of a
> missing length check.
>
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice at gmail.com>
> ---
> ...vcodec-cbs_jpeg-Check-length-for-SOS.patch | 33 +++++++++++++++++++
> package/ffmpeg/ffmpeg.mk | 3 ++
> 2 files changed, 36 insertions(+)
> create mode 100644 package/ffmpeg/0001-avcodec-cbs_jpeg-Check-length-for-SOS.patch
Applied to master, thanks.
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
More information about the buildroot
mailing list