[Buildroot] [PATCH 1/1] package/ffmpeg: fix CVE-2020-12284

Thomas Petazzoni thomas.petazzoni at bootlin.com
Sat May 9 16:47:42 UTC 2020


On Thu,  7 May 2020 00:09:14 +0200
Fabrice Fontaine <fontaine.fabrice at gmail.com> wrote:

> cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.2.2 has a
> heap-based buffer overflow during JPEG_MARKER_SOS handling because of a
> missing length check.
> 
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice at gmail.com>
> ---
>  ...vcodec-cbs_jpeg-Check-length-for-SOS.patch | 33 +++++++++++++++++++
>  package/ffmpeg/ffmpeg.mk                      |  3 ++
>  2 files changed, 36 insertions(+)
>  create mode 100644 package/ffmpeg/0001-avcodec-cbs_jpeg-Check-length-for-SOS.patch

Applied to master, thanks.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com



More information about the buildroot mailing list