Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Need confirmation for some unpatched CVE in FFmpeg #789

Open
the-Chain-Warden-thresh opened this issue Oct 30, 2023 · 0 comments
Open

Need confirmation for some unpatched CVE in FFmpeg #789

the-Chain-Warden-thresh opened this issue Oct 30, 2023 · 0 comments

Comments

@the-Chain-Warden-thresh

I'm cloning this repo to make some modifications to customize. However, I've noticed that some CVEs which were confirmed and fixed by FFmpeg do not get patched in this repo. To enhance the availability of my project as far as possible, I will appreciate it if any of the CVE below do exist in this repo as well, so that I can fix these security issue myself by applying the corresponding patch.
Here are the CVEs I found in this repo unpatched, but get fixed in FFmpeg:

CVE-2014-2263 in trunk/libs/libav/ffmpeg-0.11.x/libavformat/mpegtsenc.c's function static int mpegts_write_pmt(AVFormatContext *s, MpegTSService *service), with patch here for your reference.

CVE-2012-2791 in trunk/libs/libav/ffmpeg-0.6.x/libavcodec/ivi_common.c's function int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile), with patch here for your reference.

CVE-2017-7862 in trunk/libs/libav/ffmpeg-0.11.x/libavcodec/pictordec.c's function static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPacket *avpkt), with patch here for your reference.

CVE-2012-2794 in trunk/libs/libav/ffmpeg-0.6.x/libavcodec/indeo5.c's function static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band, IVITile *tile, AVCodecContext *avctx), with patch here for your reference.

CVE-2020-20446 in trunk/libs/libav/ffmpeg-0.11.x/libavcodec/aacpsy.c's function static void psy_3gpp_analyze_channel(FFPsyContext *ctx, int channel, const float *coefs, const FFPsyWindowInfo *wi) , with patch here for your reference.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant