[Deepin Integration]~[v25-Release] fix(cve): CVE-2026-75143 - avformat/librist: honor the caller buffer size in librist_read by deepin-ci-robot@deepin-community/ffmpeg by deepin-community-ci-bot[bot]

[deepin-bot]

Package information | 软件包信息

包名	版本
ffmpeg	7:6.1.5-0deepin9

Package repository address | 软件包仓库地址

deb [trusted=yes] https://ci.deepin.com/repo/obs/deepin:/CI:/TestingIntegration:/test-integration-pr-4601/testing/ ./

Changelog | 更新信息

ffmpeg (7:6.1.5-0deepin9) unstable; urgency=medium

• fix(cve): CVE-2026-75143 (critical) - avformat/librist: honor the
  caller buffer size in librist_read Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a2
  5ab3db142ce390602.patch
• fix(cve): CVE-2026-66038 (high) - avcodec/lcldec: zero the not-
  decoded tail to avoid heap disclosure Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825
  b87d609963e862c8c.patch
• fix(cve): CVE-2026-65704 (high) - avformat/ty: don't let the Series2
  AC3 trim underflow the packet size Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/de771bd52774a52d45b0e2c
  82e56995a1ef40df7
• fix(cve): CVE-2026-70632 (high) - avcodec/cfhd: reject transform-2
  output wider than the plane Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c03
  1409058571c94f6a9.patch
• fix(cve): CVE-2026-75146 (high) - avformat/dashdec: reject a
  negative fragment index Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30e
  cc58f5935d4f151e0
• fix(cve): CVE-2026-65703 (high) - avcodec/tdsc: unref the reference
  frame before reallocating on size change Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d
  0b5ff45685766200c
• fix(cve): CVE-2026-75142 (high) - avformat/mpegenc: reject stream
  counts that overflow the system header Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b84826519285
  74de33772aeee7be1,https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b274f
  0d21ba684446fd59b49e00f3f8e9ed954df
• fix(cve): CVE-2026-65706 (high) - avfilter/vf_swaprect: size the
  temp row buffer for the widest plane Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a7e38b617b32f996beaa371
  bbf04b39907d7a527
• fix(cve): CVE-2026-70628 (high) - avcodec/dvbsub_parser: avoid
  signed overflow in the capacity check Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/93f2a525ec6c7b467bae683
  22720d10188fc6e30.patch
• fix(cve): CVE-2026-75141 (high) - avformat/hevc: reject hvcC NAL
  arrays that overflow the 16-bit count Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/acf5d7cdc1f9ae8752c23e1
  ea8d7f355ed780781.patch
• fix(cve): CVE-2026-75144 (high) - avformat/rtpenc_vc2hq: reject data
  units larger than the RTP payload buffer Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9
  b451e01c376398818.patch
• fix(cve): CVE-2026-64834 (high) - avformat/rtpdec_asf: reject ASF
  objects smaller than their header Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f06922
  20cc772b116abc632
• fix(cve): CVE-2026-64830 (high) - avformat/vobsub: reuse subtitle
  streams and bound the stream count Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433
  f4306582aa37c3951.patch
• fix(cve): CVE-2026-70631 (medium) - avcodec/tiff: reject inflate
  output shorter than the strip Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca
  632dd16481d8de39f
• fix(cve): CVE-2026-70629 (medium) - avcodec/rscc: do not leave
  uninitilized data when the input is too short Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b
  1e92665d7874d4fd7
• fix(cve): CVE-2026-13858 (medium) - avformat/mov: Fix negative index
  given to can_seek_to_key_sample() Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cb8a5ca8ab36884064ac4de
  5175ae82c93edfcb2.patch
• fix(ffv1): backport avcodec/rangecoder: eliminate main branch from
  renorm_encoder() The x86_64 FATE run fails for fate-vsynth1/2/3-ffv1-2pass,
  ffv1-v3-yuv422p10, ffv1-v3-yuv444p16 and ffv1-v3-rgb48 because
  --toolchain=hardened adds -fstack-protector-all, which makes gcc -O3
  miscompile the branchy form of renorm_encoder() that the 6.1 branch still
  carries; the FFV1 range coder then emits a corrupt extradata (190 -> 298
  bytes) which the decoder rejects with "quant_table_index out of range".
  The upstream rewrite is a pure refactoring (identical bitstream) and
  restores the reference hashes on all architectures. Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b2da4c33e31f85b9c755f2c
  db08f5db694e90ca9
• CVE-2026-66040: not-affected
  The overrun that upstream commit b506fafec9 hardens lives in the eXIf
  chunk writer of libavcodec/pngenc.c, which sizes the chunk from
  ff_exif_get_buffer()/AV_EXIF_TIFF_HEADER. Neither the helper nor
  AV_FRAME_DATA_EXIF exists in 6.1.5 - pngenc.c here never writes an eXIf
  chunk, EXIF output support was added after the 6.1 branch - so the
  vulnerable code is absent and no patch is required.
  Upstream: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc.patch
• fix(cve): CVE-2026-65705 (high) - avfilter/vf_floodfill: remove
  unneeded variables Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f186c50cf53aec20e9a2905
  9cb22ca3f2d59201c

[deepin-bot]

Integration Test Info

Test suggestion | 测试建议

Influence | 影响范围

ADDITIONAL INFORMATION | 额外补充

[deepin-bot]

IntegrationProjector Notify the author
@deepin: Integrated issue updated

[deepin-bot]

IntegrationProjector Bot
Deepin Testing Integration Project Manager Info
Link to deepin-community/Repository-Integration#4601