summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia
AgeCommit message (Collapse)Author
2024-09-10tiff: Fix LICENSENiko Mauno
The contents of the LICENSE.md file included in the current source code package match those of libtiff license, which seems to have been the case since 1999 commit https://gitlab.com/libtiff/libtiff/-/commit/0ef31e1f62aa7a8b1c488a59c4930775ee0046e4 where it was added with filename COPYRIGHT and was then changed to LICENSE.md in 2022 commit https://gitlab.com/libtiff/libtiff/-/commit/fa1d6d787fc67a1eeb3abccb790b5bee969d424b (From OE-Core rev: 71d8e8b03349ab18dca558055c2b3a3687785ddf) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-08-16Tiff: Security fix for CVE-2024-7006Siddharth Doshi
Upstream-Status: Backport from [https://gitlab.com/libtiff/libtiff/-/commit/818fb8ce881cf839fbc710f6690aadb992aa0f9e] CVE's Fixed: CVE-2024-7006 libtiff: NULL pointer dereference in tif_dirinfo.c Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-07-01gstreamer1.0-plugins-base: fix CVE-2024-4453Archana Polampalli
GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-23896. Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-05-10gstreamer1.0-plugins-bad: fix CVE-2023-50186Vijay Anusuri
Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/a46737a73155fe1c19fa5115df40da35426f9fb5] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-05-08gstreamer1.0-plugins-bad: fix CVE-2023-44446Archana Polampalli
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-05-03gstreamer1.0-plugins-bad: fix CVE-2024-0444Archana Polampalli
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-04-02tiff: fix CVE-2023-52356 CVE-2023-6277Lee Chee Yang
import patch from ubuntu to fix CVE-2023-52356 CVE-2023-6277 import from http://archive.ubuntu.com/ubuntu/pool/main/t/tiff/tiff_4.3.0-6ubuntu0.8.debian.tar.xz Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-19tiff: fix CVE-2023-6228Yogita Urade
CVE-2023-6228: An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash. References: https://nvd.nist.gov/vuln/detail/CVE-2023-6228 https://gitlab.com/libtiff/libtiff/-/issues/606 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-19ffmpeg: fix for CVE-2022-3965mark.yang
Without a CVE tag, It will be recognised as Unpatched by cve_check task. Signed-off-by: mark.yang <mark.yang@lge.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-19ffmpeg: fix for CVE-2022-3964mark.yang
Without a CVE tag, It will be recognised as Unpatched by cve_check task. Signed-off-by: mark.yang <mark.yang@lge.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-14gstreamer1.0-plugins-base: enable glx/opengl supportAlexander Kanavin
This is required by latest webkit when built with x11 support. (From OE-Core rev: 024edebf6f722ae4d05411be348730d9eeb3bd7c) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-30libsndfile: fix CVE-2022-33065 Signed integer overflow in src/mat4.cVivek Kumbhar
Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-23gstreamer1.0-plugins-bad: fix CVE-2023-44429Archana Polampalli
AV1 codec parser buffer overflow Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-14tiff: Backport fix for CVE-2023-41175Vijay Anusuri
Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/6e2dac5f904496d127c92ddc4e56eccfca25c2ee] Reference: https://security-tracker.debian.org/tracker/CVE-2023-41175 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-03libwebp: Fix CVE-2023-4863Soumya Sambu
Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Removed CVE-2023-5129.patch as CVE-2023-5129 is duplicate of CVE-2023-4863. CVE: CVE-2023-4863 References: https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://security-tracker.debian.org/tracker/CVE-2023-4863 https://bugzilla.redhat.com/show_bug.cgi?id=2238431#c12 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-31tiff: CVE patch correction for CVE-2023-3576Vijay Anusuri
- The commit [https://gitlab.com/libtiff/libtiff/-/commit/881a070194783561fd209b7c789a4e75566f7f37] fixes CVE-2023-3576 - Hence, renamed the CVE-2023-3618-1.patch to CVE-2023-3576.patch - Reference: https://security-tracker.debian.org/tracker/CVE-2023-3576 https://security-tracker.debian.org/tracker/CVE-2023-3618 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-17tiff: Security fix for CVE-2023-40745Siddharth Doshi
Upstream-Status: Backport from [https://gitlab.com/libtiff/libtiff/-/commit/4fc16f649fa2875d5c388cf2edc295510a247ee5] CVE: CVE-2023-40745 Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-17libtiff: Add fix for tiffcrop CVE-2023-1916Hitendra Prajapati
Add fix for tiffcrop tool CVE-2023-1916 [1]. A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x. The tool is no longer part of newer libtiff distributions, hence the fix is rejected by upstream in [2]. The backport is still applicable to older versions of libtiff, pick the CVE fix from ubuntu 20.04 [3]. [1] https://nvd.nist.gov/vuln/detail/CVE-2023-1916 [2] https://gitlab.com/libtiff/libtiff/-/merge_requests/535 [3] https://packages.ubuntu.com/source/focal-updates/tiff Signed-off-by: Marek Vasut <marex@denx.de> Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/848434a81c443f59ec90d41218eba6e48a450a11 && https://gitlab.com/libtiff/libtiff/-/merge_requests/535 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-06libtiff: fix CVE-2022-40090 improved IFD-Loop handlingHitendra Prajapati
Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/c7caec9a4d8f24c17e667480d2c7d0d51c9fae41 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-27libwebp: Fix CVE-2023-5129Colin McAllister
Add patch from libwebp 1.2.4 to fix CVE-2023-5129 Signed-off-by: Colin McAllister <colinmca242@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-25gstreamer1.0-plugins-bad: fix CVE-2023-40476Archana Polampalli
gst-plugins-bad: h265parser: Fix possible overflow using max_sub_layers_minus1 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-25gstreamer1.0-plugins-bad: fix CVE-2023-40475Archana Polampalli
gst-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with AES3 audio Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-25gstreamer1.0-plugins-bad: fix CVE-2023-40474Archana Polampalli
gst-plugins-bad: Heap-based buffer overflow in the MXF file demuxer when handling malformed files with uncompressed video in GStreamer versions before 1.22.6 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-12flac: fix CVE-2020-22219Meenali Gupta
Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted input to the encoder. Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-30libtiff: fix CVE-2023-26966 Buffer OverflowHitendra Prajapati
Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/b0e1c25dd1d065200c8d8f59ad0afe014861a1b9 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-28tiff: fix CVE-2023-2908,CVE-2023-3316,CVE-2023-3618Hitendra Prajapati
Backport fixes for: * CVE-2023-2908 - Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f * CVE-2023-3316 - Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/d63de61b1ec3385f6383ef9a1f453e4b8b11d536 * CVE-2023-3618 - Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/881a070194783561fd209b7c789a4e75566f7f37 && https://gitlab.com/libtiff/libtiff/-/commit/b5c7d4c4e03333ac16b5cfb11acaaeaa493334f8 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-27ffmpeg: add CVE_CHECK_IGNORE for CVE-2023-39018Narpat Mali
CVE-2023-39018 belongs to ffmpeg-cli-wrapper (Java wrapper around the FFmpeg CLI) and not ffmpeg itself. As per CVE description, it is mentioned as FFmpeg 0.7.0 which is the version for ffmpeg-cli-wrapper and ffmpeg don't have 0.7.0 version at all. Debian & Bugzilla trackers have already marked as NOT-FOR-US/RESOLVED-INVALID. As it won't be affecting the ffmpeg package so, we can ignore the CVE-2023-39018 in ffmpeg recipe. References: https://github.com/bramp/ffmpeg-cli-wrapper https://github.com/FFmpeg/FFmpeg https://security-tracker.debian.org/tracker/CVE-2023-39018 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-39018 Upstream master patch: https://git.openembedded.org/openembedded-core/commit/?id=c21ed498b423c13463a4ae0bb475883cc7901847 Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-22gstreamer1.0: upgrade 1.20.6 -> 1.20.7Archana Polampalli
This release only contains bugfixes. Highlighted bugfixes in 1.20.7: Security fixes for flacparse, dvdspu, and subparse, and the RealMedia demuxer h265parse: Fix framerate handling filesink: Fix buffered mode writing of buffer lists and buffers with multiple memories asfmux, rtpbin_buffer_list test: fix possible unaligned write/read on 32-bit ARM ptp clock: Work around bug in ptpd in default configuration qtdemux: fix reverse playback regression with edit lists rtspsrc: various control path handling server compatibility improvements avviddec: fix potential deadlock on seeking with FFmpeg 6.x cerbero: Fix pango crash on 32bit Windows; move libass into non-GPL codecs Miscellaneous bug fixes, memory leak fixes, and other stability and reliability improvements https://nvd.nist.gov/vuln/detail/CVE-2023-37327 https://nvd.nist.gov/vuln/detail/CVE-2023-37328 https://nvd.nist.gov/vuln/detail/CVE-2023-37329 https://gstreamer.freedesktop.org/releases/1.20/#1.20.7 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-26libtiff: fix CVE-2023-26965 heap-based use after freeHitendra Prajapati
Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/ec8ef90c1f573c9eb1f17d6a056aa0015f184acf Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-26tiff: fix multiple CVEsHitendra Prajapati
Backport fixes for: * CVE-2023-25433 - Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/9c22495e5eeeae9e00a1596720c969656bb8d678 && https://gitlab.com/libtiff/libtiff/-/commit/688012dca2c39033aa2dc7bcea9796787cfd1b44 * CVE-2023-25434 & CVE-2023-25435 - Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/69818e2f2d246e6631ac2a2da692c3706b849c38 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-25tiff: fix multiple CVEsHitendra Prajapati
Bug-Debian: https://bugs.debian.org/1031632 Origin: https://gitlab.com/libtiff/libtiff/-/commit/afaabc3e50d4e5d80a94143f7e3c997e7e410f68 import from debian http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u7.debian.tar.xz fix multiple CVEs: CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-17libpng: Add ptest for libpngNikhil R
libpng is a platform-independent library which supports all PNG features. This ptest executes the below binaries, parses the png image and prints the image features. 1. pngfix - provides information about PNG image copyrights details. 2. pngtest - tests, optimizes and optionally fixes the zlib header in PNG files. 3. pngstest - verifies the integrity of PNG image by dumping chunk level information. 4. timepng - provides details about PNG image chunks. Signed-off-by: Nikhil R <nikhil.r@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-17libwebp: Fix CVE-2023-1999Soumya
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-1999 Upstream patch: https://github.com/webmproject/libwebp/commit/a486d800b60d0af4cc0836bf7ed8f21e12974129 Signed-off-by: Soumya <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-05-24gstreamer1.0: upgrade 1.20.5 -> 1.20.6Pablo Saavedra
Changelog: =========== audio: channel-mix: allow up to 64 channels instead of up to 63 channels AOM AV1 encoder timestamp handling improvements AV1 video codec caps handling improvements in aom plugin, isomp4 and matroska muxers/demuxers. avvidenc: fix bitrate control and timestamps off FFmpeg-based video encoders h264parse: fix missing timestamps on outputs when splitting a frame rtspsrc: more workarounds for servers with broken control uri handling playbin3: fix issue with UDP streams, making sure there's enough buffering qmlglsrc: Fix deadlock when stopping and some other fixes qtmux: fix default timescale unit for N/1001 framerates v4l2h264dec: Fix Raspberry Pi4 will not play video in application vtdec: Fix non-deterministic frame output after seeks wasapi2src: Fix loopback capture on Windows 10 Anniversary Update macOS, iOS: Fix Xcode 14 ABI breakage with older Xcode cerbero: Fix some regressions for CentOS in the 1.20 branch cerbero: Fix setuptools site.py breakage in Python 3.11 Fix gst-libav build against FFmpeg from git gobject-introspection annotation fixes for bindings Miscellaneous bug fixes, memory leak fixes, and other stability and reliability improvements Performance improvements Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-05-02ffmpeg: fix for CVE-2022-48434Narpat Mali
libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used). Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-04-12tiff: Add fix for CVE-2022-4645Pawan Badganchi
Below patch fixes the CVE-2022-4645 as well. 0001-Revised-handling-of-TIFFTAG_INKNAMES-and-related-TIF.patch Link: https://nvd.nist.gov/vuln/detail/CVE-2022-4645 Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-03-14tiff: fix multiple CVEsChee Yang Lee
import patch from debian to fix CVE-2022-48281 http://security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.2.0-1+deb11u4.debian.tar.xz import patch from fedora to fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804 https://src.fedoraproject.org/rpms/libtiff/c/91856895aadf3cce6353f40c2feef9bf0b486440 Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit d9ce9b37236f5c16ffba4572ad720aeb50edeee9) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-01-19tiff: Add packageconfig knob for webpKhem Raj
tiff-native otherwise falsely detects webp if its installed on build host. This ensures deterministic behavior regardless of host. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 718c44f282310b2ca85877fed706460ccc1eebea) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-01-19ffmpeg: fix for CVE-2022-3341Narpat Mali
avformat/nutdec: Add check for avformat_new_stream Check for failure of avformat_new_stream() and propagate the error code. Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-01-16ffmpeg: refresh patches to apply cleanlyMartin Jansa
* the last patch added in: https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=874b72fe259cd3a23f4613fccfe2e9cc3f79cd6a doesn't apply cleanly. * fixes: ERROR: ffmpeg-5.0.1-r0 do_patch: Fuzz detected: Applying patch 0001-avcodec-vp3-Add-missing-check-for-av_malloc.patch patching file libavcodec/vp3.c Hunk #1 succeeded at 2677 with fuzz 1 (offset -2 lines). Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-01-12gstreamer1.0: Fix race conditions in gstbin testsJose Quaresma
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b57df3fe9c1623ba2f5a9a0e11a85dcdc77e76a5) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-01-12Revert "gstreamer1.0: disable flaky gstbin:test_watch_for_state_change test"Jose Quaresma
This reverts commit 220a527d269f146bdabd66040b5bee7de9e3fd3f. - Drop this patch and use the upstream solution https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2643 Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9660045d07a2b492ac48a1f1b08aa4288b45d64a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-01-12ffmpeg: fix for CVE-2022-3109Narpat Mali
An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting availability. CVE: CVE-2022-3109 Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/656cb0450aeb73b25d7d26980af342b37ac4c568] Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-01-06gstreamer1.0: upgrade 1.20.4 -> 1.20.5Wang Mingyu
Changelog: =========== systemclock waiting fixes for certain 32-bit platforms/libcs alphacombine: robustness improvements for corner case scenarios avfvideosrc: Report latency when doing screen capture d3d11videosink: various thread-safety and stability fixes decklink: fix performance issue when HDMI signal has been lost for a long time flacparse: Fix handling of headers advertising 32 bits per sample mpegts: Handle when iconv doesn't support ISO 6937 (e.g. musl libc) opengl: fix automatic dispmanx detection for rpi4 and fix usage of eglCreate/DestroyImage opusdec: Various channel-related fixes textrender: event handling fixes, esp. for GAP event subparse: Fix non-closed tag handling videoscale: fix handling of unknown buffer metas videosink: reverse playback handling fixes qtmux: Prefill mode fixes, especially for raw audio multiudpsink: allow binding to IPv6 address rtspsrc: Fix usage of IPv6 connections in SETUP rtspsrc: Only EOS on timeout if all streams are timed out/EOS splitmuxsrc: fix playback stall if there are unlinked pads v4l2: Fix SIGSEGV on state change during format changes wavparse robustness fixes Fix static linking on macOS (opengl, vulkan) gstreamer-vaapi: fix headless build against mesa >= 22.3.0 GStreamer Editing Services library: Fix build with tools disabled webrtc example/demo fixes unit test fixes for aesdec and rtpjitterbuffer Cerbero: Fix ios cross-compile with cmake on M1; some recipe updates and other build fixes Binary packages: pkg-config file fixes for various recipes (ffmpeg, taglib, gstreamer) Binary packages: Enable high bitdepth support for libvpx (VP8/VP9 encoding/decoding) Binary packages: ship aes plugin Miscellaneous bug fixes, memory leak fixes, and other stability and reliability improvements Performance improvements Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit fd8ab6052d88120c58cf84ad7d77d60c12ef3b8a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-01-06libpng: upgrade 1.6.38 -> 1.6.39Wang Mingyu
Changelog: ========== * Changed the error handler of oversized chunks (i.e. larger than PNG_USER_CHUNK_MALLOC_MAX) from png_chunk_error to png_benign_error. * Fixed a buffer overflow error in contrib/tools/pngfix. * Fixed a memory leak (CVE-2019-6129) in contrib/tools/pngcp. * Disabled the ARM Neon optimizations by default in the CMake file, following the default behavior of the configure script. * Allowed configure.ac to work with the trunk version of autoconf. * Removed the support for "install" targets from the legacy makefiles; removed the obsolete makefile.cegcc. * Cleaned up the code and updated the internal documentation. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 19799cb50a00561b318cba1c8c20737f20e4a47f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-11-29tiff: add CVE tag to b258ed69a485a9cfb299d9f060eb2a46c54e5903.patchMartin Jansa
* according to https://bugzilla.redhat.com/show_bug.cgi?id=2118863 this commit should be the fix for CVE-2022-2868 * resolves false-possitive entry in: https://lists.yoctoproject.org/g/yocto-security/message/705 CVE-2022-2868 (CVSS3: 8.1 HIGH): tiff https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-2868 Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-28tiff: Security fix for CVE-2022-3970Qiu, Zheng
This patch contains a fix for CVE-2022-3970 Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-3970 https://security-tracker.debian.org/tracker/CVE-2022-3970 Patch generated from : https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-28tiff: fix a number of CVEsRoss Burton
Backport fixes from upstream for the following CVEs: - CVE-2022-3599 - CVE-2022-3597 - CVE-2022-3626 - CVE-2022-3627 - CVE-2022-3570 - CVE-2022-3598 Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-28tiff: refresh with devtoolMartin Jansa
* so that they can be easily and cleanly applied with "git am" * manually fix CVE-2022-2953.patch commit message not to use UTF-8 quotes and replace it with human readable text from original commit: https://gitlab.com/libtiff/libtiff/-/commit/8fe3735942ea1d90d8cef843b55b3efe8ab6feaf Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-25gstreamer1.0: upgrade 1.20.3 -> 1.20.4Alexander Kanavin
The fourth 1.20 bug-fix release (1.20.4) was released on 12 October 2022. This release only contains bugfixes and it should be safe to upgrade from 1.20.x. Highlighted bugfixes in 1.20.4 - avaudiodec: fix playback issue with WMA files, would throw an error at EOS with FFmpeg 5.x - Fix deadlock when loading gst-editing-services plugin - Fix input buffering capacity in live mode for aggregator, video/audio aggregator subclasses, muxers - glimagesink: fix crash on Android - subtitle handling and subtitle overlay fixes - matroska-mux: allow width + height changes for avc3|hev1|vp8|vp9 - rtspsrc: fix control url handling for spec compliant servers and add fallback for incompliant servers - WebRTC fixes - RTP retransmission fixes - video: fixes for formats with 4x subsampling and horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9) - macOS build and packaging fixes, in particular fix finding of gio modules on macOS for https/TLS support - Fix consuming of the macOS package as a framework in XCode - Performance improvements - Miscellaneous bug fixes, memory leak fixes, and other stability and reliability improvements Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 58e4825328dafd7f593d9eb42be5506408627a31) Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-09-25 15:48:19 +0000