File ffmpeg-CVE-2020-20448.patch of Package ffmpeg.27460
diff --unified --recursive --text --new-file --color ffmpeg-3.4.2.old/libavcodec/snowenc.c ffmpeg-3.4.2.new/libavcodec/snowenc.c
--- ffmpeg-3.4.2.old/libavcodec/snowenc.c 2021-06-02 15:52:46.065508847 +0800
+++ ffmpeg-3.4.2.new/libavcodec/snowenc.c 2021-06-02 16:06:06.690987029 +0800
@@ -86,6 +86,7 @@
s->m.bit_rate= avctx->bit_rate;
s->m.lmin = avctx->mb_lmin;
s->m.lmax = avctx->mb_lmax;
+ s->m.mb_num = (avctx->width * avctx->height + 255) / 256; // For ratecontrol
s->m.me.temp =
s->m.me.scratchpad= av_mallocz_array((avctx->width+64), 2*16*2*sizeof(uint8_t));
@@ -311,7 +312,7 @@
if(P_LEFT[1] > (c->ymax<<shift)) P_LEFT[1] = (c->ymax<<shift);
if(P_TOP[0] > (c->xmax<<shift)) P_TOP[0] = (c->xmax<<shift);
if(P_TOP[1] > (c->ymax<<shift)) P_TOP[1] = (c->ymax<<shift);
- if(P_TOPRIGHT[0] < (c->xmin<<shift)) P_TOPRIGHT[0]= (c->xmin<<shift);
+ if(P_TOPRIGHT[0] < (c->xmin * (1<<shift))) P_TOPRIGHT[0]= (c->xmin * (1<<shift));
if(P_TOPRIGHT[0] > (c->xmax<<shift)) P_TOPRIGHT[0]= (c->xmax<<shift); //due to pmx no clip
if(P_TOPRIGHT[1] > (c->ymax<<shift)) P_TOPRIGHT[1]= (c->ymax<<shift);
@@ -1782,7 +1783,7 @@
}else{
for(y=0; y<h; y++){
for(x=0; x<w; x++){
- s->spatial_dwt_buffer[y*w + x]=s->spatial_idwt_buffer[y*w + x]<<ENCODER_EXTRA_BITS;
+ s->spatial_dwt_buffer[y*w + x]= s->spatial_idwt_buffer[y*w + x] * (1 << ENCODER_EXTRA_BITS);
}
}
}