Debian Patches

Status for aom/3.12.1-1+deb13u1

Patch Description Author Forwarded Bugs Origin Last update
0001-doc-Use-libjs-mathjax-rather-than-cloudflare-copy.patch doc: Use libjs-mathjax rather than cloudflare copy Boyuan Yang <byang@debian.org> no 2021-10-21
0002-use-system-libyuv.patch use system libyuv Boyuan Yang <byang@debian.org> no 2024-01-27
0003-use-system-libwebm.patch use system libwebm Boyuan Yang <byang@debian.org> no 2024-01-27
0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch Fix missing bounds check on the SVC layer id controls The AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls did
not validate the caller-supplied spatial and temporal layer ids against the
number of layers actually configured via AV1E_SET_SVC_PARAMS. A negative or
too-large id propagated into the layer context array index and into the
cyclic refresh map pointer, causing an out-of-bounds read of the layer
context array (CVE-2026-56210), an out-of-bounds write through the cyclic
refresh map pointer (CVE-2026-56209), and potentially remote code execution
in a service that lets an attacker influence SVC encoder parameters
(CVE-2026-56211).
.
Return AOM_CODEC_INVALID_PARAM if the spatial or temporal layer id is below
0 or at/above the configured number of layers, and update the documentation
of the controls accordingly. ppi->number_spatial_layers and
ppi->number_temporal_layers are both initialised to 1 by
init_config_sequence(), called from av1_create_primary_compressor() at
encoder init, so single-layer (non-SVC) callers passing id 0 are unaffected.		 Marco Paniconi <marpan@google.com> yes debian upstream upstream, https://aomedia.googlesource.com/aom/+/a93ba0ffaacd5f576a241bf739110e65287e516d 2026-08-04
0005-CVE-2026-56208-lap-stats-buffer-overflow.patch Fix heap buffer overflow in the first-pass stats buffer in LAP mode In Look-Ahead Processing (LAP) mode the first-pass stats buffer was sized
from g_lag_in_frames alone, leaving it far shorter than the longest group of
pictures LAP can analyse, and an off-by-one in the rest_frames computation
let the encoder run past the end of it (CVE-2026-56208).
.
Reproduced on 3.12.1 under AddressSanitizer with g_lag_in_frames = 1: a
heap-buffer-overflow read in find_next_scenecut(), reached from
identify_regions() via av1_get_second_pass_params(), 9 bytes past the
487-byte allocation made by create_stats_buffer(). Applying only the
pass2_strategy.c hunk moves the fault to the stats store in
update_firstpass_stats(), so the buffer sizing change is load-bearing too.
.
The fix has three parts:
.
1. Always allocate at least MAX_GF_LENGTH_LAP + 1 stats buffers, even when
lag-in-frames is smaller than MAX_GF_LENGTH_LAP.
2. Use a compacting sliding window for the stats buffers in LAP mode so the
in-use region is moved back to the start of the buffer instead of
running off the end.
3. Correct an off-by-one in the rest_frames computation in
av1_get_second_pass_params(), which is only wrong in LAP mode.
.
The patch is taken from upstream with the test/encode_api_test.cc hunk
dropped, since debian/rules configures with -DENABLE_TESTS=0 and the
upstream test suite is not built. The remaining hunks apply to 3.12.1 with
line offsets only.		 Cheng Chen <chengchen@google.com> yes debian upstream upstream, https://aomedia.googlesource.com/aom/+/243f8ae84bfbc495b3a3c12948abc4dff3af2f84 2026-08-04
0006-svc-add-more-spatial-temporal-layer-validation.patch Validate the SVC spatial/temporal layer counts 3.12.1 accepts any value for the number of spatial and temporal layers:
AOME_SET_NUMBER_SPATIAL_LAYERS only rejects values above
MAX_NUM_SPATIAL_LAYERS, and AV1E_SET_SVC_PARAMS stores the caller's counts
before performing any validation. Out-of-range counts then propagate into
fixed-size arrays. Verified on 3.12.1 under AddressSanitizer:
.
* AOME_SET_NUMBER_SPATIAL_LAYERS(0) gives a heap-buffer-overflow write in
init_seq_coding_tools() (operating_point_idc[], MAX_NUM_OPERATING_POINTS
is 32), reached via av1_change_config_seq() from update_encoder_cfg().
* AV1E_SET_SVC_PARAMS with number_spatial_layers = 5 gives an invalid read
in av1_free_svc_cyclic_refresh(); av1_init_layer_context() has by then
written past downsample_filter_type[] and drop_spatial_layer[], both
AOM_MAX_SS_LAYERS (4) entries.
.
Reject counts outside [1, MAX_NUM_SPATIAL_LAYERS] and
[1, MAX_NUM_TEMPORAL_LAYERS] in both controls, and turn the fixed-SVC-mode
layer count assert in av1_set_svc_fixed_mode() into an aom_internal_error(),
since assert() is compiled out in Debian builds.
.
This is not one of the four CVEs above and is not a regression from them;
both crashes reproduce identically on unpatched 3.12.1. It is included
because patch 0004 derives its layer id bound from these counts, so the
counts themselves need to be trustworthy.
.
The patch is taken from upstream with the test/encode_api_test.cc hunk
dropped, since debian/rules configures with -DENABLE_TESTS=0. The remaining
hunks apply to 3.12.1 with line offsets only.		 James Zern <jzern@google.com> no debian upstream, https://aomedia.googlesource.com/aom/+/30eb74d957ee19860f3f1e0b3ab4827136da1017 2026-08-04

All known versions for source package 'aom'

Links