X-Debbugs-CC: Sebastian Ramacher <sramac...@debian.org> Control: tags 1053182 + patch Control: tags 1053182 + pending
Dear maintainer, I've prepared an NMU for libvpx (versioned as 1.12.0-1.1) and uploaded it to DELAYED/2. Please feel free to tell me if I should delay it longer. Regards, Salvatore
diff -Nru libvpx-1.12.0/debian/changelog libvpx-1.12.0/debian/changelog --- libvpx-1.12.0/debian/changelog 2022-07-09 15:20:25.000000000 +0200 +++ libvpx-1.12.0/debian/changelog 2023-09-28 23:07:11.000000000 +0200 @@ -1,3 +1,11 @@ +libvpx (1.12.0-1.1) unstable; urgency=high + + * Non-maintainer upload. + * encode_api_test: add ConfigResizeChangeThreadCount + * VP8: disallow thread count changes (CVE-2023-5217) (Closes: #1053182) + + -- Salvatore Bonaccorso <car...@debian.org> Thu, 28 Sep 2023 23:07:11 +0200 + libvpx (1.12.0-1) unstable; urgency=medium * Team upload diff -Nru libvpx-1.12.0/debian/patches/0002-encode_api_test-add-ConfigResizeChangeThreadCount.patch libvpx-1.12.0/debian/patches/0002-encode_api_test-add-ConfigResizeChangeThreadCount.patch --- libvpx-1.12.0/debian/patches/0002-encode_api_test-add-ConfigResizeChangeThreadCount.patch 1970-01-01 01:00:00.000000000 +0100 +++ libvpx-1.12.0/debian/patches/0002-encode_api_test-add-ConfigResizeChangeThreadCount.patch 2023-09-28 23:07:11.000000000 +0200 @@ -0,0 +1,89 @@ +From: James Zern <jz...@google.com> +Date: Mon, 25 Sep 2023 18:53:41 -0700 +Subject: encode_api_test: add ConfigResizeChangeThreadCount +Origin: https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282 +Bug-Debian: https://bugs.debian.org/1053182 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2023-5217 + +Update thread counts and resolution to ensure allocations are updated +correctly. VP8 is disabled to avoid a crash. + +Bug: chromium:1486441 +Change-Id: Ie89776d9818d27dc351eff298a44c699e850761b +--- + test/encode_api_test.cc | 50 ++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 49 insertions(+), 1 deletion(-) + +--- a/test/encode_api_test.cc ++++ b/test/encode_api_test.cc +@@ -304,7 +304,6 @@ TEST(EncodeAPI, SetRoi) { + + void InitCodec(const vpx_codec_iface_t &iface, int width, int height, + vpx_codec_ctx_t *enc, vpx_codec_enc_cfg_t *cfg) { +- ASSERT_EQ(vpx_codec_enc_config_default(&iface, cfg, 0), VPX_CODEC_OK); + cfg->g_w = width; + cfg->g_h = height; + cfg->g_lag_in_frames = 0; +@@ -342,6 +341,7 @@ TEST(EncodeAPI, ConfigChangeThreadCount) + vpx_codec_ctx_t ctx = {}; + } enc; + ++ ASSERT_EQ(vpx_codec_enc_config_default(iface, &cfg, 0), VPX_CODEC_OK); + EXPECT_NO_FATAL_FAILURE( + InitCodec(*iface, kWidth, kHeight, &enc.ctx, &cfg)); + if (IsVP9(iface)) { +@@ -353,6 +353,54 @@ TEST(EncodeAPI, ConfigChangeThreadCount) + + for (const auto threads : { 1, 4, 8, 6, 2, 1 }) { + cfg.g_threads = threads; ++ EXPECT_NO_FATAL_FAILURE(EncodeWithConfig(cfg, &enc.ctx)) ++ << "iteration: " << i << " threads: " << threads; ++ } ++ } ++ } ++} ++ ++TEST(EncodeAPI, ConfigResizeChangeThreadCount) { ++ constexpr int kInitWidth = 1024; ++ constexpr int kInitHeight = 1024; ++ ++ for (const auto *iface : kCodecIfaces) { ++ SCOPED_TRACE(vpx_codec_iface_name(iface)); ++ if (!IsVP9(iface)) { ++ GTEST_SKIP() << "TODO(https://crbug.com/1486441) remove this condition " ++ "after VP8 is fixed."; ++ } ++ for (int i = 0; i < (IsVP9(iface) ? 2 : 1); ++i) { ++ vpx_codec_enc_cfg_t cfg = {}; ++ struct Encoder { ++ ~Encoder() { EXPECT_EQ(vpx_codec_destroy(&ctx), VPX_CODEC_OK); } ++ vpx_codec_ctx_t ctx = {}; ++ } enc; ++ ++ ASSERT_EQ(vpx_codec_enc_config_default(iface, &cfg, 0), VPX_CODEC_OK); ++ // Start in threaded mode to ensure resolution and thread related ++ // allocations are updated correctly across changes in resolution and ++ // thread counts. See https://crbug.com/1486441. ++ cfg.g_threads = 4; ++ EXPECT_NO_FATAL_FAILURE( ++ InitCodec(*iface, kInitWidth, kInitHeight, &enc.ctx, &cfg)); ++ if (IsVP9(iface)) { ++ EXPECT_EQ(vpx_codec_control_(&enc.ctx, VP9E_SET_TILE_COLUMNS, 6), ++ VPX_CODEC_OK); ++ EXPECT_EQ(vpx_codec_control_(&enc.ctx, VP9E_SET_ROW_MT, i), ++ VPX_CODEC_OK); ++ } ++ ++ cfg.g_w = 1000; ++ cfg.g_h = 608; ++ EXPECT_EQ(vpx_codec_enc_config_set(&enc.ctx, &cfg), VPX_CODEC_OK) ++ << vpx_codec_error_detail(&enc.ctx); ++ ++ cfg.g_w = 16; ++ cfg.g_h = 720; ++ ++ for (const auto threads : { 1, 4, 8, 6, 2, 1 }) { ++ cfg.g_threads = threads; + EXPECT_NO_FATAL_FAILURE(EncodeWithConfig(cfg, &enc.ctx)) + << "iteration: " << i << " threads: " << threads; + } diff -Nru libvpx-1.12.0/debian/patches/0003-VP8-disallow-thread-count-changes.patch libvpx-1.12.0/debian/patches/0003-VP8-disallow-thread-count-changes.patch --- libvpx-1.12.0/debian/patches/0003-VP8-disallow-thread-count-changes.patch 1970-01-01 01:00:00.000000000 +0100 +++ libvpx-1.12.0/debian/patches/0003-VP8-disallow-thread-count-changes.patch 2023-09-28 23:07:11.000000000 +0200 @@ -0,0 +1,51 @@ +From: James Zern <jz...@google.com> +Date: Mon, 25 Sep 2023 18:55:59 -0700 +Subject: VP8: disallow thread count changes +Origin: https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590 +Bug-Debian: https://bugs.debian.org/1053182 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2023-5217 + +Currently allocations are done at encoder creation time. Going from +threaded to non-threaded would cause a crash. + +Bug: chromium:1486441 +Change-Id: Ie301c2a70847dff2f0daae408fbef1e4d42e73d4 +--- + test/encode_api_test.cc | 4 ---- + vp8/encoder/onyx_if.c | 5 +++++ + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/test/encode_api_test.cc b/test/encode_api_test.cc +index a8a4df2ddf88..f1c98b2c71c9 100644 +--- a/test/encode_api_test.cc ++++ b/test/encode_api_test.cc +@@ -370,10 +370,6 @@ TEST(EncodeAPI, ConfigResizeChangeThreadCount) { + + for (const auto *iface : kCodecIfaces) { + SCOPED_TRACE(vpx_codec_iface_name(iface)); +- if (!IsVP9(iface)) { +- GTEST_SKIP() << "TODO(https://crbug.com/1486441) remove this condition " +- "after VP8 is fixed."; +- } + for (int i = 0; i < (IsVP9(iface) ? 2 : 1); ++i) { + vpx_codec_enc_cfg_t cfg = {}; + struct Encoder { +diff --git a/vp8/encoder/onyx_if.c b/vp8/encoder/onyx_if.c +index c65afc643bf6..c5e9970c3cc8 100644 +--- a/vp8/encoder/onyx_if.c ++++ b/vp8/encoder/onyx_if.c +@@ -1447,6 +1447,11 @@ void vp8_change_config(VP8_COMP *cpi, VP8_CONFIG *oxcf) { + last_h = cpi->oxcf.Height; + prev_number_of_layers = cpi->oxcf.number_of_layers; + ++ if (cpi->initial_width) { ++ // TODO(https://crbug.com/1486441): Allow changing thread counts; the ++ // allocation is done once in vp8_create_compressor(). ++ oxcf->multi_threaded = cpi->oxcf.multi_threaded; ++ } + cpi->oxcf = *oxcf; + + switch (cpi->oxcf.Mode) { +-- +2.40.1 + diff -Nru libvpx-1.12.0/debian/patches/series libvpx-1.12.0/debian/patches/series --- libvpx-1.12.0/debian/patches/series 2021-09-01 23:10:14.000000000 +0200 +++ libvpx-1.12.0/debian/patches/series 2023-09-28 23:07:11.000000000 +0200 @@ -1 +1,3 @@ 0001-Relax-ABI-check.patch +0002-encode_api_test-add-ConfigResizeChangeThreadCount.patch +0003-VP8-disallow-thread-count-changes.patch
