[Deepin Integration]~[v25-Release] fix(cve): CVE-2026-70630 - avcodec/screenpresso: reject deflate output shorter than the frame by deepin-ci-robot@deepin-community/ffmpeg by deepin-community-ci-bot[bot] #14287

Package information | 软件包信息

Package repository address | 软件包仓库地址

deb [trusted=yes] https://ci.deepin.com/repo/obs/deepin:/CI:/TestingIntegration:/test-integration-pr-4746/testing/ ./

Changelog | 更新信息

ffmpeg (7:6.1.5-0deepin13) unstable; urgency=medium

• fix(cve): CVE-2026-70630 (medium) - avcodec/screenpresso: reject
  deflate output shorter than the frame Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1da
  d5eea07f28ccfb43e

• fix(cve): CVE-2026-125239 (high) - avcodec/dxva2_hevc: reject tile
  counts the DXVA picture parameters cannot hold Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136.patch,https://gith
  ub.com/aghdetngf/cybervault-cve-
  intel/commit/8f39dd6ca149ecfce759e870062509ad29617702

• fix(cve): CVE-2026-125208 (high) - libavcodec/v4l2_buffers: fixing
  buffer alignment issue Upstream:
  FFmpeg/FFmpeg@b8f159858e2fd29dae4fa34d9e71
  3bbf9bbf190e.patch

• fix(cve): CVE-2026-125213 (high) - avcodec/psd: reject an
  uncompressed image size above INT_MAX Upstream:
  FFmpeg/FFmpeg@aa4b80b54ee8645b5a77fe835ab2
  bbae1c9c465c

• fix(cve): CVE-2026-125210 (high) - avcodec/libaribcaption: allocate
  one rect in text mode Upstream:
  FFmpeg/FFmpeg@7c06aea6f0d26dd70c94ccba6127
  059cd0a0e352

• fix(cve): CVE-2026-125257 (high) - avcodec/nellymoserenc: keep the
  trellis index below OPT_SIZE Upstream:
  FFmpeg/FFmpeg@733bec3e19759520ccdbeb6c3c0c
  ae280bbe6dc5

• fix(cve): CVE-2026-125204 (high) - avcodec/encode: reject video
  frames that do not match the encoder Upstream:
  FFmpeg/FFmpeg@254cebc4e8e1358ffcf7ba6fc13b
  cc4a98db80de,FFmpeg/FFmpeg@9b99973b2bbecee
  0b7e1e57035b95498b42f54a6

• fix(cve): CVE-2026-125214 (high) - avcodec/pcm-bluray: copy only
  whole samples on big-endian hosts Upstream:
  FFmpeg/FFmpeg@a61b32df3fd67f76c1c8c7ea51be
  2a66efb0f945.patch

• fix(cve): CVE-2026-125241 (high) - avcodec/flicvideo: bound pixel
  writes at both ends of the frame storage Upstream:
  FFmpeg/FFmpeg@27f612b306eb04f81138173f705d
  f9a9b055b01d

• fix(cve): CVE-2026-125250 (high) - avcodec/gif: remap into a buffer
  with the context width as stride Upstream:
  FFmpeg/FFmpeg@26c2980980295e5516f308c5a279
  2d2a72e43eae

• fix(cve): CVE-2026-125233 (high) - avcodec/dvbsubenc: Account for
  the full CLUT segment header Upstream:
  FFmpeg/FFmpeg@7f80b2ad83f37a4998d9617495c9
  2b28a7339a90.patch

• fix(cve): CVE-2026-125202 (high) - avcodec/vaapi_hevc: reject tile
  counts the VAAPI picture parameters cannot hold Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136

• fix(cve): CVE-2026-125219 (high) - avcodec/vdpau_hevc: reject tile
  counts the VDPAU picture info cannot hold Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136.patch

• fix(cve): CVE-2026-125222 (high) - avcodec/hap: bound the sum of the
  uncompressed chunk sizes Upstream:
  FFmpeg/FFmpeg@62c308e0416bb701447817fe6f0b
  ff074d206215.patch

• fix(cve): CVE-2026-125211 (high) - avcodec/libaribcaption: free only
  the added rects on ass errors Upstream:
  FFmpeg/FFmpeg@4ec127c82678b06658e963291f27
  2881dc878735.patch

• fix(cve): CVE-2026-125269 (high) - avcodec/cbs_sei: clear the
  message slot handed out by ff_cbs_sei_list_add() Upstream:
  FFmpeg/FFmpeg@2c515eea07df719379e7f73deeeb
  7ccb8768433f.patch

• fix(cve): CVE-2026-125229 (high) - avcodec/huffyuvenc: reject frames
  too small for the median predictor Upstream:
  FFmpeg/FFmpeg@45f98d0819efe2b7ce93e9034b7e
  6a4ed6700621

• fix(cve): CVE-2026-125181 (high) - avcodec/flicvideo: decrement
  pixel_countdown in the big endian FLI_BRUN byte swap Upstream:
  FFmpeg/FFmpeg@ee30fb98c0d4e97abbd5e371d2a3
  a926e92bec70,FFmpeg/FFmpeg@c0d308a9a616f4a
  bcc4e0a4d86f7de92ecdef9f6,FFmpeg/FFmpeg@eb
  47d7bb6cf13042c6ab14e22fc0c0c3a6e51e12

• fix(cve): CVE-2026-125227 (high) - avcodec/cbs_jpeg: check the scan
  data size without overflowing size_t Upstream:
  FFmpeg/FFmpeg@b89ce54d93bf644433dfa9fbc34f
  19c22237691a.patch

• fix(cve): CVE-2026-125259 (high) - avcodec/proresenc_kostya: compute
  the frame size upper bound in 64 bits Upstream:
  FFmpeg/FFmpeg@439b452f9fe916a9f7d8788ab6af
  ee8fac846b0b.patch

• fix(cve): CVE-2026-125179 (medium) - avcodec/vqavideo: allocate the
  codebook zeroed Upstream:
  FFmpeg/FFmpeg@f9df3577ac40aaee06f82f05eab8
  249cbab3cd33.patch

• fix(cve): CVE-2026-125232 (medium) - avcodec/mpegvideo_enc: keep
  MPEG-4 B frame chains within the 16 bit frame distance Upstream:
  FFmpeg/FFmpeg@16d19ccbce802634662a9bf18a56
  79cf27da2848,FFmpeg/FFmpeg@bf0a2e4680df92d
  8de6514090d350152eb7845b8

• fix(cve): CVE-2026-125103 (medium) - avcodec/mlz: reject string
  codes beyond the dictionary Upstream:
  FFmpeg/FFmpeg@db98784a72600a94f7ebd5f016a3
  7e01a505c27b

• fix(cve): CVE-2026-125065 (medium) - avcodec/eatgv: check
  init_get_bits8() for failure Upstream:
  FFmpeg/FFmpeg@9691e4fde64e14de73c298562c4e
  475f9412b5ad.patch

• fix(cve): CVE-2026-125268 (medium) - avcodec/cfhd: allocate the
  inverse transform scratch buffer zeroed Upstream:
  FFmpeg/FFmpeg@0bfa350291b2118f6d590263dc1e
  e9cea766c0f1.patch

• fix(cve): CVE-2026-125193 (medium) - avcodec/bitpacked: check the
  packet size before using it as a UYVY422 frame Upstream:
  FFmpeg/FFmpeg@f1205ee01893a3b509d96b5fe3ae
  da755c517973.patch

• fix(cve): CVE-2026-125221 (medium) - avcodec/flac_parser: score the
  header chain without recursion Upstream:
  https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/972fe1ccd326538fe9a6b5d
  5094b7880b5443429.patch

• fix(cve): CVE-2026-125182 (medium) - avcodec/cook: reject
  js_subband_start beyond subbands Upstream:
  FFmpeg/FFmpeg@7145d13201c9f9c5253f40295714
  faa4f4ada1a0

• fix(cve): CVE-2026-125220 (medium) - avcodec/mimic: set up the bit
  reader before publishing the frame Upstream:
  FFmpeg/FFmpeg@db77b0b8318ddb38b5a3227724da
  088a325a4308.patch

• fix(cve): CVE-2026-125072 (medium) - avcodec/mpegaudiodec: fail on
  packets too large for the bit reader Upstream:
  FFmpeg/FFmpeg@0b007e0634de5b4424b9993c95a6
  c1c50de0115b.patch

• fix(cve): CVE-2026-125245 (medium) - mjpegdec: use refstruct for the
  hwaccel_picture_private Upstream:
  FFmpeg/FFmpeg@50e9ef29be1766404115b0a4908f
  a3fd6ed7fa3f

• fix(cve): CVE-2026-125197 (medium) - avcodec/lcldec: check the
  packet size before reading the ZLIB multithread header Upstream:
  FFmpeg/FFmpeg@12e5d4ec98b7add7bcac9d8131d9
  a6dfb2549966

• fix(cve): CVE-2026-125225 (medium) - avcodec/bsf/aac_adtstoasc:
  check the bit reader initialization before the PCE Upstream:
  FFmpeg/FFmpeg@3b1cbb5e0f66b85d15f1d3527436
  520b3f4711ec.patch

• fix(cve): CVE-2026-125194 (medium) - avcodec/pcm-dvdenc: do not
  encode a frame with fewer samples than a block Upstream:
  FFmpeg/FFmpeg@cfe6a6cd7de59341a70ebe6a2d47
  7f3281aec834.patch

• fix(cve): CVE-2026-125187 (medium) - avcodec/ttaenc: check the
  packet space for each sample and the CRC Upstream:
  FFmpeg/FFmpeg@29a629e788c4343ff2e923095b8f
  38769fe2e470.patch

• fix(cve): CVE-2026-125190 (medium) - avcodec/mvcdec: zero-initialize
  color array Upstream:
  FFmpeg/FFmpeg@3a5eb948e76dc6390e4b3cff7bec
  f84bc492b7af

• fix(cve): CVE-2026-125186 (medium) - avcodec/bsf/dts2pts: reject
  packets with more than two H.264 pictures Upstream:
  FFmpeg/FFmpeg@d8013c061725631261d7326c07d2
  af3a67fa4bc1

• fix(cve): CVE-2026-125066 (medium) - avcodec/cljrdec: check
  init_get_bits8() for failure Upstream:
  FFmpeg/FFmpeg@d40c1b12811814fc6c2d0816527b
  003d8510ea06

• fix(cve): CVE-2026-125170 (medium) - avcodec/targa: reject truncated
  RLE packet payloads Upstream:
  FFmpeg/FFmpeg@f8f84348dfe1a80d38e7dbbcddcd
  d5d92a760dfd

• fix(cve): CVE-2026-125191 (medium) - avcodec/v4l2_buffers: count a
  buffer once in the context reference count Upstream:
  FFmpeg/FFmpeg@4d2d58efa9b9f3802893b1db0ea1
  edfbe1cc66ef.patch

• fix(cve): CVE-2026-125243 (medium) - avcodec/jpeglsdec: decode line
  interleaved scans with more than 8 bits Upstream:
  FFmpeg/FFmpeg@60bc31fcf6543505e6d2fc1a9399
  cca95f54ba4d

• fix(cve): CVE-2026-125234 (medium) - avcodec/wavpackenc: compute the
  default block size in 64 bit Upstream:
  FFmpeg/FFmpeg@e621da8ecdbef8edb8336cc899b9
  62159dc2465c.patch

• fix(cve): CVE-2026-125178 (medium) - avcodec/tdsc: validate cursor
  dimensions before storing them Upstream:
  FFmpeg/FFmpeg@12c589a37d093cc55618f8377b09
  2dc21416806f

• fix(cve): CVE-2026-125207 (medium) - avcodec/interplayacm: reject
  blocks larger than 1M samples Upstream:
  FFmpeg/FFmpeg@6ecaddb9c1d59cf7f5de16017122
  fecb2fa0c67c.patch

• fix(cve): CVE-2026-125101 (medium) - avcodec/vmnc: restore the
  screen under the cursor only after it was painted Upstream:
  FFmpeg/FFmpeg@50865f20b1f474e6b11735c88f66
  8751bc9aa528

• fix(cve): CVE-2026-125104 (medium) - avcodec/apedec: reject legacy
  frames with more than 73728 samples Upstream:
  FFmpeg/FFmpeg@968e9e948ed8c9ba90dbc875e60b
  843c755cf4ba

• fix(cve): CVE-2026-125216 (medium) - avcodec/dpxenc: reject
  unsupported depths for RGB48 input Upstream:
  FFmpeg/FFmpeg@aa5fd7d287db4f469fdcbe444f7f
  9f38c8c289c7.patch

• fix(cve): CVE-2026-125246 (medium) - avcodec/cbs_jpeg: count byte
  stuffing only in the entropy-coded part of a scan Upstream:
  FFmpeg/FFmpeg@ee457fdcdb3a069ef35910a2e1ca
  cff10906b131.patch

• fix(cve): CVE-2026-125176 (medium) - avcodec/flashsv: require two
  bytes for a 15-bit pixel in decode_hybrid Upstream:
  FFmpeg/FFmpeg@16d0f7f408ba47b4091a22109d4f
  22f5fd57820a

• fix(cve): CVE-2026-125242 (medium) - avcodec/vdpau: free the
  bitstream buffer table when the picture is released Upstream:
  FFmpeg/FFmpeg@2c6cd8098844f2367f8ba0a3a483
  e405c8f76449.patch

• fix(cve): CVE-2026-125175 (medium) - avcodec/flashsv: reject blocks
  whose inflate output is shorter than the block Upstream:
  FFmpeg/FFmpeg@50d206a75b5e60261d71b25657ae
  04891eb60290,FFmpeg/FFmpeg@cfb40c912927fdd
  2c1186b7b6aca468422da23db

• fix(cve): CVE-2026-125205 (medium) - avcodec/av1_frame_merge_bsf:
  check that the number of Obus are within a limit Upstream:
  FFmpeg/FFmpeg@c90bbc2036bac67e95777638bdc8
  6157a775858a

• fix(cve): CVE-2026-125069 (medium) - avcodec/motionpixels: check
  init_get_bits8() for failure Upstream:
  FFmpeg/FFmpeg@26b4c37526fe0ecf1095b45daac0
  8050f25f7659.patch

• fix(cve): CVE-2026-125067 (medium) - avcodec/vble: check
  init_get_bits8() for failure Upstream:
  FFmpeg/FFmpeg@1206df65e54b6e9c01459c7cd9a9
  5f9bde2736d7

• fix(cve): CVE-2026-125068 (medium) - avcodec/bink: check
  init_get_bits8() for failure Upstream:
  FFmpeg/FFmpeg@5195d6f9729ad00b93e4d0f0bea3
  09416fb4713e.patch

• fix(cve): CVE-2026-125247 (medium) - avcodec/tiff: compute the DNG
  tile count without overflowing Upstream:
  FFmpeg/FFmpeg@a9c070e52fecb7fb247db8291308
  99db07953823.patch

• fix(cve): CVE-2026-125070 (medium) - avcodec/eatqi: check
  init_get_bits8() for failure Upstream:
  FFmpeg/FFmpeg@5d7b743bdfb724df21fd43a3d7f3
  258382eb578c

• fix(cve): CVE-2026-125253 (medium) - avcodec/cbs_vp9: check
  superframe frame sizes without overflowing size_t Upstream:
  FFmpeg/FFmpeg@6280907da48c4dd78f95ef5c713a
  29c7702153a3.patch

• fix(cve): CVE-2026-125099 (medium) - avcodec/gemdec: clear the row
  buffer before decoding Upstream:
  FFmpeg/FFmpeg@e578999fa3c5f7efac1ea70bb7c2
  a7682013c7c9.patch

• fix(cve): CVE-2026-125226 (medium) - avformat/sbgdec: bound the
  default frame size Upstream:
  FFmpeg/FFmpeg@1f4b2e22cfba19f94489ec4a1713
  0f4f0d5d8a0c

• fix(cve): CVE-2026-125098 (medium) - avcodec/webp: reject
  uncompressed alpha chunks shorter than the image Upstream:
  FFmpeg/FFmpeg@92b318e0b33623720d9f128ad7bc
  5fa8277c34f7.patch

• fix(cve): CVE-2026-125255 (medium) - avcodec/mjpegdec: reject a SOF
  without a preceding SOI when a hwaccel is used Upstream:
  FFmpeg/FFmpeg@f58a6776546567367baf5223df9f
  fbfd289299f8

• fix(cve): CVE-2026-125171 (medium) - avcodec/mpc7: reject a last
  frame length larger than a frame Upstream:
  FFmpeg/FFmpeg@5d59b7c45d7142bddd13ddc8891e
  72c5c7dc991b.patch

• fix(cve): CVE-2026-125217 (medium) - avcodec/roqaudioenc: encode the
  buffered samples when flushed early Upstream:
  FFmpeg/FFmpeg@f71410e0288f0c40ae2fb5e5a4d7
  428763d08a71

• fix(cve): CVE-2026-125097 (medium) - avcodec/rawdec: require a full
  row of input per line for 1 to 8 bits per pixel Upstream:
  FFmpeg/FFmpeg@01a395b935b9da12dbeca588a713
  0c4db6a14689.patch

• fix(cve): CVE-2026-125261 (medium) - avcodec/sgienc: compute the row
  offset in signed arithmetic Upstream:
  FFmpeg/FFmpeg@c6e5b6105aa13f6b0df2a646da60
  8078cfe52d79.patch

• fix(cve): CVE-2026-125177 (medium) - avcodec/mscc: allocate the RLE
  buffer with av_mallocz to avoid heap disclosure Upstream:
  FFmpeg/FFmpeg@263a85e2a2127396f8a2b0c329ec
  798e1ea015ad

• fix(cve): CVE-2026-125192 (medium) - avcodec/dxa: allocate the
  decompression buffer zeroed Upstream:
  FFmpeg/FFmpeg@a6e5d5ff993a525933d8d8f29071
  eb6c74b0436a

• fix(cve): CVE-2026-125265 (medium) - avcodec/nvdec: forget the
  previous picture's bitstream pointer when a picture starts
  Upstream:
  FFmpeg/FFmpeg@03cd7851955c023f1ff4c8a495d4
  7e996d01485a.patch

• fix(cve): CVE-2026-125095 (medium) - avcodec/c93: fail on truncated
  color tables Upstream:
  FFmpeg/FFmpeg@ac0106851a4dac555c967421dfc9
  6c0135183133

• fix(cve): CVE-2026-125073 (medium) - avcodec/imc: reject blocks
  whose bit budget is already exceeded Upstream:
  FFmpeg/FFmpeg@9b26bb4c9a4457d480899a1bf64e
  c080eceb1acd.patch

• fix(cve): CVE-2026-125100 (medium) - avcodec/exr: compute the tile
  count in 64 bits Upstream:
  FFmpeg/FFmpeg@c05d46ea2919da83233bf4216d3f
  58428bb54c59

• fix(cve): CVE-2026-125102 (medium) - avcodec/takdec: require the
  multichannel channel list to cover all channels Upstream:
  FFmpeg/FFmpeg@01e1bb126179879201429952cc2d
  caea0d50d603.patch

• fix(cve): CVE-2026-125183 (medium) - avcodec/hevc/ps: skip the depth
  lookup table bits in one step Upstream:
  FFmpeg/FFmpeg@f9f732b444a2fc27dcc4fe52084d
  3d435f827864.patch

• fix(cve): CVE-2026-125064 (medium) - avcodec/g726: check
  init_get_bits8() for failure Upstream:
  FFmpeg/FFmpeg@ec887b13a88afbaf44fb28c3045b
  da5d434da8dc.patch

• fix(cve): CVE-2026-125096 (medium) - avcodec/tiertexseqv: check the
  RLE block unpacking before copying the block Upstream:
  FFmpeg/FFmpeg@c896bbb24535685509a816af0966
  5cb73bf2d0c7.patch

• fix(cve): CVE-2026-125264 (medium) - avcodec/jpegxl_parser: stop
  before a TOC that cannot fit in the input Upstream:
  FFmpeg/FFmpeg@bc896c613ec0d4ad0108d62fbdda
  0196f69e7121

• fix(cve): CVE-2026-125195 (low) - avcodec/adpcmenc: encode all
  samples of a mono ADPCM_MS block with trellis Upstream:
  FFmpeg/FFmpeg@fb13409aaffc151f602ad357db46
  052e98ea46e8

• fix(cve): CVE-2026-125198 (low) - avcodec/mediacodec_wrapper: avoid
  leaking setBuffer backing storage Upstream:
  FFmpeg/FFmpeg@e5d295b3cd467fc713300e208ba2
  dacc7ff603a0.patch

• fix(cve): CVE-2026-125206 (low) - avcodec/proresenc_kostya: fill
  macroblock rows past the end of the bottom field Upstream:
  FFmpeg/FFmpeg@9edd06f8612c242b83bf9e3d14aa
  85180015a211

• fix(cve): CVE-2026-125188 (low) - avcodec/proresenc_anatoliy: fill
  the slice from the field's own number of lines Upstream:
  FFmpeg/FFmpeg@d74f5e0559ba09d942c476878563
  49b03c1115dd,FFmpeg/FFmpeg@ad2287d6d2511af
  66222e8f7e40d546bc8d461ec

• fix(cve): CVE-2026-125071 (medium) - avcodec/jvdec: check
  init_get_bits8() for failure Upstream:
  FFmpeg/FFmpeg@839c93f261cd3e1719edfac4244a
  2d0055ce8841

• fix(cve): CVE-2026-125224 (medium) - avcodec/vorbis_parser: parse
  the extradata only once Upstream:
  FFmpeg/FFmpeg@90f5e61a1da2dcc0050169af8ca5
  93530f26071b

• fix(cve): CVE-2026-125252 (medium) - avcodec/vaapi_decode: destroy
  the buffers of a picture released without being issued; avcodec:
  release the hwaccel picture private data before its frame
  Upstream:
  FFmpeg/FFmpeg@4221a63ce869ade862557ca64693
  bf77f5032971,FFmpeg/FFmpeg@838c660bb3cd66b
  a74981b453c14c79214f6ef92