[rpms/ffmpeg] epel9-next: Backport fix for CVE-2025-22921

[Dominik Mierzejewski <dominik@greysector.net>]

A new commit has been pushed.

Repo   : rpms/ffmpeg
Branch : epel9-next
Commit : 4d830a4af870c9293ee884a9464b0f7e9b182178
Author : Dominik Mierzejewski <dominik@greysector.net>
Date   : 2025-03-07T23:15:43+01:00
Stats  : +33/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/ffmpeg/c/4d830a4af870c9293ee884a9464b0f7e9b182178?branch=epel9-next

Log:
Backport fix for CVE-2025-22921

---
diff --git a/ffmpeg-CVE-2025-22921.patch b/ffmpeg-CVE-2025-22921.patch
new file mode 100644
index 0000000..3a522c8
--- /dev/null
+++ b/ffmpeg-CVE-2025-22921.patch
@@ -0,0 +1,29 @@
+From 7f9c7f9849a2155224711f0ff57ecdac6e4bfb57 Mon Sep 17 00:00:00 2001
+From: James Almer <jamrial@gmail.com>
+Date: Wed, 1 Jan 2025 23:58:39 -0300
+Subject: [PATCH] avcodec/jpeg2000dec: clear array length when freeing it
+
+Fixes NULL pointer dereferences.
+Fixes ticket #11393.
+
+Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
+Signed-off-by: James Almer <jamrial@gmail.com>
+---
+ libavcodec/jpeg2000dec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
+index e5e897a29f..b82d85d5ee 100644
+--- a/libavcodec/jpeg2000dec.c
++++ b/libavcodec/jpeg2000dec.c
+@@ -1521,6 +1521,7 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile,
+                 }
+             }
+             av_freep(&cblk->lengthinc);
++            cblk->nb_lengthinc = 0;
+         }
+     }
+     // Save state of stream
+-- 
+2.48.1
+

diff --git a/ffmpeg.spec b/ffmpeg.spec
index 2c64b90..5e016be 100644
--- a/ffmpeg.spec
+++ b/ffmpeg.spec
@@ -104,6 +104,9 @@ Patch1:         ffmpeg-codec-choice.patch
 # See https://bugzilla.redhat.com/show_bug.cgi?id=1501522#c112
 Patch2:         ffmpeg-allow-fdk-aac-free.patch
 
+# Backport fix for CVE-2025-22921
+Patch10:        https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/7f9c7f9849a2155224711f0ff57ecdac6e4bfb57#/ffmpeg-CVE-2025-22921.patch
+
 # Add first_dts getter to libavformat for Chromium
 # See: https://bugzilla.redhat.com/show_bug.cgi?id=2240127
 # Reference: https://crbug.com/1306560
@@ -859,6 +862,7 @@ rm -rf %{buildroot}%{_datadir}/%{name}/examples
 * Thu Mar 06 2025 Dominik Mierzejewski <dominik@greysector.net> - 7.1.1-1
 - Update to 7.1.1 (resolves rhbz#2349351)
 - Enable LC3 codec via liblc3
+- Backport fix for CVE-2025-22921 (resolves rhbz#2346558)
 
 * Fri Feb 07 2025 Yaakov Selkowitz <yselkowi@redhat.com> - 7.1-1
 - Rebase to 7.1 (rhbz#2273572)