Bug#1053182: libvpx: diff for NMU version 1.12.0-1.1
On 2023-09-28 23:14:20 +0200, Salvatore Bonaccorso wrote:
> X-Debbugs-CC: Sebastian Ramacher <sramacher@debian.org>
>
> Control: tags 1053182 + patch
> Control: tags 1053182 + pending
>
>
> Dear maintainer,
>
> I've prepared an NMU for libvpx (versioned as 1.12.0-1.1) and
> uploaded it to DELAYED/2. Please feel free to tell me if I
> should delay it longer.
Thanks for working on the fix! Please feel free to reschedule it so that
it directly lands in unstable.
Cheers
>
> Regards,
> Salvatore
> diff -Nru libvpx-1.12.0/debian/changelog libvpx-1.12.0/debian/changelog
> --- libvpx-1.12.0/debian/changelog 2022-07-09 15:20:25.000000000 +0200
> +++ libvpx-1.12.0/debian/changelog 2023-09-28 23:07:11.000000000 +0200
> @@ -1,3 +1,11 @@
> +libvpx (1.12.0-1.1) unstable; urgency=high
> +
> + * Non-maintainer upload.
> + * encode_api_test: add ConfigResizeChangeThreadCount
> + * VP8: disallow thread count changes (CVE-2023-5217) (Closes: #1053182)
> +
> + -- Salvatore Bonaccorso <carnil@debian.org> Thu, 28 Sep 2023 23:07:11 +0200
> +
> libvpx (1.12.0-1) unstable; urgency=medium
>
> * Team upload
> diff -Nru libvpx-1.12.0/debian/patches/0002-encode_api_test-add-ConfigResizeChangeThreadCount.patch libvpx-1.12.0/debian/patches/0002-encode_api_test-add-ConfigResizeChangeThreadCount.patch
> --- libvpx-1.12.0/debian/patches/0002-encode_api_test-add-ConfigResizeChangeThreadCount.patch 1970-01-01 01:00:00.000000000 +0100
> +++ libvpx-1.12.0/debian/patches/0002-encode_api_test-add-ConfigResizeChangeThreadCount.patch 2023-09-28 23:07:11.000000000 +0200
> @@ -0,0 +1,89 @@
> +From: James Zern <jzern@google.com>
> +Date: Mon, 25 Sep 2023 18:53:41 -0700
> +Subject: encode_api_test: add ConfigResizeChangeThreadCount
> +Origin: https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
> +Bug-Debian: https://bugs.debian.org/1053182
> +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2023-5217
> +
> +Update thread counts and resolution to ensure allocations are updated
> +correctly. VP8 is disabled to avoid a crash.
> +
> +Bug: chromium:1486441
> +Change-Id: Ie89776d9818d27dc351eff298a44c699e850761b
> +---
> + test/encode_api_test.cc | 50 ++++++++++++++++++++++++++++++++++++++++-
> + 1 file changed, 49 insertions(+), 1 deletion(-)
> +
> +--- a/test/encode_api_test.cc
> ++++ b/test/encode_api_test.cc
> +@@ -304,7 +304,6 @@ TEST(EncodeAPI, SetRoi) {
> +
> + void InitCodec(const vpx_codec_iface_t &iface, int width, int height,
> + vpx_codec_ctx_t *enc, vpx_codec_enc_cfg_t *cfg) {
> +- ASSERT_EQ(vpx_codec_enc_config_default(&iface, cfg, 0), VPX_CODEC_OK);
> + cfg->g_w = width;
> + cfg->g_h = height;
> + cfg->g_lag_in_frames = 0;
> +@@ -342,6 +341,7 @@ TEST(EncodeAPI, ConfigChangeThreadCount)
> + vpx_codec_ctx_t ctx = {};
> + } enc;
> +
> ++ ASSERT_EQ(vpx_codec_enc_config_default(iface, &cfg, 0), VPX_CODEC_OK);
> + EXPECT_NO_FATAL_FAILURE(
> + InitCodec(*iface, kWidth, kHeight, &enc.ctx, &cfg));
> + if (IsVP9(iface)) {
> +@@ -353,6 +353,54 @@ TEST(EncodeAPI, ConfigChangeThreadCount)
> +
> + for (const auto threads : { 1, 4, 8, 6, 2, 1 }) {
> + cfg.g_threads = threads;
> ++ EXPECT_NO_FATAL_FAILURE(EncodeWithConfig(cfg, &enc.ctx))
> ++ << "iteration: " << i << " threads: " << threads;
> ++ }
> ++ }
> ++ }
> ++}
> ++
> ++TEST(EncodeAPI, ConfigResizeChangeThreadCount) {
> ++ constexpr int kInitWidth = 1024;
> ++ constexpr int kInitHeight = 1024;
> ++
> ++ for (const auto *iface : kCodecIfaces) {
> ++ SCOPED_TRACE(vpx_codec_iface_name(iface));
> ++ if (!IsVP9(iface)) {
> ++ GTEST_SKIP() << "TODO(https://crbug.com/1486441) remove this condition "
> ++ "after VP8 is fixed.";
> ++ }
> ++ for (int i = 0; i < (IsVP9(iface) ? 2 : 1); ++i) {
> ++ vpx_codec_enc_cfg_t cfg = {};
> ++ struct Encoder {
> ++ ~Encoder() { EXPECT_EQ(vpx_codec_destroy(&ctx), VPX_CODEC_OK); }
> ++ vpx_codec_ctx_t ctx = {};
> ++ } enc;
> ++
> ++ ASSERT_EQ(vpx_codec_enc_config_default(iface, &cfg, 0), VPX_CODEC_OK);
> ++ // Start in threaded mode to ensure resolution and thread related
> ++ // allocations are updated correctly across changes in resolution and
> ++ // thread counts. See https://crbug.com/1486441.
> ++ cfg.g_threads = 4;
> ++ EXPECT_NO_FATAL_FAILURE(
> ++ InitCodec(*iface, kInitWidth, kInitHeight, &enc.ctx, &cfg));
> ++ if (IsVP9(iface)) {
> ++ EXPECT_EQ(vpx_codec_control_(&enc.ctx, VP9E_SET_TILE_COLUMNS, 6),
> ++ VPX_CODEC_OK);
> ++ EXPECT_EQ(vpx_codec_control_(&enc.ctx, VP9E_SET_ROW_MT, i),
> ++ VPX_CODEC_OK);
> ++ }
> ++
> ++ cfg.g_w = 1000;
> ++ cfg.g_h = 608;
> ++ EXPECT_EQ(vpx_codec_enc_config_set(&enc.ctx, &cfg), VPX_CODEC_OK)
> ++ << vpx_codec_error_detail(&enc.ctx);
> ++
> ++ cfg.g_w = 16;
> ++ cfg.g_h = 720;
> ++
> ++ for (const auto threads : { 1, 4, 8, 6, 2, 1 }) {
> ++ cfg.g_threads = threads;
> + EXPECT_NO_FATAL_FAILURE(EncodeWithConfig(cfg, &enc.ctx))
> + << "iteration: " << i << " threads: " << threads;
> + }
> diff -Nru libvpx-1.12.0/debian/patches/0003-VP8-disallow-thread-count-changes.patch libvpx-1.12.0/debian/patches/0003-VP8-disallow-thread-count-changes.patch
> --- libvpx-1.12.0/debian/patches/0003-VP8-disallow-thread-count-changes.patch 1970-01-01 01:00:00.000000000 +0100
> +++ libvpx-1.12.0/debian/patches/0003-VP8-disallow-thread-count-changes.patch 2023-09-28 23:07:11.000000000 +0200
> @@ -0,0 +1,51 @@
> +From: James Zern <jzern@google.com>
> +Date: Mon, 25 Sep 2023 18:55:59 -0700
> +Subject: VP8: disallow thread count changes
> +Origin: https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
> +Bug-Debian: https://bugs.debian.org/1053182
> +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2023-5217
> +
> +Currently allocations are done at encoder creation time. Going from
> +threaded to non-threaded would cause a crash.
> +
> +Bug: chromium:1486441
> +Change-Id: Ie301c2a70847dff2f0daae408fbef1e4d42e73d4
> +---
> + test/encode_api_test.cc | 4 ----
> + vp8/encoder/onyx_if.c | 5 +++++
> + 2 files changed, 5 insertions(+), 4 deletions(-)
> +
> +diff --git a/test/encode_api_test.cc b/test/encode_api_test.cc
> +index a8a4df2ddf88..f1c98b2c71c9 100644
> +--- a/test/encode_api_test.cc
> ++++ b/test/encode_api_test.cc
> +@@ -370,10 +370,6 @@ TEST(EncodeAPI, ConfigResizeChangeThreadCount) {
> +
> + for (const auto *iface : kCodecIfaces) {
> + SCOPED_TRACE(vpx_codec_iface_name(iface));
> +- if (!IsVP9(iface)) {
> +- GTEST_SKIP() << "TODO(https://crbug.com/1486441) remove this condition "
> +- "after VP8 is fixed.";
> +- }
> + for (int i = 0; i < (IsVP9(iface) ? 2 : 1); ++i) {
> + vpx_codec_enc_cfg_t cfg = {};
> + struct Encoder {
> +diff --git a/vp8/encoder/onyx_if.c b/vp8/encoder/onyx_if.c
> +index c65afc643bf6..c5e9970c3cc8 100644
> +--- a/vp8/encoder/onyx_if.c
> ++++ b/vp8/encoder/onyx_if.c
> +@@ -1447,6 +1447,11 @@ void vp8_change_config(VP8_COMP *cpi, VP8_CONFIG *oxcf) {
> + last_h = cpi->oxcf.Height;
> + prev_number_of_layers = cpi->oxcf.number_of_layers;
> +
> ++ if (cpi->initial_width) {
> ++ // TODO(https://crbug.com/1486441): Allow changing thread counts; the
> ++ // allocation is done once in vp8_create_compressor().
> ++ oxcf->multi_threaded = cpi->oxcf.multi_threaded;
> ++ }
> + cpi->oxcf = *oxcf;
> +
> + switch (cpi->oxcf.Mode) {
> +--
> +2.40.1
> +
> diff -Nru libvpx-1.12.0/debian/patches/series libvpx-1.12.0/debian/patches/series
> --- libvpx-1.12.0/debian/patches/series 2021-09-01 23:10:14.000000000 +0200
> +++ libvpx-1.12.0/debian/patches/series 2023-09-28 23:07:11.000000000 +0200
> @@ -1 +1,3 @@
> 0001-Relax-ABI-check.patch
> +0002-encode_api_test-add-ConfigResizeChangeThreadCount.patch
> +0003-VP8-disallow-thread-count-changes.patch
--
Sebastian Ramacher
Reply to: