Bug 906107 – <media-libs/dav1d-1.2.0: race condition leading to crash

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2023-05-11 04:21:01 UTC]

CVE-2023-32570:
https://code.videolan.org/videolan/dav1d/-/tags/1.2.0

VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

Please bump to 1.2.0.

[Comment 1 Luca Barbato 2023-05-13 15:11:15 UTC]

Thank you for the report!

[Comment 2 Luca Barbato 2023-05-13 16:03:07 UTC]

I'll wait for https://code.videolan.org/videolan/dav1d/-/issues/426 to be fixed.

[Comment 3 John Helmert III 2023-05-23 04:44:48 UTC]

(In reply to Luca Barbato from comment #2)
> I'll wait for https://code.videolan.org/videolan/dav1d/-/issues/426 to be
> fixed.

Closed with: https://code.videolan.org/videolan/dav1d/-/commit/5c584cb332e585e2527f08a5d596fad59c1f8c9b

[Comment 4 Larry the Git Cow 2023-05-31 07:00:19 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1e355a878b25f04e312e370946575fab5a0a785e

commit 1e355a878b25f04e312e370946575fab5a0a785e
Author:     Sam James <[e-mail]>
AuthorDate: 2023-05-31 06:39:04 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-05-31 06:56:27 +0000

    media-libs/dav1d: add 1.2.0
    
    Bug: https://bugs.gentoo.org/906107
    Signed-off-by: Sam James <[e-mail]>

 media-libs/dav1d/Manifest           |  1 +
 media-libs/dav1d/dav1d-1.2.0.ebuild | 61 +++++++++++++++++++++++++++++++++++++
 media-libs/dav1d/dav1d-9999.ebuild  | 12 +++++---
 3 files changed, 69 insertions(+), 5 deletions(-)

[Comment 5 Hans de Graaff 2023-10-07 06:28:25 UTC]

Ping. Please remove the vulnerable versions.

[Comment 6 Larry the Git Cow 2023-10-08 05:42:06 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=a319fb0f66c60cfb986c94c7087b361b4518c8c4

commit a319fb0f66c60cfb986c94c7087b361b4518c8c4
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2023-10-08 05:41:28 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-10-08 05:42:04 +0000

    [ GLSA 202310-05 ] dav1d: Denial of Service
    
    Bug: https://bugs.gentoo.org/906107
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Sam James <[e-mail]>

 glsa-202310-05.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

[Comment 7 Larry the Git Cow 2024-03-02 05:05:04 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a01624a3f5f46c4979ddb9eeb00a4cda2d4752a6

commit a01624a3f5f46c4979ddb9eeb00a4cda2d4752a6
Author:     Sam James <[e-mail]>
AuthorDate: 2024-03-02 05:01:24 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2024-03-02 05:01:54 +0000

    media-libs/dav1d: drop 0.9.2, 1.0.0
    
    Bug: https://bugs.gentoo.org/906107
    Signed-off-by: Sam James <[e-mail]>

 media-libs/dav1d/Manifest           |  2 --
 media-libs/dav1d/dav1d-0.9.2.ebuild | 61 -------------------------------------
 media-libs/dav1d/dav1d-1.0.0.ebuild | 59 -----------------------------------
 3 files changed, 122 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=da588fa1f4a753bbefec48a9f0505c9fc8978695

commit da588fa1f4a753bbefec48a9f0505c9fc8978695
Author:     Sam James <[e-mail]>
AuthorDate: 2024-03-02 05:00:46 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2024-03-02 05:01:50 +0000

    media-libs/dav1d: drop 1.1.0, 1.2.0
    
    Bug: https://bugs.gentoo.org/906107
    Signed-off-by: Sam James <[e-mail]>

 media-libs/dav1d/Manifest           |  2 --
 media-libs/dav1d/dav1d-1.1.0.ebuild | 59 -----------------------------------
 media-libs/dav1d/dav1d-1.2.0.ebuild | 61 -------------------------------------
 3 files changed, 122 deletions(-)