Version in base suite: 3.12.1-1 Base version: aom_3.12.1-1 Target version: aom_3.12.1-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/a/aom/aom_3.12.1-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/a/aom/aom_3.12.1-1+deb13u1.dsc changelog | 25 ++ patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch | 75 ++++++ patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch | 103 ++++++++ patches/0006-svc-add-more-spatial-temporal-layer-validation.patch | 123 ++++++++++ patches/series | 3 5 files changed, 329 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmprfk5vnee/aom_3.12.1-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmprfk5vnee/aom_3.12.1-1+deb13u1.dsc: no acceptable signature found diff -Nru aom-3.12.1/debian/changelog aom-3.12.1/debian/changelog --- aom-3.12.1/debian/changelog 2025-04-19 12:46:24.000000000 +0000 +++ aom-3.12.1/debian/changelog 2026-08-04 08:49:18.000000000 +0000 @@ -1,3 +1,28 @@ +aom (3.12.1-1+deb13u1) trixie-security; urgency=high + + * Non-maintainer upload by the Security Team. + * Backport upstream security fixes for four encoder vulnerabilities. + - debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch: + Validate the spatial and temporal layer ids passed to the + AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls + against the configured number of layers. + Fixes: CVE-2026-56210, CVE-2026-56209 and CVE-2026-56211. + - debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch: + Size the first-pass stats buffer to at least MAX_GF_LENGTH_LAP + 1, use + a compacting sliding window in Look-Ahead Processing mode and correct an + off-by-one in the rest_frames computation, fixing an out-of-bounds + access to the first-pass stats array triggered by a small + g_lag_in_frames (CVE-2026-56208). + * debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch: + Reject SVC spatial and temporal layer counts outside the supported range + in AOME_SET_NUMBER_SPATIAL_LAYERS and AV1E_SET_SVC_PARAMS, and report an + invalid parameter rather than relying on an assert() for the fixed-SVC + layer count limit. This is a pre-existing out-of-bounds access in 3.12.1, + included here because the layer id validation added above derives its + bounds from these counts. + + -- Aron Xu Tue, 04 Aug 2026 16:49:18 +0800 + aom (3.12.1-1) unstable; urgency=medium * Team upload. diff -Nru aom-3.12.1/debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch aom-3.12.1/debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch --- aom-3.12.1/debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch 1970-01-01 00:00:00.000000000 +0000 +++ aom-3.12.1/debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch 2026-08-04 08:49:18.000000000 +0000 @@ -0,0 +1,75 @@ +From: Marco Paniconi +Date: Sun, 19 Apr 2026 20:41:07 -0700 +Subject: svc: Check for invalid params for svc layer id setting +Origin: upstream, https://aomedia.googlesource.com/aom/+/a93ba0ffaacd5f576a241bf739110e65287e516d +Bug: https://issues.chromium.org/issues/503975732 +Bug: https://issues.chromium.org/issues/503993984 +Bug: https://issues.chromium.org/issues/503993985 +Bug-Debian: https://bugs.debian.org/1140428 +Applied-Upstream: 3.14.0 +Last-Update: 2026-08-04 +Description: Fix missing bounds check on the SVC layer id controls + The AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls did + not validate the caller-supplied spatial and temporal layer ids against the + number of layers actually configured via AV1E_SET_SVC_PARAMS. A negative or + too-large id propagated into the layer context array index and into the + cyclic refresh map pointer, causing an out-of-bounds read of the layer + context array (CVE-2026-56210), an out-of-bounds write through the cyclic + refresh map pointer (CVE-2026-56209), and potentially remote code execution + in a service that lets an attacker influence SVC encoder parameters + (CVE-2026-56211). + . + Return AOM_CODEC_INVALID_PARAM if the spatial or temporal layer id is below + 0 or at/above the configured number of layers, and update the documentation + of the controls accordingly. ppi->number_spatial_layers and + ppi->number_temporal_layers are both initialised to 1 by + init_config_sequence(), called from av1_create_primary_compressor() at + encoder init, so single-layer (non-SVC) callers passing id 0 are unaffected. +--- a/aom/aomcx.h ++++ b/aom/aomcx.h +@@ -197,7 +197,9 @@ enum aome_enc_control_id { + AOME_SET_SCALEMODE = 11, + + /*!\brief Codec control function to set encoder spatial layer id, int +- * parameter. ++ * parameter. Spatial layer id must be within valid range of 0 to the ++ * allowed number of spatial layers, set via the control ++ * AV1E_SET_SVC_PARAMS, or via AOME_SET_SPATIAL_LAYER_ID. + */ + AOME_SET_SPATIAL_LAYER_ID = 12, + +@@ -1280,7 +1282,9 @@ enum aome_enc_control_id { + /* NOTE: enums 145-149 unused */ + + /*!\brief Codec control function to set the layer id, aom_svc_layer_id_t* +- * parameter ++ * parameter. Layer id for spatial or temporal layer must be within valid ++ * range of 0 to the allowed number of spatial or temporal layers, set via ++ * the control AV1E_SET_SVC_PARAMS, or via AOME_SET_SPATIAL_LAYER_ID. + */ + AV1E_SET_SVC_LAYER_ID = 131, + +--- a/av1/av1_cx_iface.c ++++ b/av1/av1_cx_iface.c +@@ -3796,7 +3796,8 @@ static aom_codec_err_t ctrl_set_scale_mo + static aom_codec_err_t ctrl_set_spatial_layer_id(aom_codec_alg_priv_t *ctx, + va_list args) { + const int spatial_layer_id = va_arg(args, int); +- if (spatial_layer_id >= MAX_NUM_SPATIAL_LAYERS) ++ if (spatial_layer_id < 0 || ++ spatial_layer_id >= (int)ctx->ppi->number_spatial_layers) + return AOM_CODEC_INVALID_PARAM; + ctx->ppi->cpi->common.spatial_layer_id = spatial_layer_id; + return AOM_CODEC_OK; +@@ -3821,6 +3822,11 @@ static aom_codec_err_t ctrl_set_number_s + static aom_codec_err_t ctrl_set_layer_id(aom_codec_alg_priv_t *ctx, + va_list args) { + aom_svc_layer_id_t *const data = va_arg(args, aom_svc_layer_id_t *); ++ if (data->spatial_layer_id < 0 || data->temporal_layer_id < 0 || ++ data->spatial_layer_id >= (int)ctx->ppi->number_spatial_layers || ++ data->temporal_layer_id >= (int)ctx->ppi->number_temporal_layers) { ++ return AOM_CODEC_INVALID_PARAM; ++ } + ctx->ppi->cpi->common.spatial_layer_id = data->spatial_layer_id; + ctx->ppi->cpi->common.temporal_layer_id = data->temporal_layer_id; + ctx->ppi->cpi->svc.spatial_layer_id = data->spatial_layer_id; diff -Nru aom-3.12.1/debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch aom-3.12.1/debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch --- aom-3.12.1/debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch 1970-01-01 00:00:00.000000000 +0000 +++ aom-3.12.1/debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch 2026-08-04 08:49:18.000000000 +0000 @@ -0,0 +1,103 @@ +From: Cheng Chen +Date: Mon, 20 Apr 2026 13:09:59 -0700 +Subject: Handle buffer pointer in LAP mode to avoid overflow +Origin: upstream, https://aomedia.googlesource.com/aom/+/243f8ae84bfbc495b3a3c12948abc4dff3af2f84 +Bug: https://issues.chromium.org/issues/504317456 +Bug-Debian: https://bugs.debian.org/1140428 +Applied-Upstream: 3.14.0 +Reviewed-by: Aron Xu +Last-Update: 2026-08-04 +Description: Fix heap buffer overflow in the first-pass stats buffer in LAP mode + In Look-Ahead Processing (LAP) mode the first-pass stats buffer was sized + from g_lag_in_frames alone, leaving it far shorter than the longest group of + pictures LAP can analyse, and an off-by-one in the rest_frames computation + let the encoder run past the end of it (CVE-2026-56208). + . + Reproduced on 3.12.1 under AddressSanitizer with g_lag_in_frames = 1: a + heap-buffer-overflow read in find_next_scenecut(), reached from + identify_regions() via av1_get_second_pass_params(), 9 bytes past the + 487-byte allocation made by create_stats_buffer(). Applying only the + pass2_strategy.c hunk moves the fault to the stats store in + update_firstpass_stats(), so the buffer sizing change is load-bearing too. + . + The fix has three parts: + . + 1. Always allocate at least MAX_GF_LENGTH_LAP + 1 stats buffers, even when + lag-in-frames is smaller than MAX_GF_LENGTH_LAP. + 2. Use a compacting sliding window for the stats buffers in LAP mode so the + in-use region is moved back to the start of the buffer instead of + running off the end. + 3. Correct an off-by-one in the rest_frames computation in + av1_get_second_pass_params(), which is only wrong in LAP mode. + . + The patch is taken from upstream with the test/encode_api_test.cc hunk + dropped, since debian/rules configures with -DENABLE_TESTS=0 and the + upstream test suite is not built. The remaining hunks apply to 3.12.1 with + line offsets only. +--- a/av1/encoder/encoder.h ++++ b/av1/encoder/encoder.h +@@ -4122,7 +4122,10 @@ static inline int allow_postencode_drop_ + // Function return size of frame stats buffer + static inline int get_stats_buf_size(int num_lap_buffer, int num_lag_buffer) { + /* if lookahead is enabled return num_lap_buffers else num_lag_buffers */ +- return (num_lap_buffer > 0 ? num_lap_buffer + 1 : num_lag_buffer); ++ if (num_lap_buffer > 0) { ++ return AOMMAX(num_lap_buffer + 1, MAX_GF_LENGTH_LAP + 1); ++ } ++ return num_lag_buffer; + } + + // TODO(zoeliu): To set up cpi->oxcf.gf_cfg.enable_auto_brf +--- a/av1/encoder/firstpass.c ++++ b/av1/encoder/firstpass.c +@@ -984,6 +984,19 @@ static void update_firstpass_stats(AV1_C + twopass->stats_buf_ctx->stats_in_buf_end)) { + twopass->stats_buf_ctx->stats_in_end = + twopass->stats_buf_ctx->stats_in_start; ++ } else if (cpi->ppi->lap_enabled && ++ (twopass->stats_buf_ctx->stats_in_end >= ++ twopass->stats_buf_ctx->stats_in_buf_end)) { ++ const int num_valid = (int)(twopass->stats_buf_ctx->stats_in_end - ++ cpi->twopass_frame.stats_in); ++ if (num_valid > 0) { ++ memmove(twopass->stats_buf_ctx->stats_in_start, ++ cpi->twopass_frame.stats_in, ++ num_valid * sizeof(FIRSTPASS_STATS)); ++ } ++ cpi->twopass_frame.stats_in = twopass->stats_buf_ctx->stats_in_start; ++ twopass->stats_buf_ctx->stats_in_end = ++ twopass->stats_buf_ctx->stats_in_start + num_valid; + } + } + } +--- a/av1/encoder/pass2_strategy.c ++++ b/av1/encoder/pass2_strategy.c +@@ -3847,10 +3847,12 @@ void av1_get_second_pass_params(AV1_COMP + // how many frames we can analyze from this frame + int rest_frames = + AOMMIN(rc->frames_to_key, MAX_FIRSTPASS_ANALYSIS_FRAMES); +- rest_frames = +- AOMMIN(rest_frames, (int)(twopass->stats_buf_ctx->stats_in_end - +- cpi->twopass_frame.stats_in + +- (rc->frames_since_key == 0))); ++ int available_frames = (int)(twopass->stats_buf_ctx->stats_in_end - ++ cpi->twopass_frame.stats_in); ++ if (!cpi->ppi->lap_enabled) { ++ available_frames += (rc->frames_since_key == 0); ++ } ++ rest_frames = AOMMIN(rest_frames, available_frames); + p_rc->frames_till_regions_update = rest_frames; + + int ret; +@@ -3861,9 +3863,8 @@ void av1_get_second_pass_params(AV1_COMP + twopass->stats_buf_ctx->stats_in_end, cpi->common.error); + estimate_coeff(twopass->stats_buf_ctx->stats_in_start, + twopass->stats_buf_ctx->stats_in_end); +- ret = identify_regions(cpi->twopass_frame.stats_in, rest_frames, +- (rc->frames_since_key == 0), p_rc->regions, +- &p_rc->num_regions); ++ ret = identify_regions(cpi->twopass_frame.stats_in, rest_frames, 0, ++ p_rc->regions, &p_rc->num_regions); + } else { + ret = identify_regions( + cpi->twopass_frame.stats_in - (rc->frames_since_key == 0), diff -Nru aom-3.12.1/debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch aom-3.12.1/debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch --- aom-3.12.1/debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch 1970-01-01 00:00:00.000000000 +0000 +++ aom-3.12.1/debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch 2026-08-04 08:49:18.000000000 +0000 @@ -0,0 +1,123 @@ +From: James Zern +Date: Thu, 1 May 2025 13:49:30 -0700 +Subject: add more spatial/temporal layer validation +Origin: upstream, https://aomedia.googlesource.com/aom/+/30eb74d957ee19860f3f1e0b3ab4827136da1017 +Bug-Debian: https://bugs.debian.org/1140428 +Applied-Upstream: 3.13.0 +Reviewed-by: Aron Xu +Last-Update: 2026-08-04 +Description: Validate the SVC spatial/temporal layer counts + 3.12.1 accepts any value for the number of spatial and temporal layers: + AOME_SET_NUMBER_SPATIAL_LAYERS only rejects values above + MAX_NUM_SPATIAL_LAYERS, and AV1E_SET_SVC_PARAMS stores the caller's counts + before performing any validation. Out-of-range counts then propagate into + fixed-size arrays. Verified on 3.12.1 under AddressSanitizer: + . + * AOME_SET_NUMBER_SPATIAL_LAYERS(0) gives a heap-buffer-overflow write in + init_seq_coding_tools() (operating_point_idc[], MAX_NUM_OPERATING_POINTS + is 32), reached via av1_change_config_seq() from update_encoder_cfg(). + * AV1E_SET_SVC_PARAMS with number_spatial_layers = 5 gives an invalid read + in av1_free_svc_cyclic_refresh(); av1_init_layer_context() has by then + written past downsample_filter_type[] and drop_spatial_layer[], both + AOM_MAX_SS_LAYERS (4) entries. + . + Reject counts outside [1, MAX_NUM_SPATIAL_LAYERS] and + [1, MAX_NUM_TEMPORAL_LAYERS] in both controls, and turn the fixed-SVC-mode + layer count assert in av1_set_svc_fixed_mode() into an aom_internal_error(), + since assert() is compiled out in Debian builds. + . + This is not one of the four CVEs above and is not a regression from them; + both crashes reproduce identically on unpatched 3.12.1. It is included + because patch 0004 derives its layer id bound from these counts, so the + counts themselves need to be trustworthy. + . + The patch is taken from upstream with the test/encode_api_test.cc hunk + dropped, since debian/rules configures with -DENABLE_TESTS=0. The remaining + hunks apply to 3.12.1 with line offsets only. +--- a/aom/aomcx.h ++++ b/aom/aomcx.h +@@ -315,6 +315,10 @@ enum aome_enc_control_id { + + /*!\brief Codec control function to set number of spatial layers, int + * parameter ++ * ++ * Valid range: ++ * \li When using #AV1E_SET_SVC_REF_FRAME_CONFIG: [1, #AOM_MAX_SS_LAYERS] ++ * \li When \em not using #AV1E_SET_SVC_REF_FRAME_CONFIG: [1, 3] + */ + AOME_SET_NUMBER_SPATIAL_LAYERS = 27, + +@@ -1738,8 +1742,20 @@ typedef struct aom_svc_layer_id { + * + */ + typedef struct aom_svc_params { +- int number_spatial_layers; /**< Number of spatial layers */ +- int number_temporal_layers; /**< Number of temporal layers */ ++ /*!Number of spatial layers ++ * ++ * Valid range: ++ * \li When using #AV1E_SET_SVC_REF_FRAME_CONFIG: [1, #AOM_MAX_SS_LAYERS] ++ * \li When \em not using #AV1E_SET_SVC_REF_FRAME_CONFIG: [1, 3] ++ */ ++ int number_spatial_layers; ++ /*!Number of temporal layers ++ * ++ * Valid range: ++ * \li When using #AV1E_SET_SVC_REF_FRAME_CONFIG: [1, #AOM_MAX_TS_LAYERS] ++ * \li When \em not using #AV1E_SET_SVC_REF_FRAME_CONFIG: [1, 3] ++ */ ++ int number_temporal_layers; + int max_quantizers[AOM_MAX_LAYERS]; /**< Max Q for each layer */ + int min_quantizers[AOM_MAX_LAYERS]; /**< Min Q for each layer */ + int scaling_factor_num[AOM_MAX_SS_LAYERS]; /**< Scaling factor-numerator */ +--- a/av1/av1_cx_iface.c ++++ b/av1/av1_cx_iface.c +@@ -3806,7 +3806,12 @@ static aom_codec_err_t ctrl_set_spatial_ + static aom_codec_err_t ctrl_set_number_spatial_layers(aom_codec_alg_priv_t *ctx, + va_list args) { + const int number_spatial_layers = va_arg(args, int); +- if (number_spatial_layers > MAX_NUM_SPATIAL_LAYERS) ++ // Note svc.use_flexible_mode is set by AV1E_SET_SVC_REF_FRAME_CONFIG. When ++ // it is false (the default) the actual limit is 3 for both spatial and ++ // temporal layers. Given the order of these calls are unpredictable the ++ // final check is deferred until encoder_encode() (av1_set_svc_fixed_mode()). ++ if (number_spatial_layers <= 0 || ++ number_spatial_layers > MAX_NUM_SPATIAL_LAYERS) + return AOM_CODEC_INVALID_PARAM; + ctx->ppi->number_spatial_layers = number_spatial_layers; + // update_encoder_cfg() is somewhat costly and this control may be called +@@ -3840,6 +3845,16 @@ static aom_codec_err_t ctrl_set_svc_para + AV1_COMP *const cpi = ppi->cpi; + aom_svc_params_t *const params = va_arg(args, aom_svc_params_t *); + int64_t target_bandwidth = 0; ++ // Note svc.use_flexible_mode is set by AV1E_SET_SVC_REF_FRAME_CONFIG. When ++ // it is false (the default) the actual limit is 3 for both spatial and ++ // temporal layers. Given the order of these calls are unpredictable the ++ // final check is deferred until encoder_encode() (av1_set_svc_fixed_mode()). ++ if (params->number_spatial_layers <= 0 || ++ params->number_spatial_layers > MAX_NUM_SPATIAL_LAYERS || ++ params->number_temporal_layers <= 0 || ++ params->number_temporal_layers > MAX_NUM_TEMPORAL_LAYERS) { ++ return AOM_CODEC_INVALID_PARAM; ++ } + ppi->number_spatial_layers = params->number_spatial_layers; + ppi->number_temporal_layers = params->number_temporal_layers; + cpi->svc.number_spatial_layers = params->number_spatial_layers; +--- a/av1/encoder/svc_layercontext.c ++++ b/av1/encoder/svc_layercontext.c +@@ -477,9 +477,13 @@ void av1_set_svc_fixed_mode(AV1_COMP *co + RTC_REF *const rtc_ref = &cpi->ppi->rtc_ref; + int i; + assert(svc->use_flexible_mode == 0); ++ assert(svc->number_spatial_layers >= 1 && svc->number_temporal_layers >= 1); + // Fixed SVC mode only supports at most 3 spatial or temporal layers. +- assert(svc->number_spatial_layers >= 1 && svc->number_spatial_layers <= 3 && +- svc->number_temporal_layers >= 1 && svc->number_temporal_layers <= 3); ++ if (svc->number_spatial_layers > 3 || svc->number_temporal_layers > 3) { ++ aom_internal_error(&cpi->ppi->error, AOM_CODEC_INVALID_PARAM, ++ "Invalid number of spatial/temporal layers for fixed " ++ "SVC mode (max: 3)"); ++ } + rtc_ref->set_ref_frame_config = 1; + int superframe_cnt = svc->current_superframe; + // Set the reference map buffer idx for the 7 references: diff -Nru aom-3.12.1/debian/patches/series aom-3.12.1/debian/patches/series --- aom-3.12.1/debian/patches/series 2024-11-07 23:39:19.000000000 +0000 +++ aom-3.12.1/debian/patches/series 2026-08-04 08:49:18.000000000 +0000 @@ -1,3 +1,6 @@ 0001-doc-Use-libjs-mathjax-rather-than-cloudflare-copy.patch 0002-use-system-libyuv.patch 0003-use-system-libwebm.patch +0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch +0005-CVE-2026-56208-lap-stats-buffer-overflow.patch +0006-svc-add-more-spatial-temporal-layer-validation.patch