24 changed files with 1356 additions and 345 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,26 +1 @@
-libvpx-0.9.1.tar.bz2
+SOURCES/v1.7.0.tar.gz
 /libvpx-v0.9.5.tar.bz2
 /libvpx-v0.9.6.tar.bz2
 /libvpx-v0.9.7.tar.bz2
 /libvpx-v0.9.7-p1.tar.bz2
 /libvpx-v1.0.0.tar.bz2
 /libvpx-v1.1.0.tar.bz2
 /libvpx-v1.2.0.tar.bz2
 /libvpx-v1.3.0.tar.bz2
 /v1.4.0.tar.gz
 /libvpx-1.5.0.tar.bz2
 /libvpx-1.6.0.tar.bz2
 /v1.6.1.tar.gz
 /v1.7.0.tar.gz
 /v1.8.0.tar.gz
 /v1.8.1.tar.gz
 /v1.8.2.tar.gz
 /v1.9.0.tar.gz
 /v1.10.0-rc1.tar.gz
 /v1.10.0.tar.gz
 /v1.11.0.tar.gz
 /v1.12.0.tar.gz
 /v1.13.0.tar.gz
 /v1.13.1.tar.gz
 /v1.14.0.tar.gz
 /v1.14.1.tar.gz
--- a/.libvpx.metadata
+++ b/.libvpx.metadata
@ -0,0 +1 @@
 fb3d4b80596d1e3b1a7f53757d63e7d2b3eeb7c9 SOURCES/v1.7.0.tar.gz
--- a/0001-Fix-image-width-alignment.-Enable-ImageSizeSetting-t.patch
+++ b/0001-Fix-image-width-alignment.-Enable-ImageSizeSetting-t.patch
@ -1,54 +0,0 @@
 From 5a40c8fde11bf82cccb5bd2f57c46ab5e6262cbf Mon Sep 17 00:00:00 2001
 From: Jerome Jiang <jianj@google.com>
 Date: Wed, 27 Sep 2017 11:08:37 -0700
 Subject: [PATCH] Fix image width alignment. Enable ImageSizeSetting test.
 BUG=b/64710201
 Change-Id: I5465f6c6481d3c9a5e00fcab024cf4ae562b6b01
 diff --git a/vpx/src/vpx_image.c b/vpx/src/vpx_image.c
 index dba439c10..ebd3d7f74 100644
 --- a/vpx/src/vpx_image.c
 +++ b/vpx/src/vpx_image.c
@@ -88,11 +88,10 @@ static vpx_image_t *img_alloc_helper(vpx_image_t *img, vpx_img_fmt_t fmt,
     default: ycs = 0; break;
   }
 -  /* Calculate storage sizes given the chroma subsampling */
 -  align = (1 << xcs) - 1;
 -  w = (d_w + align) & ~align;
 -  align = (1 << ycs) - 1;
 -  h = (d_h + align) & ~align;
 +  /* Calculate storage sizes. If the buffer was allocated externally, the width
 +   * and height shouldn't be adjusted. */
 +  w = d_w;
 +  h = d_h;
   s = (fmt & VPX_IMG_FMT_PLANAR) ? w : bps * w / 8;
   s = (s + stride_align - 1) & ~(stride_align - 1);
   stride_in_bytes = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s;
@@ -111,9 +110,18 @@ static vpx_image_t *img_alloc_helper(vpx_image_t *img, vpx_img_fmt_t fmt,
   img->img_data = img_data;
   if (!img_data) {
 -    const uint64_t alloc_size = (fmt & VPX_IMG_FMT_PLANAR)
 -                                    ? (uint64_t)h * s * bps / 8
 -                                    : (uint64_t)h * s;
 +    uint64_t alloc_size;
 +    /* Calculate storage sizes given the chroma subsampling */
 +    align = xcs ? (1 << xcs) - 1 : 1;
 +    w = (d_w + align - 1) & ~(align - 1);
 +    align = ycs ? (1 << ycs) - 1 : 1;
 +    h = (d_h + align - 1) & ~(align - 1);
 +
 +    s = (fmt & VPX_IMG_FMT_PLANAR) ? w : bps * w / 8;
 +    s = (s + stride_align - 1) & ~(stride_align - 1);
 +    stride_in_bytes = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s;
 +    alloc_size = (fmt & VPX_IMG_FMT_PLANAR) ? (uint64_t)h * s * bps / 8
 +                                            : (uint64_t)h * s;
     if (alloc_size != (size_t)alloc_size) goto fail;
 -- 
 2.14.3
--- a/Bug-fix-in-ssse3-quantize-function.patch
+++ b/Bug-fix-in-ssse3-quantize-function.patch
@ -1,32 +0,0 @@
 commit 0d43bd77e5f429467fbd280a7b8f7fbc0bfe1809
 Author: Yunqing Wang <yunqingwang@google.com>
 Date:   Fri Feb 7 14:27:07 2014 -0800
    Bug fix in ssse3 quantize function
    A bug was reported in Issue 702: "SIGILL (Illegal instruction) when
    transcoding with vp9 - using FFmpeg". It was reproduced and fixed.
    Change-Id: Ie32c149a89af02856084aeaf289e848a905c7700
 diff --git a/vp9/encoder/x86/vp9_quantize_ssse3.asm b/vp9/encoder/x86/vp9_quantize_ssse3.asm
 index db30660..48ccef8 100644
 --- a/vp9/encoder/x86/vp9_quantize_ssse3.asm
 +++ b/vp9/encoder/x86/vp9_quantize_ssse3.asm
@@ -188,7 +188,8 @@ cglobal quantize_%1, 0, %2, 15, coeff, ncoeff, skip, zbin, round, quant, \
   pmaxsw                          m8, m7
   pshuflw                         m7, m8, 0x1
   pmaxsw                          m8, m7
 -  pextrw                        [r2], m8, 0
 +  pextrw                          r6, m8, 0
 +  mov                             [r2], r6
   RET
   ; skip-block, i.e. just write all zeroes
@@ -214,5 +215,5 @@ cglobal quantize_%1, 0, %2, 15, coeff, ncoeff, skip, zbin, round, quant, \
 %endmacro
 INIT_XMM ssse3
 -QUANTIZE_FN b, 6
 +QUANTIZE_FN b, 7
 QUANTIZE_FN b_32x32, 7
--- a/SOURCES/0001-CVE-2019-9232-Fix-OOB-memory-access-on-fuzzed-data.patch
+++ b/SOURCES/0001-CVE-2019-9232-Fix-OOB-memory-access-on-fuzzed-data.patch
@ -0,0 +1,45 @@
 From 953b0b85f8462efeac179341c912617c1bae8d4c Mon Sep 17 00:00:00 2001
 From: Wim Taymans <wtaymans@redhat.com>
 Date: Wed, 25 Mar 2020 13:39:30 +0100
 Subject: [PATCH 1/2] CVE-2019-9232: Fix OOB memory access on fuzzed data
 vp8_norm table has 256 elements while index to it can be higher on
 fuzzed data. Typecasting it to unsigned char will ensure valid range and
 will trigger proper error later. Also declaring "shift" as unsigned char to
 avoid UB sanitizer warning
 BUG=b/122373286,b/122373822,b/122371119
 ---
 vp8/decoder/dboolhuff.h | 2 +-
 vpx_dsp/bitreader.h     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 diff --git a/vp8/decoder/dboolhuff.h b/vp8/decoder/dboolhuff.h
 index 04c027cd7..f3b080509 100644
 --- a/vp8/decoder/dboolhuff.h
 +++ b/vp8/decoder/dboolhuff.h
@@ -76,7 +76,7 @@ static int vp8dx_decode_bool(BOOL_DECODER *br, int probability) {
   }
   {
 -    register int shift = vp8_norm[range];
 +    register unsigned char shift = vp8_norm[(unsigned char)range];
     range <<= shift;
     value <<= shift;
     count -= shift;
 diff --git a/vpx_dsp/bitreader.h b/vpx_dsp/bitreader.h
 index 6ee2a5863..4b87e986c 100644
 --- a/vpx_dsp/bitreader.h
 +++ b/vpx_dsp/bitreader.h
@@ -94,7 +94,7 @@ static INLINE int vpx_read(vpx_reader *r, int prob) {
   }
   {
 -    register int shift = vpx_norm[range];
 +    register unsigned char shift = vpx_norm[(unsigned char)range];
     range <<= shift;
     value <<= shift;
     count -= shift;
 -- 
 2.25.1
--- a/SOURCES/0001-Fix-bug-with-smaller-width-bigger-size.patch
+++ b/SOURCES/0001-Fix-bug-with-smaller-width-bigger-size.patch
@ -0,0 +1,103 @@
 From 0b9c2b782ae87f820aa34a19be7be6268f258172 Mon Sep 17 00:00:00 2001
 From: Jerome Jiang <jianj@google.com>
 Date: Thu, 30 Jun 2022 13:48:56 -0400
 Subject: [PATCH] Fix bug with smaller width bigger size
 Fixed previous patch that clusterfuzz failed on.
 Local fuzzing passing overnight.
 Bug: webm:1642
 Change-Id: If0e08e72abd2e042efe4dcfac21e4cc51afdfdb9
 (cherry picked from commit 263682c9a29395055f3b3afe2d97be1828a6223f)
 ---
 vp9/common/vp9_alloccommon.c | 13 ++++++-------
 vp9/encoder/vp9_encoder.c    | 27 +++++++++++++++++++++++++--
 2 files changed, 31 insertions(+), 9 deletions(-)
 diff --git a/vp9/common/vp9_alloccommon.c b/vp9/common/vp9_alloccommon.c
 index 7345e259b..2989ee015 100644
 --- a/vp9/common/vp9_alloccommon.c
 +++ b/vp9/common/vp9_alloccommon.c
@@ -122,13 +122,6 @@ int vp9_alloc_context_buffers(VP9_COMMON *cm, int width, int height) {
     cm->free_mi(cm);
     if (cm->alloc_mi(cm, new_mi_size)) goto fail;
   }
 -
 -  if (cm->seg_map_alloc_size < cm->mi_rows * cm->mi_cols) {
 -    // Create the segmentation map structure and set to 0.
 -    free_seg_map(cm);
 -    if (alloc_seg_map(cm, cm->mi_rows * cm->mi_cols)) goto fail;
 -  }
 -
   if (cm->above_context_alloc_cols < cm->mi_cols) {
     vpx_free(cm->above_context);
     cm->above_context = (ENTROPY_CONTEXT *)vpx_calloc(
@@ -143,6 +136,12 @@ int vp9_alloc_context_buffers(VP9_COMMON *cm, int width, int height) {
     cm->above_context_alloc_cols = cm->mi_cols;
   }
 +  if (cm->seg_map_alloc_size < cm->mi_rows * cm->mi_cols) {
 +    // Create the segmentation map structure and set to 0.
 +    free_seg_map(cm);
 +    if (alloc_seg_map(cm, cm->mi_rows * cm->mi_cols)) goto fail;
 +  }
 +
   if (vp9_alloc_loop_filter(cm)) goto fail;
   return 0;
 diff --git a/vp9/encoder/vp9_encoder.c b/vp9/encoder/vp9_encoder.c
 index 2ae59dd98..01a6d907b 100644
 --- a/vp9/encoder/vp9_encoder.c
 +++ b/vp9/encoder/vp9_encoder.c
@@ -1751,6 +1751,17 @@ static void alloc_copy_partition_data(VP9_COMP *cpi) {
   }
 }
 +static void free_copy_partition_data(VP9_COMP *cpi) {
 +  vpx_free(cpi->prev_partition);
 +  cpi->prev_partition = NULL;
 +  vpx_free(cpi->prev_segment_id);
 +  cpi->prev_segment_id = NULL;
 +  vpx_free(cpi->prev_variance_low);
 +  cpi->prev_variance_low = NULL;
 +  vpx_free(cpi->copied_frame_cnt);
 +  cpi->copied_frame_cnt = NULL;
 +}
 +
 void vp9_change_config(struct VP9_COMP *cpi, const VP9EncoderConfig *oxcf) {
   VP9_COMMON *const cm = &cpi->common;
   RATE_CONTROL *const rc = &cpi->rc;
@@ -1834,6 +1845,8 @@ void vp9_change_config(struct VP9_COMP *cpi, const VP9EncoderConfig *oxcf) {
     new_mi_size = cm->mi_stride * calc_mi_size(cm->mi_rows);
     if (cm->mi_alloc_size < new_mi_size) {
       vp9_free_context_buffers(cm);
 +      vp9_free_pc_tree(&cpi->td);
 +      vpx_free(cpi->mbmi_ext_base);
       alloc_compressor_data(cpi);
       realloc_segmentation_maps(cpi);
       cpi->initial_width = cpi->initial_height = 0;
@@ -1849,8 +1862,18 @@ void vp9_change_config(struct VP9_COMP *cpi, const VP9EncoderConfig *oxcf) {
     update_frame_size(cpi);
   if (last_w != cpi->oxcf.width || last_h != cpi->oxcf.height) {
 -    memset(cpi->consec_zero_mv, 0,
 -           cm->mi_rows * cm->mi_cols * sizeof(*cpi->consec_zero_mv));
 +    vpx_free(cpi->consec_zero_mv);
 +    CHECK_MEM_ERROR(
 +        cm, cpi->consec_zero_mv,
 +        vpx_calloc(cm->mi_rows * cm->mi_cols, sizeof(*cpi->consec_zero_mv)));
 +
 +    vpx_free(cpi->skin_map);
 +    CHECK_MEM_ERROR(
 +        cm, cpi->skin_map,
 +        vpx_calloc(cm->mi_rows * cm->mi_cols, sizeof(cpi->skin_map[0])));
 +
 +    free_copy_partition_data(cpi);
 +    alloc_copy_partition_data(cpi);
     if (cpi->oxcf.aq_mode == CYCLIC_REFRESH_AQ)
       vp9_cyclic_refresh_reset_resize(cpi);
     rc->rc_1_frame = 0;
 -- 
 2.41.0
--- a/SOURCES/0001-Fix-integer-overflows-in-calc-of-stride_in_bytes.patch
+++ b/SOURCES/0001-Fix-integer-overflows-in-calc-of-stride_in_bytes.patch
@ -0,0 +1,109 @@
 From 6b98423e19a68b182cd50e3c640f9828b025818b Mon Sep 17 00:00:00 2001
 From: Wan-Teh Chang <wtc@google.com>
 Date: Wed, 10 Apr 2024 17:01:10 -0700
 Subject: [PATCH 1/3] Fix integer overflows in calc of stride_in_bytes
 A port of the libaom CL
 https://aomedia-review.googlesource.com/c/aom/+/188761.
 Fix unsigned integer overflows in the calculation of stride_in_bytes in
 img_alloc_helper() when d_w is huge.
 Change the type of stride_in_bytes from unsigned int to int because it
 will be assigned to img->stride[VPX_PLANE_Y], which is of the int type.
 Test:
 . ../libvpx/tools/set_analyzer_env.sh integer
 ../libvpx/configure --enable-debug --disable-optimizations
 make -j
 ./test_libvpx --gtest_filter=VpxImageTest.VpxImgAllocHugeWidth
 Bug: chromium:332382766
 Change-Id: I3b39d78f61c7255e10cbf72ba2f4975425a05a82
 ---
 vpx/src/vpx_image.c | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)
 diff --git a/vpx/src/vpx_image.c b/vpx/src/vpx_image.c
 index af7c529a7..a01aab29c 100644
 --- a/vpx/src/vpx_image.c
 +++ b/vpx/src/vpx_image.c
@@ -20,9 +20,9 @@ static vpx_image_t *img_alloc_helper(vpx_image_t *img, vpx_img_fmt_t fmt,
                                      unsigned int buf_align,
                                      unsigned int stride_align,
                                      unsigned char *img_data) {
 -  unsigned int h, w, s, xcs, ycs, bps;
 -  unsigned int stride_in_bytes;
 -  int align;
 +  unsigned int h, w, xcs, ycs, bps;
 +  uint64_t s;
 +  int stride_in_bytes, align;
   /* Treat align==0 like align==1 */
   if (!buf_align) buf_align = 1;
@@ -92,9 +92,11 @@ static vpx_image_t *img_alloc_helper(vpx_image_t *img, vpx_img_fmt_t fmt,
    * and height shouldn't be adjusted. */
   w = d_w;
   h = d_h;
 -  s = (fmt & VPX_IMG_FMT_PLANAR) ? w : bps * w / 8;
 -  s = (s + stride_align - 1) & ~(stride_align - 1);
 -  stride_in_bytes = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s;
 +  s = (fmt & VPX_IMG_FMT_PLANAR) ? w : (uint64_t)bps * w / 8;
 +  s = (s + stride_align - 1) & ~((uint64_t)stride_align - 1);
 +  s = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s;
 +  if (s > INT_MAX) goto fail;
 +  stride_in_bytes = (int)s;
   /* Allocate the new image */
   if (!img) {
@@ -117,9 +119,11 @@ static vpx_image_t *img_alloc_helper(vpx_image_t *img, vpx_img_fmt_t fmt,
     align = (1 << ycs) - 1;
     h = (d_h + align) & ~align;
 -    s = (fmt & VPX_IMG_FMT_PLANAR) ? w : bps * w / 8;
 -    s = (s + stride_align - 1) & ~(stride_align - 1);
 -    stride_in_bytes = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s;
 +    s = (fmt & VPX_IMG_FMT_PLANAR) ? w : (uint64_t)bps * w / 8;
 +    s = (s + stride_align - 1) & ~((uint64_t)stride_align - 1);
 +    s = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s;
 +    if (s > INT_MAX) goto fail;
 +    stride_in_bytes = (int)s;
     alloc_size = (fmt & VPX_IMG_FMT_PLANAR) ? (uint64_t)h * s * bps / 8
                                             : (uint64_t)h * s;
@@ -185,18 +189,19 @@ int vpx_img_set_rect(vpx_image_t *img, unsigned int x, unsigned int y,
       if (img->fmt & VPX_IMG_FMT_HAS_ALPHA) {
         img->planes[VPX_PLANE_ALPHA] =
             data + x * bytes_per_sample + y * img->stride[VPX_PLANE_ALPHA];
 -        data += img->h * img->stride[VPX_PLANE_ALPHA];
 +        data += (size_t)img->h * img->stride[VPX_PLANE_ALPHA];
       }
       img->planes[VPX_PLANE_Y] =
           data + x * bytes_per_sample + y * img->stride[VPX_PLANE_Y];
 -      data += img->h * img->stride[VPX_PLANE_Y];
 +      data += (size_t)img->h * img->stride[VPX_PLANE_Y];
       if (!(img->fmt & VPX_IMG_FMT_UV_FLIP)) {
         img->planes[VPX_PLANE_U] =
             data + (x >> img->x_chroma_shift) * bytes_per_sample +
             (y >> img->y_chroma_shift) * img->stride[VPX_PLANE_U];
 -        data += (img->h >> img->y_chroma_shift) * img->stride[VPX_PLANE_U];
 +        data +=
 +            (size_t)(img->h >> img->y_chroma_shift) * img->stride[VPX_PLANE_U];
         img->planes[VPX_PLANE_V] =
             data + (x >> img->x_chroma_shift) * bytes_per_sample +
             (y >> img->y_chroma_shift) * img->stride[VPX_PLANE_V];
@@ -204,7 +209,8 @@ int vpx_img_set_rect(vpx_image_t *img, unsigned int x, unsigned int y,
         img->planes[VPX_PLANE_V] =
             data + (x >> img->x_chroma_shift) * bytes_per_sample +
             (y >> img->y_chroma_shift) * img->stride[VPX_PLANE_V];
 -        data += (img->h >> img->y_chroma_shift) * img->stride[VPX_PLANE_V];
 +        data +=
 +            (size_t)(img->h >> img->y_chroma_shift) * img->stride[VPX_PLANE_V];
         img->planes[VPX_PLANE_U] =
             data + (x >> img->x_chroma_shift) * bytes_per_sample +
             (y >> img->y_chroma_shift) * img->stride[VPX_PLANE_U];
 -- 
 2.45.2
--- a/SOURCES/0001-VP8-disallow-thread-count-changes.patch
+++ b/SOURCES/0001-VP8-disallow-thread-count-changes.patch
@ -0,0 +1,34 @@
 From 3a03995efe86129cde5df3a7de32fecdfce3259e Mon Sep 17 00:00:00 2001
 From: James Zern <jzern@google.com>
 Date: Mon, 25 Sep 2023 18:55:59 -0700
 Subject: [PATCH] VP8: disallow thread count changes
 Currently allocations are done at encoder creation time. Going from
 threaded to non-threaded would cause a crash.
 Bug: chromium:1486441
 Change-Id: Ie301c2a70847dff2f0daae408fbef1e4d42e73d4
 (cherry picked from commit 3fbd1dca6a4d2dad332a2110d646e4ffef36d590)
 ---
 vp8/encoder/onyx_if.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/vp8/encoder/onyx_if.c b/vp8/encoder/onyx_if.c
 index 224318242..e0c22070c 100644
 --- a/vp8/encoder/onyx_if.c
 +++ b/vp8/encoder/onyx_if.c
@@ -1449,6 +1449,11 @@ void vp8_change_config(VP8_COMP *cpi, VP8_CONFIG *oxcf) {
   last_h = cpi->oxcf.Height;
   prev_number_of_layers = cpi->oxcf.number_of_layers;
 +  if (cpi->initial_width) {
 +    // TODO(https://crbug.com/1486441): Allow changing thread counts; the
 +    // allocation is done once in vp8_create_compressor().
 +    oxcf->multi_threaded = cpi->oxcf.multi_threaded;
 +  }
   cpi->oxcf = *oxcf;
   switch (cpi->oxcf.Mode) {
 -- 
 2.41.0
--- a/SOURCES/0002-Apply-stride_align-to-byte-count-not-pixel-count.patch
+++ b/SOURCES/0002-Apply-stride_align-to-byte-count-not-pixel-count.patch
@ -0,0 +1,34 @@
 From f8472f581ed1b4dd0d205efdec72e43742f579fb Mon Sep 17 00:00:00 2001
 From: Wan-Teh Chang <wtc@google.com>
 Date: Thu, 11 Apr 2024 16:38:45 -0700
 Subject: [PATCH 2/3] Apply stride_align to byte count, not pixel count
 A port of the libaom CL
 https://aomedia-review.googlesource.com/c/aom/+/188962.
 stride_align is documented to be the "alignment, in bytes, of each row
 in the image (stride)."
 Change-Id: I2184b50dc3607611f47719319fa5adb3adcef2fd
 (cherry picked from commit 7d37ffacc6f7c45554b48ca867be4223248f1ed6)
 ---
 vpx/src/vpx_image.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/vpx/src/vpx_image.c b/vpx/src/vpx_image.c
 index a01aab29c..0c84562ae 100644
 --- a/vpx/src/vpx_image.c
 +++ b/vpx/src/vpx_image.c
@@ -93,8 +93,8 @@ static vpx_image_t *img_alloc_helper(vpx_image_t *img, vpx_img_fmt_t fmt,
   w = d_w;
   h = d_h;
   s = (fmt & VPX_IMG_FMT_PLANAR) ? w : (uint64_t)bps * w / 8;
 -  s = (s + stride_align - 1) & ~((uint64_t)stride_align - 1);
   s = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s;
 +  s = (s + stride_align - 1) & ~((uint64_t)stride_align - 1);
   if (s > INT_MAX) goto fail;
   stride_in_bytes = (int)s;
 -- 
 2.45.2
--- a/SOURCES/0002-CVE-2019-9433-VP8-Fix-use-after-free-in-postproc.patch
+++ b/SOURCES/0002-CVE-2019-9433-VP8-Fix-use-after-free-in-postproc.patch
@ -0,0 +1,33 @@
 From 93681819b22d3f42cf5fdfa85701f38e5bab10dd Mon Sep 17 00:00:00 2001
 From: Wim Taymans <wtaymans@redhat.com>
 Date: Wed, 25 Mar 2020 13:42:07 +0100
 Subject: [PATCH 2/2] CVE-2019-9433: VP8: Fix use-after-free in postproc.
 The pointer in vp8 postproc refers to show_frame_mi which is only
 updated on show frame. However, when there is a no-show frame which also
 changes the size (thus new frame buffers allocated), show_frame_mi is
 not updated with new frame buffer memory.
 Change the pointer in postproc to mi which is always updated.
 Bug: 842265
 ---
 vp8/common/postproc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/vp8/common/postproc.c b/vp8/common/postproc.c
 index d67ee8a57..8c292d616 100644
 --- a/vp8/common/postproc.c
 +++ b/vp8/common/postproc.c
@@ -65,7 +65,7 @@ void vp8_deblock(VP8_COMMON *cm, YV12_BUFFER_CONFIG *source,
   double level = 6.0e-05 * q * q * q - .0067 * q * q + .306 * q + .0065;
   int ppl = (int)(level + .5);
 -  const MODE_INFO *mode_info_context = cm->show_frame_mi;
 +  const MODE_INFO *mode_info_context = cm->mi;
   int mbr, mbc;
   /* The pixel thresholds are adjusted according to if or not the macroblock
 -- 
 2.25.1
--- a/SOURCES/0003-CVE-2019-9371-update-libwebm.patch
+++ b/SOURCES/0003-CVE-2019-9371-update-libwebm.patch
@ -0,0 +1,755 @@
 From ca1647dda267762c03c8641d2c605a9853a8ac59 Mon Sep 17 00:00:00 2001
 From: Johann <johannkoenig@google.com>
 Date: Tue, 24 Apr 2018 15:22:28 -0700
 Subject: [PATCH 3/4] CVE-2019-9371: update libwebm
 update libwebm to libwebm-1.0.0.27-358-gdbf1d10
 ---
 configure                                    |  8 +-
 third_party/libwebm/AUTHORS.TXT              |  8 +-
 third_party/libwebm/Android.mk               |  2 +-
 third_party/libwebm/README.libvpx            | 14 +++-
 third_party/libwebm/common/file_util.cc      | 19 ++++-
 third_party/libwebm/common/file_util.h       |  5 +-
 third_party/libwebm/common/hdr_util.cc       |  8 +-
 third_party/libwebm/common/hdr_util.h        | 10 +--
 third_party/libwebm/common/webmids.h         |  1 +
 third_party/libwebm/mkvmuxer/mkvmuxer.cc     | 77 +++++++++++++-------
 third_party/libwebm/mkvmuxer/mkvmuxer.h      |  5 +-
 third_party/libwebm/mkvmuxer/mkvmuxerutil.cc | 13 ++--
 third_party/libwebm/mkvmuxer/mkvmuxerutil.h  |  3 +
 third_party/libwebm/mkvmuxer/mkvwriter.cc    |  2 +
 third_party/libwebm/mkvparser/mkvparser.cc   | 64 +++++++++++-----
 third_party/libwebm/mkvparser/mkvparser.h    |  6 +-
 third_party/libwebm/mkvparser/mkvreader.cc   |  2 +
 17 files changed, 165 insertions(+), 82 deletions(-)
 diff --git a/configure b/configure
 index e5a74c6f2..56d203e6b 100755
 --- a/configure
 +++ b/configure
@@ -703,9 +703,7 @@ process_toolchain() {
             check_cxx "$@" <<EOF && soft_enable unit_tests
 int z;
 EOF
 -            check_cxx "$@" <<EOF && soft_enable webm_io
 -int z;
 -EOF
 +            check_add_cxx_flags -std=c++11 && soft_enable webm_io
             check_cxx "$@" <<EOF && soft_enable libyuv
 int z;
 EOF
@@ -714,9 +712,7 @@ EOF
             enabled pthread_h && check_cxx "$@" <<EOF && soft_enable unit_tests
 int z;
 EOF
 -            check_cxx "$@" <<EOF && soft_enable webm_io
 -int z;
 -EOF
 +            check_add_cxx_flags -std=c++11 && soft_enable webm_io
             check_cxx "$@" <<EOF && soft_enable libyuv
 int z;
 EOF
 diff --git a/third_party/libwebm/AUTHORS.TXT b/third_party/libwebm/AUTHORS.TXT
 index 8ab6f794c..9686ac13e 100644
 --- a/third_party/libwebm/AUTHORS.TXT
 +++ b/third_party/libwebm/AUTHORS.TXT
@@ -1,4 +1,4 @@
 -# Names should be added to this file like so:
 -# Name or Organization <email address>
 -
 -Google Inc.
 +# Names should be added to this file like so:
 +# Name or Organization <email address>
 +
 +Google Inc.
 diff --git a/third_party/libwebm/Android.mk b/third_party/libwebm/Android.mk
 index 8149a083f..b46ba101d 100644
 --- a/third_party/libwebm/Android.mk
 +++ b/third_party/libwebm/Android.mk
@@ -3,7 +3,7 @@ LOCAL_PATH:= $(call my-dir)
 include $(CLEAR_VARS)
 LOCAL_MODULE:= libwebm
 LOCAL_CPPFLAGS:=-D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS
 -LOCAL_CPPFLAGS+=-D__STDC_LIMIT_MACROS -Wno-extern-c-compat
 +LOCAL_CPPFLAGS+=-D__STDC_LIMIT_MACROS -std=c++11
 LOCAL_C_INCLUDES:= $(LOCAL_PATH)
 LOCAL_EXPORT_C_INCLUDES:= $(LOCAL_PATH)
 diff --git a/third_party/libwebm/README.libvpx b/third_party/libwebm/README.libvpx
 index ebb5ff2f4..16f17513e 100644
 --- a/third_party/libwebm/README.libvpx
 +++ b/third_party/libwebm/README.libvpx
@@ -1,5 +1,5 @@
 URL: https://chromium.googlesource.com/webm/libwebm
 -Version: 0ae757087f5e6eb01dfea16cc09205b2425cfb74
 +Version: dbf1d1089756e7cb5b1a04d6752310ef35912347
 License: BSD
 License File: LICENSE.txt
@@ -7,4 +7,14 @@ Description:
 libwebm is used to handle WebM container I/O.
 Local Changes:
 -* <none>
 +Only keep:
 + - Android.mk
 + - AUTHORS.TXT
 + - common/
 +    file_util.cc/h
 +    hdr_util.cc/h
 +    webmids.h
 + - LICENSE.TXT
 + - mkvmuxer/
 + - mkvparser/
 + - PATENTS.TXT
 diff --git a/third_party/libwebm/common/file_util.cc b/third_party/libwebm/common/file_util.cc
 index 6dab146dd..6eb6428b9 100644
 --- a/third_party/libwebm/common/file_util.cc
 +++ b/third_party/libwebm/common/file_util.cc
@@ -17,14 +17,15 @@
 #include <cstring>
 #include <fstream>
 #include <ios>
 +#include <string>
 namespace libwebm {
 std::string GetTempFileName() {
 #if !defined _MSC_VER && !defined __MINGW32__
   std::string temp_file_name_template_str =
 -      std::string(std::getenv("TEST_TMPDIR") ? std::getenv("TEST_TMPDIR") :
 -                                               ".") +
 +      std::string(std::getenv("TEST_TMPDIR") ? std::getenv("TEST_TMPDIR")
 +                                             : ".") +
       "/libwebm_temp.XXXXXX";
   char* temp_file_name_template =
       new char[temp_file_name_template_str.length() + 1];
@@ -41,7 +42,12 @@ std::string GetTempFileName() {
   return temp_file_name;
 #else
   char tmp_file_name[_MAX_PATH];
 +#if defined _MSC_VER || defined MINGW_HAS_SECURE_API
   errno_t err = tmpnam_s(tmp_file_name);
 +#else
 +  char* fname_pointer = tmpnam(tmp_file_name);
 +  int err = (fname_pointer == &tmp_file_name[0]) ? 0 : -1;
 +#endif
   if (err == 0) {
     return std::string(tmp_file_name);
   }
@@ -65,6 +71,15 @@ uint64_t GetFileSize(const std::string& file_name) {
   return file_size;
 }
 +bool GetFileContents(const std::string& file_name, std::string* contents) {
 +  std::ifstream file(file_name.c_str());
 +  *contents = std::string(static_cast<size_t>(GetFileSize(file_name)), 0);
 +  if (file.good() && contents->size()) {
 +    file.read(&(*contents)[0], contents->size());
 +  }
 +  return !file.fail();
 +}
 +
 TempFileDeleter::TempFileDeleter() { file_name_ = GetTempFileName(); }
 TempFileDeleter::~TempFileDeleter() {
 diff --git a/third_party/libwebm/common/file_util.h b/third_party/libwebm/common/file_util.h
 index 0e71eac11..a87373464 100644
 --- a/third_party/libwebm/common/file_util.h
 +++ b/third_party/libwebm/common/file_util.h
@@ -22,6 +22,9 @@ std::string GetTempFileName();
 // Returns size of file specified by |file_name|, or 0 upon failure.
 uint64_t GetFileSize(const std::string& file_name);
 +// Gets the contents file_name as a string. Returns false on error.
 +bool GetFileContents(const std::string& file_name, std::string* contents);
 +
 // Manages life of temporary file specified at time of construction. Deletes
 // file upon destruction.
 class TempFileDeleter {
@@ -38,4 +41,4 @@ class TempFileDeleter {
 }  // namespace libwebm
 -#endif  // LIBWEBM_COMMON_FILE_UTIL_H_
 \ No newline at end of file
 +#endif  // LIBWEBM_COMMON_FILE_UTIL_H_
 diff --git a/third_party/libwebm/common/hdr_util.cc b/third_party/libwebm/common/hdr_util.cc
 index e1618ce75..916f7170b 100644
 --- a/third_party/libwebm/common/hdr_util.cc
 +++ b/third_party/libwebm/common/hdr_util.cc
@@ -36,10 +36,10 @@ bool CopyMasteringMetadata(const mkvparser::MasteringMetadata& parser_mm,
   if (MasteringMetadataValuePresent(parser_mm.luminance_min))
     muxer_mm->set_luminance_min(parser_mm.luminance_min);
 -  PrimaryChromaticityPtr r_ptr(NULL);
 -  PrimaryChromaticityPtr g_ptr(NULL);
 -  PrimaryChromaticityPtr b_ptr(NULL);
 -  PrimaryChromaticityPtr wp_ptr(NULL);
 +  PrimaryChromaticityPtr r_ptr(nullptr);
 +  PrimaryChromaticityPtr g_ptr(nullptr);
 +  PrimaryChromaticityPtr b_ptr(nullptr);
 +  PrimaryChromaticityPtr wp_ptr(nullptr);
   if (parser_mm.r) {
     if (!CopyPrimaryChromaticity(*parser_mm.r, &r_ptr))
 diff --git a/third_party/libwebm/common/hdr_util.h b/third_party/libwebm/common/hdr_util.h
 index 3ef5388fd..78e2eeb70 100644
 --- a/third_party/libwebm/common/hdr_util.h
 +++ b/third_party/libwebm/common/hdr_util.h
@@ -47,15 +47,7 @@ struct Vp9CodecFeatures {
   int chroma_subsampling;
 };
 -// disable deprecation warnings for auto_ptr
 -#if defined(__GNUC__) && __GNUC__ >= 5
 -#pragma GCC diagnostic push
 -#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
 -#endif
 -typedef std::auto_ptr<mkvmuxer::PrimaryChromaticity> PrimaryChromaticityPtr;
 -#if defined(__GNUC__) && __GNUC__ >= 5
 -#pragma GCC diagnostic pop
 -#endif
 +typedef std::unique_ptr<mkvmuxer::PrimaryChromaticity> PrimaryChromaticityPtr;
 bool CopyPrimaryChromaticity(const mkvparser::PrimaryChromaticity& parser_pc,
                              PrimaryChromaticityPtr* muxer_pc);
 diff --git a/third_party/libwebm/common/webmids.h b/third_party/libwebm/common/webmids.h
 index 89d722a71..fc0c20814 100644
 --- a/third_party/libwebm/common/webmids.h
 +++ b/third_party/libwebm/common/webmids.h
@@ -93,6 +93,7 @@ enum MkvId {
   kMkvDisplayHeight = 0x54BA,
   kMkvDisplayUnit = 0x54B2,
   kMkvAspectRatioType = 0x54B3,
 +  kMkvColourSpace = 0x2EB524,
   kMkvFrameRate = 0x2383E3,
   // end video
   // colour
 diff --git a/third_party/libwebm/mkvmuxer/mkvmuxer.cc b/third_party/libwebm/mkvmuxer/mkvmuxer.cc
 index 15b9a908d..512031211 100644
 --- a/third_party/libwebm/mkvmuxer/mkvmuxer.cc
 +++ b/third_party/libwebm/mkvmuxer/mkvmuxer.cc
@@ -8,6 +8,8 @@
 #include "mkvmuxer/mkvmuxer.h"
 +#include <stdint.h>
 +
 #include <cfloat>
 #include <climits>
 #include <cstdio>
@@ -24,11 +26,6 @@
 #include "mkvmuxer/mkvwriter.h"
 #include "mkvparser/mkvparser.h"
 -// disable deprecation warnings for auto_ptr
 -#if defined(__GNUC__) && __GNUC__ >= 5
 -#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
 -#endif
 -
 namespace mkvmuxer {
 const float PrimaryChromaticity::kChromaticityMin = 0.0f;
@@ -72,7 +69,7 @@ bool StrCpy(const char* src, char** dst_ptr) {
   return true;
 }
 -typedef std::auto_ptr<PrimaryChromaticity> PrimaryChromaticityPtr;
 +typedef std::unique_ptr<PrimaryChromaticity> PrimaryChromaticityPtr;
 bool CopyChromaticity(const PrimaryChromaticity* src,
                       PrimaryChromaticityPtr* dst) {
   if (!dst)
@@ -776,6 +773,14 @@ bool Track::Write(IMkvWriter* writer) const {
   if (!type_ || !codec_id_)
     return false;
 +  // AV1 tracks require a CodecPrivate. See
 +  // https://github.com/Matroska-Org/matroska-specification/blob/av1-mappin/codec/av1.md
 +  // TODO(tomfinegan): Update the above link to the AV1 Matroska mappings to
 +  // point to a stable version once it is finalized, or our own WebM mappings
 +  // page on webmproject.org should we decide to release them.
 +  if (!strcmp(codec_id_, Tracks::kAv1CodecId) && !codec_private_)
 +    return false;
 +
   // |size| may be bigger than what is written out in this function because
   // derived classes may write out more data in the Track element.
   const uint64_t payload_size = PayloadSize();
@@ -1030,19 +1035,16 @@ bool MasteringMetadata::Write(IMkvWriter* writer) const {
       !WriteEbmlElement(writer, libwebm::kMkvLuminanceMin, luminance_min_)) {
     return false;
   }
 -  if (r_ &&
 -      !r_->Write(writer, libwebm::kMkvPrimaryRChromaticityX,
 -                 libwebm::kMkvPrimaryRChromaticityY)) {
 +  if (r_ && !r_->Write(writer, libwebm::kMkvPrimaryRChromaticityX,
 +                       libwebm::kMkvPrimaryRChromaticityY)) {
     return false;
   }
 -  if (g_ &&
 -      !g_->Write(writer, libwebm::kMkvPrimaryGChromaticityX,
 -                 libwebm::kMkvPrimaryGChromaticityY)) {
 +  if (g_ && !g_->Write(writer, libwebm::kMkvPrimaryGChromaticityX,
 +                       libwebm::kMkvPrimaryGChromaticityY)) {
     return false;
   }
 -  if (b_ &&
 -      !b_->Write(writer, libwebm::kMkvPrimaryBChromaticityX,
 -                 libwebm::kMkvPrimaryBChromaticityY)) {
 +  if (b_ && !b_->Write(writer, libwebm::kMkvPrimaryBChromaticityX,
 +                       libwebm::kMkvPrimaryBChromaticityY)) {
     return false;
   }
   if (white_point_ &&
@@ -1057,22 +1059,22 @@ bool MasteringMetadata::Write(IMkvWriter* writer) const {
 bool MasteringMetadata::SetChromaticity(
     const PrimaryChromaticity* r, const PrimaryChromaticity* g,
     const PrimaryChromaticity* b, const PrimaryChromaticity* white_point) {
 -  PrimaryChromaticityPtr r_ptr(NULL);
 +  PrimaryChromaticityPtr r_ptr(nullptr);
   if (r) {
     if (!CopyChromaticity(r, &r_ptr))
       return false;
   }
 -  PrimaryChromaticityPtr g_ptr(NULL);
 +  PrimaryChromaticityPtr g_ptr(nullptr);
   if (g) {
     if (!CopyChromaticity(g, &g_ptr))
       return false;
   }
 -  PrimaryChromaticityPtr b_ptr(NULL);
 +  PrimaryChromaticityPtr b_ptr(nullptr);
   if (b) {
     if (!CopyChromaticity(b, &b_ptr))
       return false;
   }
 -  PrimaryChromaticityPtr wp_ptr(NULL);
 +  PrimaryChromaticityPtr wp_ptr(nullptr);
   if (white_point) {
     if (!CopyChromaticity(white_point, &wp_ptr))
       return false;
@@ -1238,7 +1240,7 @@ bool Colour::Write(IMkvWriter* writer) const {
 }
 bool Colour::SetMasteringMetadata(const MasteringMetadata& mastering_metadata) {
 -  std::auto_ptr<MasteringMetadata> mm_ptr(new MasteringMetadata());
 +  std::unique_ptr<MasteringMetadata> mm_ptr(new MasteringMetadata());
   if (!mm_ptr.get())
     return false;
@@ -1424,6 +1426,7 @@ VideoTrack::VideoTrack(unsigned int* seed)
       stereo_mode_(0),
       alpha_mode_(0),
       width_(0),
 +      colour_space_(NULL),
       colour_(NULL),
       projection_(NULL) {}
@@ -1521,6 +1524,10 @@ bool VideoTrack::Write(IMkvWriter* writer) const {
                           static_cast<uint64>(alpha_mode_)))
       return false;
   }
 +  if (colour_space_) {
 +    if (!WriteEbmlElement(writer, libwebm::kMkvColourSpace, colour_space_))
 +      return false;
 +  }
   if (frame_rate_ > 0.0) {
     if (!WriteEbmlElement(writer, libwebm::kMkvFrameRate,
                           static_cast<float>(frame_rate_))) {
@@ -1545,8 +1552,24 @@ bool VideoTrack::Write(IMkvWriter* writer) const {
   return true;
 }
 +void VideoTrack::set_colour_space(const char* colour_space) {
 +  if (colour_space) {
 +    delete[] colour_space_;
 +
 +    const size_t length = strlen(colour_space) + 1;
 +    colour_space_ = new (std::nothrow) char[length];  // NOLINT
 +    if (colour_space_) {
 +#ifdef _MSC_VER
 +      strcpy_s(colour_space_, length, colour_space);
 +#else
 +      strcpy(colour_space_, colour_space);
 +#endif
 +    }
 +  }
 +}
 +
 bool VideoTrack::SetColour(const Colour& colour) {
 -  std::auto_ptr<Colour> colour_ptr(new Colour());
 +  std::unique_ptr<Colour> colour_ptr(new Colour());
   if (!colour_ptr.get())
     return false;
@@ -1574,7 +1597,7 @@ bool VideoTrack::SetColour(const Colour& colour) {
 }
 bool VideoTrack::SetProjection(const Projection& projection) {
 -  std::auto_ptr<Projection> projection_ptr(new Projection());
 +  std::unique_ptr<Projection> projection_ptr(new Projection());
   if (!projection_ptr.get())
     return false;
@@ -1628,6 +1651,8 @@ uint64_t VideoTrack::VideoPayloadSize() const {
   if (frame_rate_ > 0.0)
     size += EbmlElementSize(libwebm::kMkvFrameRate,
                             static_cast<float>(frame_rate_));
 +  if (colour_space_)
 +    size += EbmlElementSize(libwebm::kMkvColourSpace, colour_space_);
   if (colour_)
     size += colour_->ColourSize();
   if (projection_)
@@ -1705,9 +1730,9 @@ bool AudioTrack::Write(IMkvWriter* writer) const {
 const char Tracks::kOpusCodecId[] = "A_OPUS";
 const char Tracks::kVorbisCodecId[] = "A_VORBIS";
 +const char Tracks::kAv1CodecId[] = "V_AV1";
 const char Tracks::kVp8CodecId[] = "V_VP8";
 const char Tracks::kVp9CodecId[] = "V_VP9";
 -const char Tracks::kVp10CodecId[] = "V_VP10";
 const char Tracks::kWebVttCaptionsId[] = "D_WEBVTT/CAPTIONS";
 const char Tracks::kWebVttDescriptionsId[] = "D_WEBVTT/DESCRIPTIONS";
 const char Tracks::kWebVttMetadataId[] = "D_WEBVTT/METADATA";
@@ -2666,7 +2691,7 @@ bool Cluster::QueueOrWriteFrame(const Frame* const frame) {
   // and write it if it is okay to do so (i.e.) no other track has an held back
   // frame with timestamp <= the timestamp of the frame in question.
   std::vector<std::list<Frame*>::iterator> frames_to_erase;
 -  for (std::list<Frame *>::iterator
 +  for (std::list<Frame*>::iterator
            current_track_iterator = stored_frames_[track_number].begin(),
            end = --stored_frames_[track_number].end();
        current_track_iterator != end; ++current_track_iterator) {
@@ -4168,8 +4193,8 @@ bool Segment::DocTypeIsWebm() const {
   // TODO(vigneshv): Tweak .clang-format.
   const char* kWebmCodecIds[kNumCodecIds] = {
       Tracks::kOpusCodecId,          Tracks::kVorbisCodecId,
 -      Tracks::kVp8CodecId,           Tracks::kVp9CodecId,
 -      Tracks::kVp10CodecId,          Tracks::kWebVttCaptionsId,
 +      Tracks::kAv1CodecId,           Tracks::kVp8CodecId,
 +      Tracks::kVp9CodecId,           Tracks::kWebVttCaptionsId,
       Tracks::kWebVttDescriptionsId, Tracks::kWebVttMetadataId,
       Tracks::kWebVttSubtitlesId};
 diff --git a/third_party/libwebm/mkvmuxer/mkvmuxer.h b/third_party/libwebm/mkvmuxer/mkvmuxer.h
 index 46b0029dc..f2db37714 100644
 --- a/third_party/libwebm/mkvmuxer/mkvmuxer.h
 +++ b/third_party/libwebm/mkvmuxer/mkvmuxer.h
@@ -795,6 +795,8 @@ class VideoTrack : public Track {
   uint64_t alpha_mode() { return alpha_mode_; }
   void set_width(uint64_t width) { width_ = width; }
   uint64_t width() const { return width_; }
 +  void set_colour_space(const char* colour_space);
 +  const char* colour_space() const { return colour_space_; }
   Colour* colour() { return colour_; }
@@ -824,6 +826,7 @@ class VideoTrack : public Track {
   uint64_t stereo_mode_;
   uint64_t alpha_mode_;
   uint64_t width_;
 +  char* colour_space_;
   Colour* colour_;
   Projection* projection_;
@@ -871,9 +874,9 @@ class Tracks {
   static const char kOpusCodecId[];
   static const char kVorbisCodecId[];
 +  static const char kAv1CodecId[];
   static const char kVp8CodecId[];
   static const char kVp9CodecId[];
 -  static const char kVp10CodecId[];
   static const char kWebVttCaptionsId[];
   static const char kWebVttDescriptionsId[];
   static const char kWebVttMetadataId[];
 diff --git a/third_party/libwebm/mkvmuxer/mkvmuxerutil.cc b/third_party/libwebm/mkvmuxer/mkvmuxerutil.cc
 index 355d4e22b..7636a9f4e 100644
 --- a/third_party/libwebm/mkvmuxer/mkvmuxerutil.cc
 +++ b/third_party/libwebm/mkvmuxer/mkvmuxerutil.cc
@@ -136,9 +136,8 @@ uint64 WriteBlock(IMkvWriter* writer, const Frame* const frame, int64 timecode,
     return false;
   }
 -  if (!frame->is_key() &&
 -      !WriteEbmlElement(writer, libwebm::kMkvReferenceBlock,
 -                        reference_block_timestamp)) {
 +  if (!frame->is_key() && !WriteEbmlElement(writer, libwebm::kMkvReferenceBlock,
 +                                            reference_block_timestamp)) {
     return false;
   }
@@ -563,10 +562,10 @@ uint64 WriteFrame(IMkvWriter* writer, const Frame* const frame,
   if (relative_timecode < 0 || relative_timecode > kMaxBlockTimecode)
     return 0;
 -  return frame->CanBeSimpleBlock() ?
 -             WriteSimpleBlock(writer, frame, relative_timecode) :
 -             WriteBlock(writer, frame, relative_timecode,
 -                        cluster->timecode_scale());
 +  return frame->CanBeSimpleBlock()
 +             ? WriteSimpleBlock(writer, frame, relative_timecode)
 +             : WriteBlock(writer, frame, relative_timecode,
 +                          cluster->timecode_scale());
 }
 uint64 WriteVoidElement(IMkvWriter* writer, uint64 size) {
 diff --git a/third_party/libwebm/mkvmuxer/mkvmuxerutil.h b/third_party/libwebm/mkvmuxer/mkvmuxerutil.h
 index 132388da5..3355428bd 100644
 --- a/third_party/libwebm/mkvmuxer/mkvmuxerutil.h
 +++ b/third_party/libwebm/mkvmuxer/mkvmuxerutil.h
@@ -31,6 +31,9 @@ const int64 kMaxBlockTimecode = 0x07FFFLL;
 // Writes out |value| in Big Endian order. Returns 0 on success.
 int32 SerializeInt(IMkvWriter* writer, int64 value, int32 size);
 +// Writes out |f| in Big Endian order. Returns 0 on success.
 +int32 SerializeFloat(IMkvWriter* writer, float f);
 +
 // Returns the size in bytes of the element.
 int32 GetUIntSize(uint64 value);
 int32 GetIntSize(int64 value);
 diff --git a/third_party/libwebm/mkvmuxer/mkvwriter.cc b/third_party/libwebm/mkvmuxer/mkvwriter.cc
 index 84655d802..d668384d8 100644
 --- a/third_party/libwebm/mkvmuxer/mkvwriter.cc
 +++ b/third_party/libwebm/mkvmuxer/mkvwriter.cc
@@ -78,6 +78,8 @@ int32 MkvWriter::Position(int64 position) {
 #ifdef _MSC_VER
   return _fseeki64(file_, position, SEEK_SET);
 +#elif defined(_WIN32)
 +  return fseeko64(file_, static_cast<off_t>(position), SEEK_SET);
 #else
   return fseeko(file_, static_cast<off_t>(position), SEEK_SET);
 #endif
 diff --git a/third_party/libwebm/mkvparser/mkvparser.cc b/third_party/libwebm/mkvparser/mkvparser.cc
 index 37f230d0a..dcb969dcf 100644
 --- a/third_party/libwebm/mkvparser/mkvparser.cc
 +++ b/third_party/libwebm/mkvparser/mkvparser.cc
@@ -22,12 +22,8 @@
 #include "common/webmids.h"
 -// disable deprecation warnings for auto_ptr
 -#if defined(__GNUC__) && __GNUC__ >= 5
 -#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
 -#endif
 -
 namespace mkvparser {
 +const long long kStringElementSizeLimit = 20 * 1000 * 1000;
 const float MasteringMetadata::kValueNotPresent = FLT_MAX;
 const long long Colour::kValueNotPresent = LLONG_MAX;
 const float Projection::kValueNotPresent = FLT_MAX;
@@ -40,8 +36,6 @@ inline bool isnan(double val) { return std::isnan(val); }
 inline bool isinf(double val) { return std::isinf(val); }
 #endif  // MSC_COMPAT
 -IMkvReader::~IMkvReader() {}
 -
 template <typename Type>
 Type* SafeArrayAlloc(unsigned long long num_elements,
                      unsigned long long element_size) {
@@ -330,7 +324,7 @@ long UnserializeString(IMkvReader* pReader, long long pos, long long size,
   delete[] str;
   str = NULL;
 -  if (size >= LONG_MAX || size < 0)
 +  if (size >= LONG_MAX || size < 0 || size > kStringElementSizeLimit)
     return E_FILE_FORMAT_INVALID;
   // +1 for '\0' terminator
@@ -5015,7 +5009,7 @@ bool MasteringMetadata::Parse(IMkvReader* reader, long long mm_start,
   if (!reader || *mm)
     return false;
 -  std::auto_ptr<MasteringMetadata> mm_ptr(new MasteringMetadata());
 +  std::unique_ptr<MasteringMetadata> mm_ptr(new MasteringMetadata());
   if (!mm_ptr.get())
     return false;
@@ -5035,6 +5029,10 @@ bool MasteringMetadata::Parse(IMkvReader* reader, long long mm_start,
       double value = 0;
       const long long value_parse_status =
           UnserializeFloat(reader, read_pos, child_size, value);
 +      if (value < -FLT_MAX || value > FLT_MAX ||
 +          (value > 0.0 && value < FLT_MIN)) {
 +        return false;
 +      }
       mm_ptr->luminance_max = static_cast<float>(value);
       if (value_parse_status < 0 || mm_ptr->luminance_max < 0.0 ||
           mm_ptr->luminance_max > 9999.99) {
@@ -5044,6 +5042,10 @@ bool MasteringMetadata::Parse(IMkvReader* reader, long long mm_start,
       double value = 0;
       const long long value_parse_status =
           UnserializeFloat(reader, read_pos, child_size, value);
 +      if (value < -FLT_MAX || value > FLT_MAX ||
 +          (value > 0.0 && value < FLT_MIN)) {
 +        return false;
 +      }
       mm_ptr->luminance_min = static_cast<float>(value);
       if (value_parse_status < 0 || mm_ptr->luminance_min < 0.0 ||
           mm_ptr->luminance_min > 999.9999) {
@@ -5096,7 +5098,7 @@ bool Colour::Parse(IMkvReader* reader, long long colour_start,
   if (!reader || *colour)
     return false;
 -  std::auto_ptr<Colour> colour_ptr(new Colour());
 +  std::unique_ptr<Colour> colour_ptr(new Colour());
   if (!colour_ptr.get())
     return false;
@@ -5194,7 +5196,7 @@ bool Projection::Parse(IMkvReader* reader, long long start, long long size,
   if (!reader || *projection)
     return false;
 -  std::auto_ptr<Projection> projection_ptr(new Projection());
 +  std::unique_ptr<Projection> projection_ptr(new Projection());
   if (!projection_ptr.get())
     return false;
@@ -5270,6 +5272,7 @@ bool Projection::Parse(IMkvReader* reader, long long start, long long size,
 VideoTrack::VideoTrack(Segment* pSegment, long long element_start,
                        long long element_size)
     : Track(pSegment, element_start, element_size),
 +      m_colour_space(NULL),
       m_colour(NULL),
       m_projection(NULL) {}
@@ -5295,6 +5298,7 @@ long VideoTrack::Parse(Segment* pSegment, const Info& info,
   long long stereo_mode = 0;
   double rate = 0.0;
 +  char* colour_space = NULL;
   IMkvReader* const pReader = pSegment->m_pReader;
@@ -5307,8 +5311,8 @@ long VideoTrack::Parse(Segment* pSegment, const Info& info,
   const long long stop = pos + s.size;
 -  Colour* colour = NULL;
 -  Projection* projection = NULL;
 +  std::unique_ptr<Colour> colour_ptr;
 +  std::unique_ptr<Projection> projection_ptr;
   while (pos < stop) {
     long long id, size;
@@ -5357,11 +5361,23 @@ long VideoTrack::Parse(Segment* pSegment, const Info& info,
       if (rate <= 0)
         return E_FILE_FORMAT_INVALID;
     } else if (id == libwebm::kMkvColour) {
 -      if (!Colour::Parse(pReader, pos, size, &colour))
 +      Colour* colour = NULL;
 +      if (!Colour::Parse(pReader, pos, size, &colour)) {
         return E_FILE_FORMAT_INVALID;
 +      } else {
 +        colour_ptr.reset(colour);
 +      }
     } else if (id == libwebm::kMkvProjection) {
 -      if (!Projection::Parse(pReader, pos, size, &projection))
 +      Projection* projection = NULL;
 +      if (!Projection::Parse(pReader, pos, size, &projection)) {
         return E_FILE_FORMAT_INVALID;
 +      } else {
 +        projection_ptr.reset(projection);
 +      }
 +    } else if (id == libwebm::kMkvColourSpace) {
 +      const long status = UnserializeString(pReader, pos, size, colour_space);
 +      if (status < 0)
 +        return status;
     }
     pos += size;  // consume payload
@@ -5392,8 +5408,9 @@ long VideoTrack::Parse(Segment* pSegment, const Info& info,
   pTrack->m_display_unit = display_unit;
   pTrack->m_stereo_mode = stereo_mode;
   pTrack->m_rate = rate;
 -  pTrack->m_colour = colour;
 -  pTrack->m_projection = projection;
 +  pTrack->m_colour = colour_ptr.release();
 +  pTrack->m_colour_space = colour_space;
 +  pTrack->m_projection = projection_ptr.release();
   pResult = pTrack;
   return 0;  // success
@@ -7903,6 +7920,10 @@ long Block::Parse(const Cluster* pCluster) {
         return E_FILE_FORMAT_INVALID;
       curr.len = static_cast<long>(frame_size);
 +      // Check if size + curr.len could overflow.
 +      if (size > LLONG_MAX - curr.len) {
 +        return E_FILE_FORMAT_INVALID;
 +      }
       size += curr.len;  // contribution of this frame
       --frame_count;
@@ -7964,6 +7985,11 @@ long long Block::GetTimeCode(const Cluster* pCluster) const {
   const long long tc0 = pCluster->GetTimeCode();
   assert(tc0 >= 0);
 +  // Check if tc0 + m_timecode would overflow.
 +  if (tc0 < 0 || LLONG_MAX - tc0 < m_timecode) {
 +    return -1;
 +  }
 +
   const long long tc = tc0 + m_timecode;
   return tc;  // unscaled timecode units
@@ -7981,6 +8007,10 @@ long long Block::GetTime(const Cluster* pCluster) const {
   const long long scale = pInfo->GetTimeCodeScale();
   assert(scale >= 1);
 +  // Check if tc * scale could overflow.
 +  if (tc != 0 && scale > LLONG_MAX / tc) {
 +    return -1;
 +  }
   const long long ns = tc * scale;
   return ns;
 diff --git a/third_party/libwebm/mkvparser/mkvparser.h b/third_party/libwebm/mkvparser/mkvparser.h
 index 26c2b7e5e..848d01f03 100644
 --- a/third_party/libwebm/mkvparser/mkvparser.h
 +++ b/third_party/libwebm/mkvparser/mkvparser.h
@@ -22,7 +22,7 @@ class IMkvReader {
   virtual int Length(long long* total, long long* available) = 0;
  protected:
 -  virtual ~IMkvReader();
 +  virtual ~IMkvReader() {}
 };
 template <typename Type>
@@ -527,6 +527,8 @@ class VideoTrack : public Track {
   Projection* GetProjection() const;
 +  const char* GetColourSpace() const { return m_colour_space; }
 +
  private:
   long long m_width;
   long long m_height;
@@ -534,7 +536,7 @@ class VideoTrack : public Track {
   long long m_display_height;
   long long m_display_unit;
   long long m_stereo_mode;
 -
 +  char* m_colour_space;
   double m_rate;
   Colour* m_colour;
 diff --git a/third_party/libwebm/mkvparser/mkvreader.cc b/third_party/libwebm/mkvparser/mkvreader.cc
 index 23d68f508..9d19c1be5 100644
 --- a/third_party/libwebm/mkvparser/mkvreader.cc
 +++ b/third_party/libwebm/mkvparser/mkvreader.cc
@@ -118,6 +118,8 @@ int MkvReader::Read(long long offset, long len, unsigned char* buffer) {
   if (status)
     return -1;  // error
 +#elif defined(_WIN32)
 +  fseeko64(m_file, static_cast<off_t>(offset), SEEK_SET);
 #else
   fseeko(m_file, static_cast<off_t>(offset), SEEK_SET);
 #endif
 -- 
 2.25.1
--- a/SOURCES/0003-Fix-a-bug-in-alloc_size-for-high-bit-depths.patch
+++ b/SOURCES/0003-Fix-a-bug-in-alloc_size-for-high-bit-depths.patch
@ -0,0 +1,46 @@
 From 0a68a93729ab879251ad63f833a327d20dbbbc23 Mon Sep 17 00:00:00 2001
 From: Wan-Teh Chang <wtc@google.com>
 Date: Fri, 12 Apr 2024 15:48:04 -0700
 Subject: [PATCH 3/3] Fix a bug in alloc_size for high bit depths
 I introduced this bug in commit 2e32276:
 https://chromium-review.googlesource.com/c/webm/libvpx/+/5446333
 I changed the line
  stride_in_bytes = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s;
 to three lines:
  s = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s;
  if (s > INT_MAX) goto fail;
  stride_in_bytes = (int)s;
 But I didn't realize that `s` is used later in the calculation of
 alloc_size.
 As a quick fix, undo the effect of s * 2 for high bit depths after `s`
 has been assigned to stride_in_bytes.
 Bug: chromium:332382766
 Change-Id: I53fbf405555645ab1d7254d31aadabe4f426be8c
 (cherry picked from commit 74c70af01667733483dc69298b8921779f5f6ff3)
 ---
 vpx/src/vpx_image.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/vpx/src/vpx_image.c b/vpx/src/vpx_image.c
 index 0c84562ae..38d4c1ce3 100644
 --- a/vpx/src/vpx_image.c
 +++ b/vpx/src/vpx_image.c
@@ -97,6 +97,7 @@ static vpx_image_t *img_alloc_helper(vpx_image_t *img, vpx_img_fmt_t fmt,
   s = (s + stride_align - 1) & ~((uint64_t)stride_align - 1);
   if (s > INT_MAX) goto fail;
   stride_in_bytes = (int)s;
 +  s = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s / 2 : s;
   /* Allocate the new image */
   if (!img) {
 -- 
 2.45.2
--- a/SOURCES/0004-CVE-2019-2126-update-libwebm-to-libwebm-1.0.0.27-361.patch
+++ b/SOURCES/0004-CVE-2019-2126-update-libwebm-to-libwebm-1.0.0.27-361.patch
@ -0,0 +1,71 @@
 From d06fa15d1c113edea0d6760ea19af8e8d0af0d94 Mon Sep 17 00:00:00 2001
 From: James Zern <jzern@google.com>
 Date: Fri, 7 Jun 2019 15:06:29 -0700
 Subject: [PATCH 4/4] CVE-2019-2126: update libwebm to
 libwebm-1.0.0.27-361-g81de00c
 81de00c Check there is only one settings per ContentCompression
 5623013 Fixes a double free in ContentEncoding
 93b2ba0 mkvparser: quiet static analysis warnings
 Change-Id: Ieaa562ef2f10075381bd856388e6b29f97ca2746
 ---
 third_party/libwebm/README.libvpx          | 2 +-
 third_party/libwebm/mkvparser/mkvparser.cc | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)
 diff --git a/third_party/libwebm/README.libvpx b/third_party/libwebm/README.libvpx
 index 16f17513e..714f5d0eb 100644
 --- a/third_party/libwebm/README.libvpx
 +++ b/third_party/libwebm/README.libvpx
@@ -1,5 +1,5 @@
 URL: https://chromium.googlesource.com/webm/libwebm
 -Version: dbf1d1089756e7cb5b1a04d6752310ef35912347
 +Version: 81de00c43ea3c087b48a8c20337db7531b9f7612
 License: BSD
 License File: LICENSE.txt
 diff --git a/third_party/libwebm/mkvparser/mkvparser.cc b/third_party/libwebm/mkvparser/mkvparser.cc
 index dcb969dcf..ace65bd59 100644
 --- a/third_party/libwebm/mkvparser/mkvparser.cc
 +++ b/third_party/libwebm/mkvparser/mkvparser.cc
@@ -4230,6 +4230,7 @@ long ContentEncoding::ParseContentEncodingEntry(long long start, long long size,
         new (std::nothrow) ContentEncryption*[encryption_count];
     if (!encryption_entries_) {
       delete[] compression_entries_;
 +      compression_entries_ = NULL;
       return -1;
     }
     encryption_entries_end_ = encryption_entries_;
@@ -4261,6 +4262,7 @@ long ContentEncoding::ParseContentEncodingEntry(long long start, long long size,
         delete compression;
         return status;
       }
 +      assert(compression_count > 0);
       *compression_entries_end_++ = compression;
     } else if (id == libwebm::kMkvContentEncryption) {
       ContentEncryption* const encryption =
@@ -4273,6 +4275,7 @@ long ContentEncoding::ParseContentEncodingEntry(long long start, long long size,
         delete encryption;
         return status;
       }
 +      assert(encryption_count > 0);
       *encryption_entries_end_++ = encryption;
     }
@@ -4325,6 +4328,12 @@ long ContentEncoding::ParseCompressionEntry(long long start, long long size,
         return status;
       }
 +      // There should be only one settings element per content compression.
 +      if (compression->settings != NULL) {
 +        delete[] buf;
 +        return E_FILE_FORMAT_INVALID;
 +      }
 +
       compression->settings = buf;
       compression->settings_len = buflen;
     }
 -- 
 2.25.1
--- a/SOURCES/include-limits.patch
+++ b/SOURCES/include-limits.patch
@ -0,0 +1,11 @@
 diff -ru libvpx-1.7.0/vpx/src/vpx_image.c libvpx-1.7.0.new/vpx/src/vpx_image.c
 --- libvpx-1.7.0/vpx/src/vpx_image.c	2018-01-24 23:25:44.000000000 +0100
 +++ libvpx-1.7.0.new/vpx/src/vpx_image.c	2024-08-27 15:22:25.886886526 +0200
@@ -10,6 +10,7 @@
 #include <stdlib.h>
 #include <string.h>
 +#include <limits.h>
 #include "vpx/vpx_image.h"
 #include "vpx/vpx_integer.h"
--- a/SOURCES/libvpx-1.7.0-leave-fortify-source-on.patch
+++ b/SOURCES/libvpx-1.7.0-leave-fortify-source-on.patch
--- a/SOURCES/libvpx.ver
+++ b/SOURCES/libvpx.ver
--- a/SOURCES/vpx_config.h
+++ b/SOURCES/vpx_config.h
--- a/SPECS/libvpx.spec
+++ b/SPECS/libvpx.spec
@ -1,27 +1,36 @@
-%global somajor 9
+%global somajor 5
 %global sominor 0
 %global sotiny  0
 %global soversion %{somajor}.%{sominor}.%{sotiny}
 Name:			libvpx
 Summary:		VP8/VP9 Video Codec SDK
-Version:		1.14.1
+Version:		1.7.0
-Release:		2%{?dist}
+Release:		11%{?dist}
-License:		BSD-3-Clause
+License:		BSD
-URL:			http://www.webmproject.org/code/
+Group:			System Environment/Libraries
 #Source0:		http://downloads.webmproject.org/releases/webm/%{name}-%{version}.tar.bz2
 Source0:		https://github.com/webmproject/libvpx/archive/v%{version}.tar.gz
 Source1:		vpx_config.h
 # Thanks to debian.
 Source2:		libvpx.ver
 URL:			http://www.webmproject.org/code/
 %ifarch %{ix86} x86_64
 BuildRequires:		yasm
 %endif
 BuildRequires:		doxygen, perl(Getopt::Long)
 # Do not disable FORTIFY_SOURCE=2
 Patch0:			libvpx-1.7.0-leave-fortify-source-on.patch
-BuildRequires:		gcc
+Patch1:			0001-CVE-2019-9232-Fix-OOB-memory-access-on-fuzzed-data.patch
-BuildRequires:		gcc-c++
+Patch2:			0002-CVE-2019-9433-VP8-Fix-use-after-free-in-postproc.patch
-BuildRequires:		make
+Patch3:			0003-CVE-2019-9371-update-libwebm.patch
-%ifarch %{ix86} x86_64
+Patch4:			0004-CVE-2019-2126-update-libwebm-to-libwebm-1.0.0.27-361.patch
-BuildRequires:		nasm
+Patch5:			0001-Fix-bug-with-smaller-width-bigger-size.patch
-%endif
+Patch6:			0001-VP8-disallow-thread-count-changes.patch
-BuildRequires:		doxygen, php-cli, perl(Getopt::Long)
+Patch7:			0001-Fix-integer-overflows-in-calc-of-stride_in_bytes.patch
 Patch8:			0002-Apply-stride_align-to-byte-count-not-pixel-count.patch
 Patch9:			0003-Fix-a-bug-in-alloc_size-for-high-bit-depths.patch
 Patch10:		include-limits.patch
 %description
 libvpx provides the VP8/VP9 SDK, which allows you to integrate your applications 
@ -30,6 +39,7 @@ deployed on millions of computers and devices worldwide.
 %package devel
 Summary:		Development files for libvpx
 Group:			Development/Libraries
 Requires:		%{name}%{?_isa} = %{version}-%{release}
 %description devel
@ -38,6 +48,7 @@ libvpx.
 %package utils
 Summary:		VP8 utilities and tools
 Group:			Development/Tools
 Requires:		%{name}%{?_isa} = %{version}-%{release}
 %description utils
@ -46,16 +57,28 @@ and decoder.
 %prep
 %setup -q -n libvpx-%{version}
-%patch -P0 -p1 -b .fortify-source-on
+%patch0 -p1 -b .leave-fs-on
 %patch1 -p1 -b .0001
 %patch2 -p1 -b .0002
 %patch3 -p1 -b .0003
 %patch4 -p1 -b .0004
 %patch5 -p1 -b .0005
 %patch6 -p1 -b .0006
 %patch7 -p1 -b .0007
 %patch8 -p1 -b .0008
 %patch9 -p1 -b .0009
 %patch10 -p1 -b .0010
 %build
 %ifarch %{ix86}
 %global vpxtarget x86-linux-gcc
 %else
 %ifarch	x86_64
 %global	vpxtarget x86_64-linux-gcc
 %else
 %ifarch armv7hl
 %global vpxtarget armv7-linux-gcc
 %else
 %ifarch aarch64
 %global vpxtarget arm64-linux-gcc
 %else
@ -63,6 +86,7 @@ and decoder.
 %endif
 %endif
 %endif
 %endif
 # History: The configure script used to reject the shared flag on the generic target.
 # This meant that we needed to fall back to manual shared lib creation.
@ -78,22 +102,45 @@ and decoder.
 %set_build_flags
 %ifarch armv7hl
 CROSS=armv7hl-redhat-linux-gnueabi- CHOST=armv7hl-redhat-linux-gnueabi-hardfloat ./configure \
 %else
 ./configure --target=%{vpxtarget} \
 %endif
 %ifarch %{arm}
 --disable-neon --disable-neon_asm \
 %endif
 --enable-pic --disable-install-srcs \
 --enable-vp9-decoder --enable-vp9-encoder \
--enable-experimental \
+--enable-experimental --enable-spatial-svc \
--enable-vp9-highbitdepth \
+--enable-vp9-highbitdepth --enable-webm-io \
 --enable-debug \
 %if ! %{generic_target}
 --enable-shared \
 %endif
 %ifarch %{ix86} x86_64
 --as=nasm \
 %endif
 --enable-install-srcs \
 --prefix=%{_prefix} --libdir=%{_libdir} --size-limit=16384x16384
-%make_build verbose=true
+# Hack our optflags in.
 sed -i "s|-O3|%{optflags}|g" libs-%{vpxtarget}.mk
 sed -i "s|-O3|%{optflags}|g" examples-%{vpxtarget}.mk
 sed -i "s|-O3|%{optflags}|g" docs-%{vpxtarget}.mk
 %ifarch armv7hl
 #hackety hack hack
 sed -i "s|AR=armv7hl-redhat-linux-gnueabi-ar|AR=ar|g" libs-%{vpxtarget}.mk
 sed -i "s|AR=armv7hl-redhat-linux-gnueabi-ar|AR=ar|g" examples-%{vpxtarget}.mk
 sed -i "s|AR=armv7hl-redhat-linux-gnueabi-ar|AR=ar|g" docs-%{vpxtarget}.mk
 sed -i "s|AS=armv7hl-redhat-linux-gnueabi-as|AS=as|g" libs-%{vpxtarget}.mk
 sed -i "s|AS=armv7hl-redhat-linux-gnueabi-as|AS=as|g" examples-%{vpxtarget}.mk
 sed -i "s|AS=armv7hl-redhat-linux-gnueabi-as|AS=as|g" docs-%{vpxtarget}.mk
 sed -i "s|NM=armv7hl-redhat-linux-gnueabi-nm|NM=nm|g" libs-%{vpxtarget}.mk
 sed -i "s|NM=armv7hl-redhat-linux-gnueabi-nm|NM=nm|g" examples-%{vpxtarget}.mk
 sed -i "s|NM=armv7hl-redhat-linux-gnueabi-nm|NM=nm|g" docs-%{vpxtarget}.mk
 %endif
 make %{?_smp_mflags} verbose=true
 # Manual shared library creation
 # We should never need to do this anymore, and if we do, we need to fix the version-script.
@ -113,19 +160,23 @@ rm -rf tmp
 # We need to do this so the examples can link against it.
 # ln -sf libvpx.so.%{soversion} libvpx.so
-# %make_build verbose=true target=examples CONFIG_SHARED=1
+# make %{?_smp_mflags} verbose=true target=examples CONFIG_SHARED=1
-# %make_build verbose=true target=docs
+# make %{?_smp_mflags} verbose=true target=docs
 # Put them back so the install doesn't fail
 # mv libNOTvpx.a libvpx.a
 # mv libNOTvpx_g.a libvpx_g.a
 %install
 %ifarch armv7hl
 export CROSS=armv7hl-redhat-linux-gnueabi-
 export CHOST=armv7hl-redhat-linux-gnueabi-hardfloat
 %endif
 make DIST_DIR=%{buildroot}%{_prefix} dist
 # Simpler to label the dir as %%doc.
-if [ -d %{buildroot}%{_prefix}/docs ]; then
+if [ -d %{buildroot}/usr/docs ]; then
-   mv %{buildroot}%{_prefix}/docs doc/
+   mv %{buildroot}/usr/docs doc/
 fi
 # Again, we should never need to do this anymore.
@ -140,21 +191,24 @@ popd
 pushd %{buildroot}
 # Stuff we don't need.
-rm -rf .%{_prefix}/build/ .%{_prefix}/md5sums.txt .%{_libdir}*/*.a .%{_prefix}/CHANGELOG .%{_prefix}/README
+rm -rf usr/build/ usr/md5sums.txt usr/lib*/*.a usr/CHANGELOG usr/README
 # No, bad google. No treat.
-mv .%{_bindir}/examples/* .%{_bindir}
+mv usr/bin/examples/* usr/bin/
-rm -rf .%{_bindir}/examples
+rm -rf usr/bin/examples
 # Rename a few examples
-mv .%{_bindir}/postproc .%{_bindir}/vp8_postproc
+mv usr/bin/postproc usr/bin/vp8_postproc
-mv .%{_bindir}/simple_decoder .%{_bindir}/vp8_simple_decoder
+mv usr/bin/simple_decoder usr/bin/vp8_simple_decoder
-mv .%{_bindir}/simple_encoder .%{_bindir}/vp8_simple_encoder
+mv usr/bin/simple_encoder usr/bin/vp8_simple_encoder
-mv .%{_bindir}/twopass_encoder .%{_bindir}/vp8_twopass_encoder
+mv usr/bin/twopass_encoder usr/bin/vp8_twopass_encoder
 # Fix the binary permissions
-chmod 755 .%{_bindir}/*
+chmod 755 usr/bin/*
 popd
 # Get the vpx_config.h file
 %ifarch %{arm}
 cp -a vpx_config.h %{buildroot}%{_includedir}/vpx/vpx_config-arm.h
 %else
 # Does ppc64le need its own?
 %ifarch ppc64 ppc64le
 cp -a vpx_config.h %{buildroot}%{_includedir}/vpx/vpx_config-ppc64.h
@ -169,6 +223,7 @@ cp -a vpx_config.h %{buildroot}%{_includedir}/vpx/vpx_config-%{_arch}.h
 %endif
 %endif
 %endif
 %endif
 cp %{SOURCE1} %{buildroot}%{_includedir}/vpx/vpx_config.h
 # for timestamp sync
 touch -r AUTHORS %{buildroot}%{_includedir}/vpx/vpx_config.h
@ -185,7 +240,7 @@ rm -rf %{buildroot}%{_prefix}/src
 %files
 %license LICENSE
 %doc AUTHORS CHANGELOG README
-%{_libdir}/libvpx.so.%{somajor}*
+%{_libdir}/libvpx.so.*
 %files devel
 # These are SDK docs, not really useful to an end-user.
@ -202,134 +257,31 @@ rm -rf %{buildroot}%{_prefix}/src
 %{_bindir}/*
 %changelog
-* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.14.1-2
+* Fri Jul 5 2024 Wim Taymans <wtaymans@redhat.com> - 1.7.0-11
- Bump release for October 2024 mass rebuild:
+- Add patch to fix integer overflows.
-  Resolves: RHEL-64018
+- Fix compilation by including limits.h
 - Resolves: RHEL-40650
-* Fri Jul 05 2024 Wim Taymans <wtaymans@redhat.com> - 1.14.1-1
+* Thu Oct 5 2023 Wim Taymans <wtaymans@redhat.com> - 1.7.0-10
- Upgrade to 1.14.1
+- Add patch for CVE-2023-5217
-  Resolves: RHEL-40644
+- Resolves: RHEL-10612
-* Fri Jul 05 2024 Tulio Magno Quites Machado Filho <tuliom@redhat.com> - 1.14.0-3
+* Tue Oct 3 2023 Wim Taymans <wtaymans@redhat.com> - 1.7.0-9
- Replace yasm with nasm
+- Add patch for CVE-2023-44488
-  Resolves: RHEL-45221
+- Resolves: RHEL-11615
-* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 1.14.0-2
+* Wed Apr 1 2020 Wim Taymans <wtaymans@redhat.com> - 1.7.0-8
- Bump release for June 2024 mass rebuild
+- Resolves: rhbz#1796086, rhbz#1796100, rhbz#1796448, rhbz#1796454
 - Enable webm-io explicitly
-* Tue Feb 06 2024 Pete Walter <pwalter@fedoraproject.org> - 1.14.0-1
+* Wed Mar 25 2020 Wim Taymans <wtaymans@redhat.com> - 1.7.0-7
- Update to 1.14.0
+- Fix for CVE-2019-9232, CVE-2019-9433, CVE-2019-9371, CVE-2019-2126
 - Resolves: rhbz#1796086, rhbz#1796100, rhbz#1796448, rhbz#1796454
 - Remove php-cli BR
-* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.13.1-3
+* Tue Oct 09 2018 Wim Taymans <wtaymans@redhat.com> - 1.7.0-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+- Set build flags in all cases
-
+- Resolves: #1630588
 * Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.13.1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 * Sun Oct  1 2023 Tom Callaway <spot@fedoraproject.org> - 1.13.1-1
 - update to 1.13.1
 * Fri Sep 29 2023 Neal Gompa <ngompa@fedoraproject.org> - 1.13.0-5
 - Minor spec cleanups
 * Thu Sep 28 2023 Boudhayan Bhattacharya <bbhtt.zn0i8@slmail.me> - 1.13.0-4
 - Patch for CVE-2023-5217
 * Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.13.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
 * Wed Feb 15 2023 Pete Walter <pwalter@fedoraproject.org> - 1.13.0-2
 - Fix whitespace in spec file
 - Drop 32 bit arm support
 * Wed Feb 15 2023 Tom Callaway <spot@fedoraproject.org> - 1.13.0-1
 - update to 1.13.0
 * Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.12.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 * Tue Dec  6 2022 Florian Weimer <fweimer@redhat.com> - 1.12.0-2
 - Backport upstream commit to improve C99 compatibility
 * Wed Aug 17 2022 Pete Walter <pwalter@fedoraproject.org> - 1.12.0-1
 - Update to 1.12.0
 * Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 * Thu Jan 27 2022 Tom Callaway <spot@fedoraproject.org> - 1.11.0-1
 - update to 1.11.0
 * Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 * Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
 * Mon Mar 29 2021 Tom Callaway <spot@fedoraproject.org> - 1.10.0-1
 - update to 1.10.0
 * Mon Mar  8 2021 Tom Callaway <spot@fedoraproject.org> - 1.10.0-0.1.rc1
 - update to 1.10.0-rc1
 * Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 * Sat Oct 10 2020 Jeff Law <law@redhat.com> - 1.9.0-2
 - Re-enable LTO
 * Thu Aug 13 2020 Tom Callaway <spot@fedoraproject.org> - 1.9.0-1
 - update to 1.9.0
 * Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.2-6
 - Second attempt - Rebuilt for
  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 * Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.2-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 * Mon Jul 13 2020 Tom Stellard <tstellar@redhat.com> - 1.8.2-4
 - Use make macros
 - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
 * Wed Jul 01 2020 Jeff Law <law@redhat.com> - 1.8.2-3
 - Disable LTO
 * Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.2-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 * Fri Dec 20 2019 Tom Callaway <spot@fedoraproject.org> - 1.8.2-1
 - update to 1.8.2
 * Wed Jul 31 2019 Tom Callaway <spot@fedoraproject.org> - 1.8.1-1
 - update to 1.8.1
 * Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.0-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 * Tue Feb 05 2019 Pete Walter <pwalter@fedoraproject.org> - 1.8.0-4
 - Avoid setting optflags twice
 * Tue Feb 05 2019 Pete Walter <pwalter@fedoraproject.org> - 1.8.0-3
 - Tighten soname glob to avoid accidental soname bumps
 * Tue Feb 05 2019 Björn Esser <besser82@fedoraproject.org> - 1.8.0-2
 - rebuilt (libvpx)
 * Tue Feb 05 2019 Pete Walter <pwalter@fedoraproject.org> - 1.8.0-1
 - Update to 1.8.0
 * Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.0-9
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 * Tue Sep 18 2018 Owen Taylor <otaylor@redhat.com> - 1.7.0-8
 - Avoid hardcoding prefix=/usr
 * Fri Jul 20 2018 Wim Taymans <wtaymans@redhat.com> - 1.7.0-7
 - Add compilers as buildrequires
 * Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.0-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 * Mon Feb 12 2018 Tom Callaway <spot@fedoraproject.org> - 1.7.0-5
 - properly set build flags in rawhide (bz1543819)
@ -510,4 +462,3 @@ rm -rf %{buildroot}%{_prefix}/src
 * Wed May 19 2010 Tom "spot" Callaway <tcallawa@redhat.com> 0.9.0-1
 - Initial package for Fedora
--- a/gating.yaml
+++ b/gating.yaml
@ -1,6 +0,0 @@
 --- !Policy
 product_versions:
  - rhel-10
 decision_context: osci_compose_gate
 rules:
  - !PassingTestCaseRule {test_case_name: desktop-qe.desktop-ci.tier1-gating.functional}
--- a/libvpx-configure-c99.patch
+++ b/libvpx-configure-c99.patch
@ -1,17 +0,0 @@
 Add missing types to the inline keyword check, otherwise the check
 might fail incorrectly with strict C99 compilers which do not support
 implicit int.
 diff --git a/build/make/configure.sh b/build/make/configure.sh
 index 79e6f59c2df38d38..4f8dc59b7ee0290b 100644
 --- a/build/make/configure.sh
 +++ b/build/make/configure.sh
@@ -1511,7 +1511,7 @@ EOF
     # Try to find which inline keywords are supported
     check_cc <<EOF && INLINE="inline"
 -static inline function() {}
 +static inline void function(void) {}
 EOF
   # Almost every platform uses pthreads.
--- a/libvpx-v1.0.0-pcfix.patch
+++ b/libvpx-v1.0.0-pcfix.patch
@ -1,21 +0,0 @@
 diff -up libvpx-v1.0.0/libs.mk.pcfix libvpx-v1.0.0/libs.mk
 --- libvpx-v1.0.0/libs.mk.pcfix	2012-01-27 13:36:39.000000000 -0500
 +++ libvpx-v1.0.0/libs.mk	2012-05-29 10:48:27.348425023 -0400
@@ -232,7 +232,7 @@ vpx.pc: config.mk libs.mk
 	$(qexec)echo '# pkg-config file from libvpx $(VERSION_STRING)' > $@
 	$(qexec)echo 'prefix=$(PREFIX)' >> $@
 	$(qexec)echo 'exec_prefix=$${prefix}' >> $@
 -	$(qexec)echo 'libdir=$${prefix}/lib' >> $@
 +	$(qexec)echo 'libdir=$${prefix}/$(LIBSUBDIR)' >> $@
 	$(qexec)echo 'includedir=$${prefix}/include' >> $@
 	$(qexec)echo '' >> $@
 	$(qexec)echo 'Name: vpx' >> $@
@@ -240,7 +240,7 @@ vpx.pc: config.mk libs.mk
 	$(qexec)echo 'Version: $(VERSION_MAJOR).$(VERSION_MINOR).$(VERSION_PATCH)' >> $@
 	$(qexec)echo 'Requires:' >> $@
 	$(qexec)echo 'Conflicts:' >> $@
 -	$(qexec)echo 'Libs: -L$${libdir} -lvpx' >> $@
 +	$(qexec)echo 'Libs: -L$${libdir} -lvpx -lm' >> $@
 	$(qexec)echo 'Cflags: -I$${includedir}' >> $@
 INSTALL-LIBS-yes += $(LIBSUBDIR)/pkgconfig/vpx.pc
 INSTALL_MAPS += $(LIBSUBDIR)/pkgconfig/%.pc %.pc
--- a/libvpx-v1.1.0-pcfix.patch
+++ b/libvpx-v1.1.0-pcfix.patch
@ -1,12 +0,0 @@
 diff -up libvpx-v1.1.0/libs.mk.pcfix libvpx-v1.1.0/libs.mk
 --- libvpx-v1.1.0/libs.mk.pcfix	2012-05-29 17:07:15.786028887 -0400
 +++ libvpx-v1.1.0/libs.mk	2012-05-29 17:07:19.362006037 -0400
@@ -241,7 +241,7 @@ vpx.pc: config.mk libs.mk
 	$(qexec)echo 'Version: $(VERSION_MAJOR).$(VERSION_MINOR).$(VERSION_PATCH)' >> $@
 	$(qexec)echo 'Requires:' >> $@
 	$(qexec)echo 'Conflicts:' >> $@
 -	$(qexec)echo 'Libs: -L$${libdir} -lvpx' >> $@
 +	$(qexec)echo 'Libs: -L$${libdir} -lvpx -lm' >> $@
 	$(qexec)echo 'Cflags: -I$${includedir}' >> $@
 INSTALL-LIBS-yes += $(LIBSUBDIR)/pkgconfig/vpx.pc
 INSTALL_MAPS += $(LIBSUBDIR)/pkgconfig/%.pc %.pc
--- a/libvpx.pc
+++ b/libvpx.pc
@ -1,14 +0,0 @@
 prefix=@PREFIX@
 exec_prefix=@PREFIX@
 libdir=@LIBDIR@
 includedir=@INCLUDEDIR@
 Name: libvpx
 Description: VP8 Video Codec SDK library
 Version: 1.0.0
 URL: http://www.webmproject.org/tools/vp8-sdk/
 Requires:
 Conflicts:
 Libs: -L${libdir} -lvpx
 Libs.private:  
 Cflags: -I${includedir}/vpx/
--- a/1
+++ b/1
@ -1 +0,0 @@
 SHA512 (v1.14.1.tar.gz) = 3e3bfad3d035c0bc3db7cb5a194d56d3c90f5963fb1ad527ae5252054e7c48ce2973de1346c97d94b59f7a95d4801bec44214cce10faf123f92b36fca79a8d1e
		`@ -0,0 +1 @@`
							`fb3d4b80596d1e3b1a7f53757d63e7d2b3eeb7c9 SOURCES/v1.7.0.tar.gz`
		`@ -1 +0,0 @@`
			`SHA512 (v1.14.1.tar.gz) = 3e3bfad3d035c0bc3db7cb5a194d56d3c90f5963fb1ad527ae5252054e7c48ce2973de1346c97d94b59f7a95d4801bec44214cce10faf123f92b36fca79a8d1e`