1 files changed, 51 insertions, 0 deletions
diff --git a/patches/source/libvpx/0003-VP8-disallow-thread-count-changes.patch b/patches/source/libvpx/0003-VP8-disallow-thread-count-changes.patch
new file mode 100644
index 000000000..f93b3d258
--- /dev/null
+++ b/patches/source/libvpx/0003-VP8-disallow-thread-count-changes.patch
@@ -0,0 +1,51 @@
+From: James Zern <jzern@google.com>
+Date: Mon, 25 Sep 2023 18:55:59 -0700
+Subject: VP8: disallow thread count changes
+Origin: https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
+Bug-Debian: https://bugs.debian.org/1053182
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2023-5217
+
+Currently allocations are done at encoder creation time. Going from
+threaded to non-threaded would cause a crash.
+
+Bug: chromium:1486441
+Change-Id: Ie301c2a70847dff2f0daae408fbef1e4d42e73d4
+---
+ test/encode_api_test.cc | 4 ----
+ vp8/encoder/onyx_if.c   | 5 +++++
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/test/encode_api_test.cc b/test/encode_api_test.cc
+index a8a4df2ddf88..f1c98b2c71c9 100644
+--- a/test/encode_api_test.cc
++++ b/test/encode_api_test.cc
+@@ -370,10 +370,6 @@ TEST(EncodeAPI, ConfigResizeChangeThreadCount) {
+ 
+   for (const auto *iface : kCodecIfaces) {
+     SCOPED_TRACE(vpx_codec_iface_name(iface));
+-    if (!IsVP9(iface)) {
+-      GTEST_SKIP() << "TODO(https://crbug.com/1486441) remove this condition "
+-                      "after VP8 is fixed.";
+-    }
+     for (int i = 0; i < (IsVP9(iface) ? 2 : 1); ++i) {
+       vpx_codec_enc_cfg_t cfg = {};
+       struct Encoder {
+diff --git a/vp8/encoder/onyx_if.c b/vp8/encoder/onyx_if.c
+index c65afc643bf6..c5e9970c3cc8 100644
+--- a/vp8/encoder/onyx_if.c
++++ b/vp8/encoder/onyx_if.c
+@@ -1447,6 +1447,11 @@ void vp8_change_config(VP8_COMP *cpi, VP8_CONFIG *oxcf) {
+   last_h = cpi->oxcf.Height;
+   prev_number_of_layers = cpi->oxcf.number_of_layers;
+ 
++  if (cpi->initial_width) {
++    // TODO(https://crbug.com/1486441): Allow changing thread counts; the
++    // allocation is done once in vp8_create_compressor().
++    oxcf->multi_threaded = cpi->oxcf.multi_threaded;
++  }
+   cpi->oxcf = *oxcf;
+ 
+   switch (cpi->oxcf.Mode) {
+-- 
+2.40.1
+