rpms/gstreamer1-plugins-bad-free
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix bytes/bits confusion in AV1 parser when parsing tile data size

Browse Source 
Backport upstream commit fe5f81163e4f from the GStreamer 1.26
stable branch to fix a bytes/bits confusion in the AV1 parser.
The tile_data_size_minus_1 value (in bytes) was being passed
directly to gst_bit_reader_skip() which expects bits, causing
an assertion failure. The fix multiplies the value by 8 to
convert bytes to bits.

CVE: CVE-2026-52718
Upstream patches:
 - fe5f81163e.patch
Resolves: RHEL-184392

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-29 10:15:49 +00:00
parent 088d40f88e
commit 2d9c493ac1
2 changed files with 48 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
0005-av1parser-Fix-bytes-bits-confusion-when-parsing-tile.patch Normal file
View File

@ -0,0 +1,41 @@
From 83b1767d40098f955e166e29b27b7047354e5661 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 9 Jun 2026 09:26:38 +0300
Subject: [PATCH] av1parser: Fix bytes/bits confusion when parsing tile data
size
Which would then later lead to an assertion.
Patch provided by Junyi Liu, who also reported this.
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5103
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11829>
---
.../gst-libs/gst/codecparsers/gstav1parser.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c b/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c
index e2caf91c2d..cf2d860760 100644
--- a/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c
+++ b/subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gstav1parser.c
@@ -4339,6 +4339,8 @@ gst_av1_parser_parse_tile_list_obu (GstAV1Parser * parser,
}
for (tile = 0; tile <= tile_list->tile_count_minus_1; tile++) {
+ guint32 tile_data_size;
+
if (AV1_REMAINING_BITS (br) < 8 + 8 + 8 + 16) {
retval = GST_AV1_PARSER_NO_MORE_DATA;
goto error;
@@ -4353,8 +4355,8 @@ gst_av1_parser_parse_tile_list_obu (GstAV1Parser * parser,
tile_list->entry[tile].coded_tile_data =
obu->data + gst_bit_reader_get_pos (br) / 8;
/* skip the coded_tile_data */
- if (!gst_bit_reader_skip (br,
- tile_list->entry[tile].tile_data_size_minus_1 + 1)) {
+ tile_data_size = tile_list->entry[tile].tile_data_size_minus_1 + 1;
+ if (!gst_bit_reader_skip (br, tile_data_size * 8)) {
retval = GST_AV1_PARSER_NO_MORE_DATA;
goto error;
}

8
gstreamer1-plugins-bad-free.spec
View File

@ -26,7 +26,7 @@
Name: gstreamer1-plugins-bad-free
Version: 1.26.7
Release: 7%{?dist}
Release: 8%{?dist}
Summary: GStreamer streaming media framework "bad" plugins
License: LGPLv2+ and LGPLv2
@ -58,6 +58,8 @@ Patch: 0005-dtlsconnection-Allocate-large-enough-buffer-for-the-.patch
Patch: gstreamer1-plugins-bad-free-1.26.7-CVE-2026-52722.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c97cce5f187fa40d389256ce6c6da68f159bb8bd
Patch: gstreamer1-plugins-bad-free-1.26.7-CVE-2026-52719.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11829
Patch: 0005-av1parser-Fix-bytes-bits-confusion-when-parsing-tile.patch
BuildRequires: meson >= 0.48.0
BuildRequires: gcc-c++
@ -885,6 +887,10 @@ EOF
%changelog
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-8
- Fix bytes/bits confusion in AV1 parser when parsing tile data size
Resolves: RHEL-184392
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-7
- Fix CVE-2026-52719: out-of-bounds read in VA JPEG decoder
Resolves: RHEL-184407