rpms/gstreamer1-plugins-bad-free
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-52719: out-of-bounds read in VA JPEG decoder

Browse Source 
Backport upstream commit c97cce5f from the GStreamer monorepo
to fix CVE-2026-52719. The patch adds input validation to the
VA JPEG decoder (gstjpegdecoder.c) by introducing a
jpeg_segment_fits_input() helper function that verifies parsed
JPEG segments don't exceed the available input data, preventing
potential out-of-bounds reads.

CVE: CVE-2026-52719
Upstream patches:
 - c97cce5f18.patch
Resolves: RHEL-184404

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-29 10:03:59 +00:00
parent 2e7483a03c
commit ca613476ca
2 changed files with 71 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
gstreamer1-plugins-bad-free-1.22.12-CVE-2026-52719.patch Normal file
View File

@ -0,0 +1,64 @@
From c2fa8c17a876830025923696b754c4118e1b2ac9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 9 Jun 2026 09:40:41 +0300
Subject: [PATCH] vajpegdecoder: Validate that enough data is available for the
current JPEG segment
gst_jpeg_parse() does not ensure this and relies on the caller to collect enough
data. All other users of the function are doing this correctly.
Here we can directly error out if not enough data is available as we require
parsing input.
Patch provided by Junyi Liu, who also reported this.
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5104
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11805>
---
subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c b/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c
index 2448c3c..3fccf03 100644
--- a/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c
+++ b/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c
@@ -370,6 +370,18 @@ _get_marker_name (guint marker)
}
#endif
+static gboolean
+jpeg_segment_fits_input (const GstJpegSegment * seg, gsize size)
+{
+ if (seg->size < 0)
+ return FALSE;
+
+ if ((gsize) seg->offset > size)
+ return FALSE;
+
+ return (gsize) seg->size <= size - (gsize) seg->offset;
+}
+
static GstFlowReturn
gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
GstVideoCodecFrame * frame)
@@ -399,6 +411,9 @@ gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
if (!gst_jpeg_parse (&seg, map.data, map.size, offset))
goto unmap_and_error;
+ if (!jpeg_segment_fits_input (&seg, map.size))
+ goto unmap_and_error;
+
offset = seg.offset + seg.size;
marker = seg.marker;
@@ -445,6 +460,9 @@ gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
if (!gst_jpeg_parse (&seg_scan, map.data, map.size, offset))
goto unmap_and_error;
+ if (!jpeg_segment_fits_input (&seg_scan, map.size))
+ goto unmap_and_error;
+
if (seg_scan.marker < GST_JPEG_MARKER_RST_MIN
|| seg_scan.marker > GST_JPEG_MARKER_RST_MAX)
break;

8
gstreamer1-plugins-bad-free.spec
View File

@ -12,7 +12,7 @@
Name: gstreamer1-plugins-bad-free
Version: 1.22.12
Release: 11%{?dist}
Release: 12%{?dist}
Summary: GStreamer streaming media framework "bad" plugins
License: LGPLv2+ and LGPLv2
@ -48,6 +48,9 @@ Patch: gstreamer1-plugins-bad-free-1.22.12-CVE-2026-59692.patch
# https://issues.redhat.com/browse/RHEL-184423
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/6c146775d784bbe91ff7afc6701ba351306282ce
Patch: gstreamer1-plugins-bad-free-1.22.12-CVE-2026-52722.patch
# https://issues.redhat.com/browse/RHEL-184404
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c97cce5f187fa40d389256ce6c6da68f159bb8bd
Patch: gstreamer1-plugins-bad-free-1.22.12-CVE-2026-52719.patch
BuildRequires: meson >= 0.48.0
BuildRequires: gcc-c++
@ -792,6 +795,9 @@ rm $RPM_BUILD_ROOT%{_bindir}/playout
%changelog
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-12
- Fix CVE-2026-52719: out-of-bounds read in VA JPEG decoder
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-11
- Fix integer overflows in vmnc decoder (CVE-2026-52722)