rpms/gstreamer1-plugins-base
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-18297: opusdec channel position overflow

Browse Source 
Backport upstream fix (GStreamer MR !12044) for
CVE-2026-18297 to gstreamer1-plugins-base-1.16.1.

The patch adds a guard in gst_opus_dec_negotiate() to avoid
using channel positions when there are more than 64 channels,
which is unsupported. The patch paths were adjusted from the
upstream monorepo layout to the standalone 1.16.1 source tree.

CVE: CVE-2026-18297
Upstream patches:
 - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12044.patch
Resolves: RHEL-246576

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-25 07:13:42 +00:00
parent 1b37d2ac58
commit e3fa46713d
2 changed files with 36 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
gstreamer1-plugins-base-1.16.1-CVE-2026-18297.patch Normal file
View File

@ -0,0 +1,27 @@
From 91d14fc6bff0da9d7931e4d048ca0119c05943bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Fri, 19 Jun 2026 13:48:16 +0300
Subject: [PATCH] opusdec: Don't use any channel positions for >64 channels
We don't support this.
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5122
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12044>
---
ext/opus/gstopusdec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/ext/opus/gstopusdec.c b/ext/opus/gstopusdec.c
index 16b2a29..37980a4 100644
--- a/ext/opus/gstopusdec.c
+++ b/ext/opus/gstopusdec.c
@@ -290,6 +290,8 @@ gst_opus_dec_negotiate (GstOpusDec * dec, const GstAudioChannelPosition * pos)
GST_DEBUG_OBJECT (dec, "Using a default of 2 channels");
dec->n_channels = 2;
pos = NULL;
+ } else if (dec->n_channels > 64) {
+ pos = NULL;
}
if (dec->sample_rate == 0) {

10
gstreamer1-plugins-base.spec
View File

@ -6,7 +6,7 @@
Name: gstreamer1-plugins-base
Version: 1.16.1
Release: 6%{?gitcommit:.git%{shortcommit}}%{?dist}
Release: 6%{?gitcommit:.git%{shortcommit}}%{?dist}.1
Summary: GStreamer streaming media framework base plugins
License: LGPLv2+
@ -27,6 +27,9 @@ Patch5: 0006-opusdec-Set-at-most-64-channels-to-NONE-position.patch
Patch6: 0007-vorbis_parse-check-writes-to-GstOggStream.vorbis_mod.patch
Patch7: 0008-vorbisdec-Set-at-most-64-channels-to-NONE-position.patch
Patch8: 0001-riff-Correctly-check-that-enough-RGB-palette-data-is.patch
# https://issues.redhat.com/browse/RHEL-246576
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12044
Patch9: gstreamer1-plugins-base-1.16.1-CVE-2026-18297.patch
BuildRequires: gcc-c++
BuildRequires: gstreamer1-devel >= %{version}
@ -130,6 +133,7 @@ for the GStreamer Base Plugins library.
%patch6 -p1
%patch7 -p1
%patch8 -p1
%patch9 -p1
%build
# die rpath (method of modifying libtool fails here)
@ -497,6 +501,10 @@ chrpath --delete $RPM_BUILD_ROOT%{_bindir}/gst-play-1.0
%changelog
* Tue Aug 25 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-6.1
- Add patch for CVE-2026-18297
Resolves: RHEL-246576
* Tue Mar 31 2026 Wim Taymans <wtaymans@redhat.com> - 1.16.1-6
- Add patch for CVE-2026-2921
Resolves: RHEL-156169