SOURCES/0001-missing-plugins-Remove-the-mpegaudioversion-field.patch

@@ -1,7 +1,7 @@
-From 06ca82cad9898f5df40011fe0614ee1dfd89f1ae Mon Sep 17 00:00:00 2001
+From d4f28912bad1748afffec840b9330dcd054f5981 Mon Sep 17 00:00:00 2001
 From: Bastien Nocera <hadess@hadess.net>
 Date: Fri, 3 Aug 2012 17:50:24 +0100
-Subject: [PATCH 1/2] missing-plugins: Remove the mpegaudioversion field
+Subject: [PATCH 1/8] missing-plugins: Remove the mpegaudioversion field
 
 From missing plugins requests as it's a duplicate of mpegversion
 and its presence would break codec discovery when using RPM.
@@ -26,5 +26,5 @@ index a08803b18..cdce4bf05 100644
    return ret;
  }
 -- 
-2.14.3
+2.47.0
 

SOURCES/0002-video-disable-ORC_RESTRICT.patch

@@ -1,7 +1,7 @@
-From 303c62f25d9d8361f62c1eb00655efb6c4e89f21 Mon Sep 17 00:00:00 2001
+From 1bc56aad2c40ab30c57c15536f9d09bb12f11087 Mon Sep 17 00:00:00 2001
 From: Wim Taymans <wtaymans@redhat.com>
 Date: Thu, 22 Feb 2018 11:37:07 +0100
-Subject: [PATCH 2/2] video: disable ORC_RESTRICT
+Subject: [PATCH 2/8] video: disable ORC_RESTRICT
 
 We pass the same pointers to the video_chroma_up,
 video_chroma_down fnd video_convert unctions, which causes the
@@ -12,7 +12,7 @@ compiler to complain.
  2 files changed, 4 insertions(+)
 
 diff --git a/gst-libs/gst/video/video-chroma.c b/gst-libs/gst/video/video-chroma.c
-index b994658a9..0cba36838 100644
+index f761b4435..7ed22ea1e 100644
 --- a/gst-libs/gst/video/video-chroma.c
 +++ b/gst-libs/gst/video/video-chroma.c
 @@ -24,6 +24,8 @@
@@ -25,7 +25,7 @@ index b994658a9..0cba36838 100644
  #include "video-format.h"
  
 diff --git a/gst-libs/gst/video/video-converter.c b/gst-libs/gst/video/video-converter.c
-index 31e866a79..03c23a56f 100644
+index 22f81a465..147252415 100644
 --- a/gst-libs/gst/video/video-converter.c
 +++ b/gst-libs/gst/video/video-converter.c
 @@ -29,6 +29,8 @@
@@ -38,5 +38,5 @@ index 31e866a79..03c23a56f 100644
  
  #include <glib.h>
 -- 
-2.14.3
+2.47.0
 

SOURCES/0003-subparse-Look-for-the-closing-of-a-tag-after-the-ope.patch

@@ -1,7 +1,7 @@
 From 5e8fa4cb835a938aba72f2b7ccd3e784e5886df8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
 Date: Tue, 13 Jun 2023 12:53:13 +0300
-Subject: [PATCH 1/2] subparse: Look for the closing `>` of a tag after the
+Subject: [PATCH 3/8] subparse: Look for the closing `>` of a tag after the
  opening `<`
 
 Previously when fixing up subrip markip, we were looking from the start
@@ -32,5 +32,5 @@ index 425415874..e8d3ecaef 100644
          const gchar *last = NULL;
          if (num_open_tags > 0)
 -- 
-2.43.0
+2.47.0
 

SOURCES/0004-subparse-Skip-after-the-end-of-a-valid-closing-tag-i.patch

@@ -1,7 +1,7 @@
 From 889e0b00c2b3b4ecb8ab8116d6192ee7f3b37909 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
 Date: Tue, 13 Jun 2023 12:58:26 +0300
-Subject: [PATCH 2/2] subparse: Skip after the end of a valid closing tag
+Subject: [PATCH 4/8] subparse: Skip after the end of a valid closing tag
  instead of only skipping `<`
 
 This is a small optimization and avoids restarting the next parsing
@@ -29,5 +29,5 @@ index e8d3ecaef..9336419e1 100644
        }
      }
 -- 
-2.43.0
+2.47.0
 

SOURCES/0005-exiftag-Prevent-integer-overflows-and-out-of-bounds-.patch

@@ -0,0 +1,69 @@
+From 58deb2c68fda0cf46a03643aefa28efdc0753efa Mon Sep 17 00:00:00 2001
+From: Wim Taymans <wtaymans@redhat.com>
+Date: Fri, 8 Nov 2024 10:45:07 +0100
+Subject: [PATCH 5/8] exiftag: Prevent integer overflows and out of bounds
+ reads when handling undefined tags
+
+Fixes ZDI-CAN-23896
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3483
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/6768>
+---
+ gst-libs/gst/tag/gstexiftag.c | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/gst-libs/gst/tag/gstexiftag.c b/gst-libs/gst/tag/gstexiftag.c
+index b615779be..558996b42 100644
+--- a/gst-libs/gst/tag/gstexiftag.c
++++ b/gst-libs/gst/tag/gstexiftag.c
+@@ -1372,6 +1372,8 @@ parse_exif_long_tag (GstExifReader * reader, const GstExifTagMatch * tag,
+   }
+ }
+ 
++static inline gboolean size_checked_add(gsize *dest, gsize a, gsize b) {
++  *dest = a + b; return *dest >= a; }
+ 
+ static void
+ parse_exif_undefined_tag (GstExifReader * reader, const GstExifTagMatch * tag,
+@@ -1383,6 +1385,7 @@ parse_exif_undefined_tag (GstExifReader * reader, const GstExifTagMatch * tag,
+ 
+   if (count > 4) {
+     GstMapInfo info;
++    gsize alloc_size;
+ 
+     if (offset < reader->base_offset) {
+       GST_WARNING ("Offset is smaller (%u) than base offset (%u)", offset,
+@@ -1404,14 +1407,28 @@ parse_exif_undefined_tag (GstExifReader * reader, const GstExifTagMatch * tag,
+       return;
+     }
+ 
++    if (info.size - real_offset < count) {
++      GST_WARNING ("Invalid size %u for buffer of size %" G_GSIZE_FORMAT
++          ", not adding tag %s", count, info.size, tag->gst_tag);
++      gst_buffer_unmap (reader->buffer, &info);
++      return;
++    }
++
++    if (!size_checked_add (&alloc_size, count, 1)) {
++      GST_WARNING ("Invalid size %u for buffer of size %" G_GSIZE_FORMAT
++          ", not adding tag %s", real_offset, info.size, tag->gst_tag);
++      gst_buffer_unmap (reader->buffer, &info);
++      return;
++    }
++
+     /* +1 because it could be a string without the \0 */
+-    data = malloc (sizeof (guint8) * count + 1);
++    data = malloc (alloc_size);
+     memcpy (data, info.data + real_offset, count);
+     data[count] = 0;
+ 
+     gst_buffer_unmap (reader->buffer, &info);
+   } else {
+-    data = malloc (sizeof (guint8) * count + 1);
++    data = malloc (count + 1);
+     memcpy (data, (guint8 *) offset_as_data, count);
+     data[count] = 0;
+   }
+-- 
+2.47.0
+

SOURCES/0006-opusdec-Set-at-most-64-channels-to-NONE-position.patch

@@ -0,0 +1,37 @@
+From 0cd2cd6ffe7e5c2dc11cebf56aef39b23103c9aa Mon Sep 17 00:00:00 2001
+From: Wim Taymans <wtaymans@redhat.com>
+Date: Mon, 16 Dec 2024 11:24:39 +0100
+Subject: [PATCH 6/8] opusdec: Set at most 64 channels to NONE position
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-116
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3871
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8096>
+---
+ ext/opus/gstopusdec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ext/opus/gstopusdec.c b/ext/opus/gstopusdec.c
+index 7ff9bee2e..16b2a2932 100644
+--- a/ext/opus/gstopusdec.c
++++ b/ext/opus/gstopusdec.c
+@@ -369,12 +369,12 @@ gst_opus_dec_parse_header (GstOpusDec * dec, GstBuffer * buf)
+         posn = gst_opus_channel_positions[dec->n_channels - 1];
+         break;
+       default:{
+-        gint i;
++        guint i, max_pos = MIN (dec->n_channels, 64);
+ 
+         GST_ELEMENT_WARNING (GST_ELEMENT (dec), STREAM, DECODE,
+             (NULL), ("Using NONE channel layout for more than 8 channels"));
+ 
+-        for (i = 0; i < dec->n_channels; i++)
++        for (i = 0; i < max_pos; i++)
+           pos[i] = GST_AUDIO_CHANNEL_POSITION_NONE;
+ 
+         posn = pos;
+-- 
+2.47.0
+

SOURCES/0007-vorbis_parse-check-writes-to-GstOggStream.vorbis_mod.patch

@@ -0,0 +1,76 @@
+From 478653961d090f868521e8513518fe8d7c67cba3 Mon Sep 17 00:00:00 2001
+From: Wim Taymans <wtaymans@redhat.com>
+Date: Mon, 16 Dec 2024 11:26:07 +0100
+Subject: [PATCH 7/8] vorbis_parse: check writes to
+ GstOggStream.vorbis_mode_sizes
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-117 Fixes gstreamer#3875
+
+Also perform out-of-bounds check for accesses to op->packet
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8097>
+---
+ ext/ogg/vorbis_parse.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/ext/ogg/vorbis_parse.c b/ext/ogg/vorbis_parse.c
+index 2d85e9397..df52f7eb5 100644
+--- a/ext/ogg/vorbis_parse.c
++++ b/ext/ogg/vorbis_parse.c
+@@ -165,6 +165,10 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
+     if (offset == 0) {
+       offset = 8;
+       current_pos -= 1;
++
++      /* have we underrun? */
++      if (current_pos < op->packet)
++        return -1;
+     }
+   }
+ 
+@@ -178,6 +182,10 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
+     if (offset == 7)
+       current_pos -= 1;
+ 
++    /* have we underrun? */
++    if (current_pos < op->packet + 5)
++      return -1;
++
+     if (((current_pos[-5] & ~((1 << (offset + 1)) - 1)) != 0)
+         ||
+         current_pos[-4] != 0
+@@ -199,9 +207,18 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
+   /* Give ourselves a chance to recover if we went back too far by using
+    * the size check. */
+   for (ii = 0; ii < 2; ii++) {
++
+     if (offset > 4) {
++      /* have we underrun? */
++      if (current_pos < op->packet)
++        return -1;
++
+       size_check = (current_pos[0] >> (offset - 5)) & 0x3F;
+     } else {
++      /* have we underrun? */
++      if (current_pos < op->packet + 1)
++        return -1;
++
+       /* mask part of byte from current_pos */
+       size_check = (current_pos[0] & ((1 << (offset + 1)) - 1));
+       /* shift to appropriate position */
+@@ -229,6 +246,10 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
+ 
+   mode_size_ptr = pad->vorbis_mode_sizes;
+ 
++  if (size > G_N_ELEMENTS (pad->vorbis_mode_sizes)) {
++    return -1;
++  }
++
+   for (i = 0; i < size; i++) {
+     offset = (offset + 1) % 8;
+     if (offset == 0)
+-- 
+2.47.0
+

SOURCES/0008-vorbisdec-Set-at-most-64-channels-to-NONE-position.patch

@@ -0,0 +1,31 @@
+From 58375a492ee3b28e6e7f3d0be0f4bd9ec861a8cf Mon Sep 17 00:00:00 2001
+From: Wim Taymans <wtaymans@redhat.com>
+Date: Mon, 16 Dec 2024 11:27:39 +0100
+Subject: [PATCH 8/8] vorbisdec: Set at most 64 channels to NONE position
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-115
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3869
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8101>
+---
+ ext/vorbis/gstvorbisdec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ext/vorbis/gstvorbisdec.c b/ext/vorbis/gstvorbisdec.c
+index a0b48b71b..b44398945 100644
+--- a/ext/vorbis/gstvorbisdec.c
++++ b/ext/vorbis/gstvorbisdec.c
+@@ -191,7 +191,7 @@ vorbis_handle_identification_packet (GstVorbisDec * vd)
+     }
+     default:{
+       GstAudioChannelPosition position[64];
+-      gint i, max_pos = MAX (vd->vi.channels, 64);
++      gint i, max_pos = MIN (vd->vi.channels, 64);
+ 
+       GST_ELEMENT_WARNING (vd, STREAM, DECODE,
+           (NULL), ("Using NONE channel layout for more than 8 channels"));
+-- 
+2.47.0
+

SPECS/gstreamer1-plugins-base.spec

@@ -6,7 +6,7 @@
 
 Name:           gstreamer1-plugins-base
 Version:        1.16.1
-Release:        3%{?gitcommit:.git%{shortcommit}}%{?dist}
+Release:        5%{?gitcommit:.git%{shortcommit}}%{?dist}
 Summary:        GStreamer streaming media framework base plugins
 
 License:        LGPLv2+
@@ -20,8 +20,12 @@ Source0:        http://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugin
 %endif
 Patch0:		0001-missing-plugins-Remove-the-mpegaudioversion-field.patch
 Patch1:		0002-video-disable-ORC_RESTRICT.patch
-Patch2:		0001-subparse-Look-for-the-closing-of-a-tag-after-the-ope.patch
+Patch2:		0003-subparse-Look-for-the-closing-of-a-tag-after-the-ope.patch
-Patch3:		0002-subparse-Skip-after-the-end-of-a-valid-closing-tag-i.patch
+Patch3:		0004-subparse-Skip-after-the-end-of-a-valid-closing-tag-i.patch
+Patch4:		0005-exiftag-Prevent-integer-overflows-and-out-of-bounds-.patch
+Patch5:		0006-opusdec-Set-at-most-64-channels-to-NONE-position.patch
+Patch6:		0007-vorbis_parse-check-writes-to-GstOggStream.vorbis_mod.patch
+Patch7:		0008-vorbisdec-Set-at-most-64-channels-to-NONE-position.patch
 
 BuildRequires:  gcc-c++
 BuildRequires:  gstreamer1-devel >= %{version}
@@ -120,6 +124,10 @@ for the GStreamer Base Plugins library.
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
+%patch4 -p1
+%patch5 -p1
+%patch6 -p1
+%patch7 -p1
 
 %build
 # die rpath (method of modifying libtool fails here)
@@ -487,6 +495,14 @@ chrpath --delete $RPM_BUILD_ROOT%{_bindir}/gst-play-1.0
 
 
 %changelog
+* Mon Dec 16 2024 Wim Taymans <wtaymans@redhat.com> - 1.16.1-5
+- Fixes for CVE-2024-47538, CVE-2024-47607, CVE-2024-47615
+  Resolves: RHEL-70974, RHEL-71010, RHEL-70986
+
+* Fri Nov 08 2024 Wim Taymans <wtaymans@redhat.com> - 1.16.1-4
+- CVE-2024-4453 gstreamer1: EXIF Metadata Parsing Integer Overflow
+- Resolves: RHEL-38509
+
 * Wed Jan 17 2024 Wim Taymans <wtaymans@redhat.com> - 1.16.1-3
 - CVE-2023-37328 gstreamer1-plugins-base: heap overwrite in subtitle parsing
 - Resolves: RHEL-19472