import Oracle_OSS gstreamer1-plugins-good-1.26.7-2.el10_2.1
This commit is contained in:
AlmaLinux RelEng Bot
parent
19ed59f5d0
commit
03715fb10c
164
gstreamer1-plugins-good-1.26.7-CVE-2026-53705.patch
Normal file
164
gstreamer1-plugins-good-1.26.7-CVE-2026-53705.patch
Normal file
@ -0,0 +1,164 @@
|
||||
From bedd4c05847e9a67512195d425646b3b67150b17 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 5 Jun 2026 11:24:21 +0300
|
||||
Subject: [PATCH 1/4] wavpackdec: Avoid integer overflow when calculating
|
||||
output buffer size
|
||||
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5069
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797>
|
||||
---
|
||||
ext/wavpack/gstwavpackdec.c | 7 ++++++-
|
||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
index 4736892..df5bb93 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
@@ -294,6 +294,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
gint width, depth, i, j, max, wavpack_mode;
|
||||
gboolean mode_float;
|
||||
gint32 *dec_data = NULL;
|
||||
+ gsize dec_data_size;
|
||||
guint8 *out_data;
|
||||
GstMapInfo map, omap;
|
||||
|
||||
@@ -371,7 +372,11 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
}
|
||||
|
||||
/* alloc output buffer */
|
||||
- dec_data = g_malloc (4 * wph.block_samples * dec->channels);
|
||||
+ dec_data_size = 4;
|
||||
+ if (!g_size_checked_mul (&dec_data_size, dec_data_size, wph.block_samples) ||
|
||||
+ !g_size_checked_mul (&dec_data_size, dec_data_size, dec->channels))
|
||||
+ goto invalid_header;
|
||||
+ dec_data = g_malloc (dec_data_size);
|
||||
|
||||
/* decode */
|
||||
decoded = WavpackUnpackSamples (dec->context, dec_data, wph.block_samples);
|
||||
--
|
||||
2.52.0
|
||||
|
||||
|
||||
From 2674296414e15e11c6e29d5eeed6f8c41acc8be5 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 5 Jun 2026 11:24:25 +0300
|
||||
Subject: [PATCH 2/4] wavpackdec: Use correctly-sized variable types
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797>
|
||||
---
|
||||
ext/wavpack/gstwavpackdec.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
index df5bb93..a952865 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
@@ -289,12 +289,12 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
GstBuffer *outbuf = NULL;
|
||||
GstFlowReturn ret = GST_FLOW_OK;
|
||||
WavpackHeader wph;
|
||||
- int32_t decoded, unpacked_size;
|
||||
gboolean format_changed;
|
||||
- gint width, depth, i, j, max, wavpack_mode;
|
||||
+ gint width, depth, wavpack_mode;
|
||||
gboolean mode_float;
|
||||
gint32 *dec_data = NULL;
|
||||
- gsize dec_data_size;
|
||||
+ gsize i, j, dec_data_size, unpacked_size, max;
|
||||
+ uint32_t decoded;
|
||||
guint8 *out_data;
|
||||
GstMapInfo map, omap;
|
||||
|
||||
--
|
||||
2.52.0
|
||||
|
||||
|
||||
From bd45e8a957717844b35c578d7f30396a1ec8fe95 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 5 Jun 2026 11:24:29 +0300
|
||||
Subject: [PATCH 3/4] wavpackdec: Avoid integer overflow when checking input
|
||||
buffer size
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797>
|
||||
---
|
||||
ext/wavpack/gstwavpackdec.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
index a952865..4fe0567 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
@@ -311,7 +311,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
if (!gst_wavpack_read_header (&wph, map.data))
|
||||
goto invalid_header;
|
||||
|
||||
- if (map.size < wph.ckSize + 4 * 1 + 4)
|
||||
+ if (map.size - 4 * 1 - 4 < wph.ckSize)
|
||||
goto input_not_framed;
|
||||
|
||||
if (!(wph.flags & INITIAL_BLOCK))
|
||||
--
|
||||
2.52.0
|
||||
|
||||
|
||||
From bf5f8b3d6b44f27394b4229c7993b57c54518ea6 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 5 Jun 2026 11:24:33 +0300
|
||||
Subject: [PATCH 4/4] wavpackdec: Unmap input buffer directly after decoding
|
||||
|
||||
In case of decoder errors we would otherwise unmap the buffer after
|
||||
finish_frame(), which potentially invalidates the input buffer already.
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797>
|
||||
---
|
||||
ext/wavpack/gstwavpackdec.c | 9 +++++----
|
||||
1 file changed, 5 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
index 4fe0567..7d1e95d 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
@@ -295,6 +295,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
gint32 *dec_data = NULL;
|
||||
gsize i, j, dec_data_size, unpacked_size, max;
|
||||
uint32_t decoded;
|
||||
+ guint64 offset;
|
||||
guint8 *out_data;
|
||||
GstMapInfo map, omap;
|
||||
|
||||
@@ -377,9 +378,12 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
!g_size_checked_mul (&dec_data_size, dec_data_size, dec->channels))
|
||||
goto invalid_header;
|
||||
dec_data = g_malloc (dec_data_size);
|
||||
+ offset = GST_BUFFER_OFFSET (buf);
|
||||
|
||||
/* decode */
|
||||
decoded = WavpackUnpackSamples (dec->context, dec_data, wph.block_samples);
|
||||
+ gst_buffer_unmap (buf, &map);
|
||||
+ buf = NULL;
|
||||
if (decoded != wph.block_samples)
|
||||
goto decode_error;
|
||||
|
||||
@@ -387,7 +391,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
outbuf = gst_buffer_new_and_alloc (unpacked_size);
|
||||
|
||||
/* legacy; pass along offset, whatever that might entail */
|
||||
- GST_BUFFER_OFFSET (outbuf) = GST_BUFFER_OFFSET (buf);
|
||||
+ GST_BUFFER_OFFSET (outbuf) = offset;
|
||||
|
||||
gst_buffer_map (outbuf, &omap, GST_MAP_WRITE);
|
||||
out_data = omap.data;
|
||||
@@ -432,9 +436,6 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
}
|
||||
|
||||
gst_buffer_unmap (outbuf, &omap);
|
||||
- gst_buffer_unmap (buf, &map);
|
||||
- buf = NULL;
|
||||
-
|
||||
g_free (dec_data);
|
||||
|
||||
ret = gst_audio_decoder_finish_frame (bdec, outbuf, 1);
|
||||
--
|
||||
2.52.0
|
||||
|
||||
@ -35,7 +35,7 @@
|
||||
|
||||
Name: gstreamer1-plugins-good
|
||||
Version: 1.26.7
|
||||
Release: 2%{?dist}
|
||||
Release: 2%{?dist}.1
|
||||
Summary: GStreamer plugins with good code and licensing
|
||||
|
||||
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
|
||||
@ -56,6 +56,11 @@ Source0: http://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugin
|
||||
Source1: gstreamer-good.appdata.xml
|
||||
|
||||
Patch: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
|
||||
# https://github.com/GStreamer/gstreamer/commit/318f72af3bf0d8314d1fd4b9117f240d1b8511b7
|
||||
# https://github.com/GStreamer/gstreamer/commit/8472adc6707caca61a18a4dee01dbe970ea430f2
|
||||
# https://github.com/GStreamer/gstreamer/commit/f2313c0bcc1f68054168e0b6e884d458fba76fbc
|
||||
# https://github.com/GStreamer/gstreamer/commit/e92726ba1b60c16487d7a0fe11198f41e3bad51c
|
||||
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-53705.patch
|
||||
|
||||
BuildRequires: meson >= 0.48.0
|
||||
BuildRequires: gcc
|
||||
@ -376,9 +381,13 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
|
||||
|
||||
|
||||
%changelog
|
||||
* Fri Jun 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-2.1
|
||||
- Fix integer overflow vulnerabilities in wavpack decoder (CVE-2026-53705)
|
||||
Resolves: RHEL-184480
|
||||
|
||||
* Tue Mar 31 2026 Wim Taymans <wtaymans@redhat.com> - 1.26.7-2
|
||||
- Add patch for CVE-2026-3083 and CVE-2026-3085
|
||||
Resolves: RHEL-156142, RHEL-156119
|
||||
Resolves: RHEL-156133, RHEL-156112
|
||||
|
||||
* Tue Nov 04 2025 Wim Taymans <wtaymans@redhat.com> - 1.26.7-1
|
||||
- Update to 1.26.7
|
||||
|
||||
Loading…
Reference in New Issue
Block a user