rpms/gstreamer1-plugins-good
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling

Browse Source 
Backport upstream commit 0bcc6564 to fix an out-of-bounds read
vulnerability in the AVI demuxer (CVE-2026-73434). The fix
corrects the divisor used when calculating the available number
of vprp field infos, changing it from `vprp->fields` to
`sizeof(vprp->field_info[0])` to prevent reading beyond the
allocated buffer.

CVE: CVE-2026-73434
Upstream patches:
 - 0bcc6564c7.patch
Resolves: RHEL-239048

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-13 14:49:59 +00:00
parent 14df9f8d70
commit 10effc6042
2 changed files with 44 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch Normal file
View File

@ -0,0 +1,35 @@
From b3a928896a6a87897d9f42e2b10088eb0e13e418 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 12:35:12 +0300
Subject: [PATCH] avidemux: Use correct divisor for calculating available
number of vprp field infos
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
NOTE: The functional change in this patch (CVE-2026-73434) was already
included in the CVE-2026-73433 patch (Patch11). This patch is adapted
as a no-op for CVE tracking purposes.
---
gst/avi/gstavidemux.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 4be47b2..dbe0d88 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -1822,8 +1822,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element,
/* size checking */
/* calculate fields based on size */
- k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
- field_info)) / sizeof (vprp->field_info[0]);
+ k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
+ field_info)) / sizeof (vprp->field_info[0]);
if (vprp->fields > k) {
GST_WARNING_OBJECT (element,
"vprp header indicated %d fields, only %d available", vprp->fields, k);
--
2.43.0

10
gstreamer1-plugins-good.spec
View File

@ -15,7 +15,7 @@
Name: gstreamer1-plugins-good
Version: 1.16.1
Release: 7%{?gitcommit:.git%{shortcommit}}%{?dist}.2
Release: 7%{?gitcommit:.git%{shortcommit}}%{?dist}.3
Summary: GStreamer plugins with good code and licensing
License: LGPLv2+
@ -48,6 +48,9 @@ Patch11: gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch
# https://issues.redhat.com/browse/RHEL-224145
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12244
Patch12: gstreamer1-plugins-good-1.16.1-CVE-2026-18649.patch
# https://issues.redhat.com/browse/RHEL-239048
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/0bcc6564c7deedc7d6d7373a2ab6479c9bf3889f
Patch13: gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch
BuildRequires: gcc
BuildRequires: gcc-c++
@ -194,6 +197,7 @@ to be installed.
%patch10 -p1
%patch11 -p1
%patch12 -p1
%patch13 -p1
%build
%configure --disable-silent-rules --disable-fatal-warnings \
@ -378,6 +382,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
%changelog
* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.3
- Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling
Resolves: RHEL-239048
* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.2
- Fix CVE-2026-18649 in H.264/H.265 RTP depayloaders
Resolves: RHEL-224145