rpms/gstreamer1-plugins-good
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix avidemux vprp field info divisor calculation (CVE-2026-73434)

Browse Source 
Backport upstream commit 0bcc6564c7 to fix CVE-2026-73434
in the AVI demuxer. The patch corrects the divisor used in
gst_avi_demux_riff_parse_vprp() when calculating the available
number of vprp field infos, changing it from an incorrect
division by vprp->fields to the correct sizeof(vprp->field_info[0]).

CVE: CVE-2026-73434
Upstream patches:
 - 0bcc6564c7.patch
Resolves: RHEL-239039

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-17 09:09:04 +00:00
parent 81bea5fd9a
commit 17732cec3f
2 changed files with 36 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch Normal file
View File

@ -0,0 +1,27 @@
From dd4fc6238da811a4c7ee92eefe49f0aec58fef6c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 12:35:12 +0300
Subject: [PATCH] avidemux: Use correct divisor for calculating available
number of vprp field infos
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
subprojects/gst-plugins-good/gst/avi/gstavidemux.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
index 0d18a6495c..379c6544f3 100644
--- a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
+++ b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
@@ -1808,7 +1808,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element,
/* size checking */
/* calculate fields based on size */
- k = (size - G_STRUCT_OFFSET (gst_riff_vprp, field_info)) / vprp->fields;
+ k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
+ field_info)) / sizeof (vprp->field_info[0]);
if (vprp->fields > k) {
GST_WARNING_OBJECT (element,
"vprp header indicated %d fields, only %d available", vprp->fields, k);

10
gstreamer1-plugins-good.spec
View File

@ -28,7 +28,7 @@
Name: gstreamer1-plugins-good
Version: 1.22.12
Release: 10%{?dist}
Release: 11%{?dist}
Summary: GStreamer plugins with good code and licensing
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
@ -86,6 +86,9 @@ Patch0031: gstreamer1-plugins-good-1.22.12-CVE-2026-18649.patch
# https://issues.redhat.com/browse/RHEL-239066
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/bb8fb5a9bf15fb845863430281e4bf908aec7090
Patch0032: gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch
# https://issues.redhat.com/browse/RHEL-239039
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231
Patch0033: gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch
BuildRequires: meson >= 0.48.0
BuildRequires: gcc
@ -277,6 +280,7 @@ to be installed.
%patch -P 0030 -p3
%patch -P 0031 -p3
%patch -P 0032 -p3
%patch -P 0033 -p3
%build
%meson \
@ -427,6 +431,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
%changelog
* Mon Aug 17 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-11
- Fix avidemux vprp field info divisor calculation
(CVE-2026-73434)
* Mon Aug 17 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-10
- Fix out-of-bounds reads in AVI FUJIFILM strd parsing
(CVE-2026-73433)