From 17732cec3f4274656d09738404aa643a622705b2 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Mon, 17 Aug 2026 09:09:04 +0000 Subject: [PATCH] Fix avidemux vprp field info divisor calculation (CVE-2026-73434) Backport upstream commit 0bcc6564c7 to fix CVE-2026-73434 in the AVI demuxer. The patch corrects the divisor used in gst_avi_demux_riff_parse_vprp() when calculating the available number of vprp field infos, changing it from an incorrect division by vprp->fields to the correct sizeof(vprp->field_info[0]). CVE: CVE-2026-73434 Upstream patches: - https://github.com/GStreamer/gstreamer/commit/0bcc6564c7deedc7d6d7373a2ab6479c9bf3889f.patch Resolves: RHEL-239039 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- ...-plugins-good-1.22.12-CVE-2026-73434.patch | 27 +++++++++++++++++++ gstreamer1-plugins-good.spec | 10 ++++++- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch diff --git a/gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch b/gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch new file mode 100644 index 0000000..102b7d1 --- /dev/null +++ b/gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch @@ -0,0 +1,27 @@ +From dd4fc6238da811a4c7ee92eefe49f0aec58fef6c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:35:12 +0300 +Subject: [PATCH] avidemux: Use correct divisor for calculating available + number of vprp field infos + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213 + +Part-of: +--- + subprojects/gst-plugins-good/gst/avi/gstavidemux.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c +index 0d18a6495c..379c6544f3 100644 +--- a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c ++++ b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c +@@ -1808,7 +1808,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element, + + /* size checking */ + /* calculate fields based on size */ +- k = (size - G_STRUCT_OFFSET (gst_riff_vprp, field_info)) / vprp->fields; ++ k = (size - G_STRUCT_OFFSET (gst_riff_vprp, ++ field_info)) / sizeof (vprp->field_info[0]); + if (vprp->fields > k) { + GST_WARNING_OBJECT (element, + "vprp header indicated %d fields, only %d available", vprp->fields, k); diff --git a/gstreamer1-plugins-good.spec b/gstreamer1-plugins-good.spec index 1e1d767..838972d 100644 --- a/gstreamer1-plugins-good.spec +++ b/gstreamer1-plugins-good.spec @@ -28,7 +28,7 @@ Name: gstreamer1-plugins-good Version: 1.22.12 -Release: 10%{?dist} +Release: 11%{?dist} Summary: GStreamer plugins with good code and licensing License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0 @@ -86,6 +86,9 @@ Patch0031: gstreamer1-plugins-good-1.22.12-CVE-2026-18649.patch # https://issues.redhat.com/browse/RHEL-239066 # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/bb8fb5a9bf15fb845863430281e4bf908aec7090 Patch0032: gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch +# https://issues.redhat.com/browse/RHEL-239039 +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231 +Patch0033: gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch BuildRequires: meson >= 0.48.0 BuildRequires: gcc @@ -277,6 +280,7 @@ to be installed. %patch -P 0030 -p3 %patch -P 0031 -p3 %patch -P 0032 -p3 +%patch -P 0033 -p3 %build %meson \ @@ -427,6 +431,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';' %changelog +* Mon Aug 17 2026 RHEL Packaging Agent - 1.22.12-11 +- Fix avidemux vprp field info divisor calculation + (CVE-2026-73434) + * Mon Aug 17 2026 RHEL Packaging Agent - 1.22.12-10 - Fix out-of-bounds reads in AVI FUJIFILM strd parsing (CVE-2026-73433)