rpms/gstreamer1-plugins-good
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix multiple security issues in AVI demuxer (CVE-2026-73433)

Browse Source 
Backport upstream GStreamer MR !12231 to fix CVE-2026-73433,
addressing multiple security issues in the AVI demuxer
(gst/avi/gstavidemux.c). The patch includes fixes for
bounds checking on FUJIFILM strd parsing, read-only buffer
handling, tag pointer dereferencing, vprp field info
calculation, integer overflow in index parsing, and subindex
item count validation.

CVE: CVE-2026-73433
Upstream patches:
 - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231.patch
Resolves: RHEL-239068

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-13 14:32:05 +00:00
parent ed74ee9326
commit 1a5072bc97
2 changed files with 374 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

365
gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch Normal file
View File

@ -0,0 +1,365 @@
From 901efd4d415752fc6b539bdebcb550c9345f6487 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 12:00:34 +0300
Subject: [PATCH 1/6] avidemux: Make sure enough data is available when parsing
FUJIFILM strd
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
gst/avi/gstavidemux.c | 23 +++++++++++++----------
1 file changed, 13 insertions(+), 10 deletions(-)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 834af76..4be47b2 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -3821,13 +3821,13 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
ptr += 98;
left -= 98;
- if (!memcmp (ptr, "FUJIFILM", 8)) {
+ if (left >= 10 && !memcmp (ptr, "FUJIFILM", 8)) {
GST_MEMDUMP_OBJECT (avi, "fujifim tag", ptr, 48);
ptr += 10;
left -= 10;
sub_size = 0;
- while (ptr[sub_size] && sub_size < left)
+ while (sub_size < left && ptr[sub_size])
sub_size++;
if (avi->globaltags == NULL)
@@ -3838,21 +3838,24 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
parse_tag_value (avi, avi->globaltags, GST_TAG_DEVICE_MODEL, ptr,
sub_size);
- while (ptr[sub_size] == '\0' && sub_size < left)
+ while (sub_size < left && ptr[sub_size] == '\0')
sub_size++;
ptr += sub_size;
left -= sub_size;
sub_size = 0;
- while (ptr[sub_size] && sub_size < left)
+ while (sub_size < left && ptr[sub_size])
sub_size++;
- if (ptr[4] == ':')
- ptr[4] = '-';
- if (ptr[7] == ':')
- ptr[7] = '-';
- parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
- sub_size);
+ if (sub_size >= 8) {
+ if (ptr[4] == ':')
+ ptr[4] = '-';
+ if (ptr[7] == ':')
+ ptr[7] = '-';
+
+ parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
+ sub_size);
+ }
}
}
}
From 3f527d85b7280b020b328121ef4c0e62c333f79f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 12:27:37 +0300
Subject: [PATCH 2/6] avidemux: Don't modify read-only mapped buffer data
And improve const-correctness in many places.
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
gst/avi/gstavidemux.c | 59 ++++++++++++++++++++++++++++---------------
1 file changed, 38 insertions(+), 21 deletions(-)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 4be47b2..7a8957c 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -126,7 +126,7 @@ static void gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf);
static void gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf);
static void parse_tag_value (GstAviDemux * avi, GstTagList * taglist,
- const gchar * type, guint8 * ptr, guint tsize);
+ const gchar * type, const guint8 * ptr, guint tsize);
/* GObject methods */
@@ -1238,7 +1238,7 @@ gst_avi_demux_parse_superindex (GstAviDemux * avi,
GstBuffer * buf, guint64 ** _indexes)
{
GstMapInfo map;
- guint8 *data;
+ const guint8 *data;
guint16 bpe = 16;
guint32 num, i;
guint64 *indexes;
@@ -1526,7 +1526,7 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream,
GstBuffer * buf)
{
GstMapInfo map;
- guint8 *data;
+ const guint8 *data;
guint16 bpe;
guint32 num, i;
guint64 baseoff;
@@ -1974,7 +1974,7 @@ gst_avi_demux_check_caps (GstAviDemux * avi, GstAviStream * stream,
/* some muxers put invalid bytestream stuff in h264 extra data */
val = gst_structure_get_value (s, "codec_data");
if (val && (buf = gst_value_get_buffer (val))) {
- guint8 *data;
+ const guint8 *data;
gint size;
GstMapInfo map;
@@ -2730,7 +2730,7 @@ gst_avi_demux_parse_index (GstAviDemux * avi, GstBuffer * buf)
{
GstMapInfo map;
guint i, num, n;
- gst_riff_index_entry *index;
+ const gst_riff_index_entry *index;
GstClockTime stamp;
GstAviStream *stream;
GstAviIndexEntry entry;
@@ -3714,7 +3714,7 @@ static void
gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf)
{
GstMapInfo map;
- gchar *ptr;
+ const gchar *ptr;
gsize left;
gchar *safedata = NULL;
@@ -3732,7 +3732,7 @@ gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf)
*/
/* skip eventual initial whitespace */
- ptr = (gchar *) map.data;
+ ptr = (const gchar *) map.data;
left = map.size;
while (left > 0 && g_ascii_isspace (ptr[0])) {
@@ -3769,7 +3769,7 @@ non_parsable:
static void
parse_tag_value (GstAviDemux * avi, GstTagList * taglist, const gchar * type,
- guint8 * ptr, guint tsize)
+ const guint8 * ptr, guint tsize)
{
static const gchar *env_vars[] = { "GST_AVI_TAG_ENCODING",
"GST_RIFF_TAG_ENCODING", "GST_TAG_ENCODING", NULL
@@ -3809,7 +3809,7 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
gst_buffer_map (buf, &map, GST_MAP_READ);
if (map.size > 4) {
- guint8 *ptr = map.data;
+ const guint8 *ptr = map.data;
gsize left = map.size;
/* parsing based on
@@ -3848,13 +3848,17 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
sub_size++;
if (sub_size >= 8) {
- if (ptr[4] == ':')
- ptr[4] = '-';
- if (ptr[7] == ':')
- ptr[7] = '-';
+ guint8 *ptr_dup = g_memdup2 (ptr, sub_size);
+
+ if (ptr_dup[4] == ':')
+ ptr_dup[4] = '-';
+ if (ptr_dup[7] == ':')
+ ptr_dup[7] = '-';
- parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
+ parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr_dup,
sub_size);
+
+ g_free (ptr_dup);
}
}
}
@@ -3877,7 +3881,7 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf,
GstTagList ** _taglist)
{
GstMapInfo info;
- guint8 *ptr;
+ const guint8 *ptr;
gsize left;
guint tsize;
guint32 tag;
@@ -3946,14 +3950,27 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf,
type = GST_TAG_ENCODER;
break;
case 0x13: /* CreationDate */
- type = GST_TAG_DATE_TIME;
- if (left > 7) {
- if (ptr[4] == ':')
- ptr[4] = '-';
- if (ptr[7] == ':')
- ptr[7] = '-';
+ {
+ type = NULL;
+
+ if (left > 7 && ptr[0] != '\0') {
+ guint8 *ptr_dup = g_memdup2 (ptr, sub_size);
+
+ if (ptr_dup[4] == ':')
+ ptr_dup[4] = '-';
+ if (ptr_dup[7] == ':')
+ ptr_dup[7] = '-';
+
+ GST_DEBUG_OBJECT (avi, "mapped tag %u to tag %s", sub_tag,
+ GST_TAG_DATE_TIME);
+
+ parse_tag_value (avi, taglist, GST_TAG_DATE_TIME, ptr_dup,
+ sub_size);
+
+ g_free (ptr_dup);
}
break;
+ }
default:
type = NULL;
break;
From 345735b66d7049991fb27a8f64ea1adfc9352e46 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 12:29:14 +0300
Subject: [PATCH 3/6] avidemux: Check that at least 1 byte is available before
dereferencing tag pointer
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
gst/avi/gstavidemux.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 7a8957c..64a28d2 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -3975,7 +3975,7 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf,
type = NULL;
break;
}
- if (type != NULL && ptr[0] != '\0') {
+ if (type != NULL && left > 0 && ptr[0] != '\0') {
GST_DEBUG_OBJECT (avi, "mapped tag %u to tag %s", sub_tag, type);
parse_tag_value (avi, taglist, type, ptr, sub_size);
From a224a7a063ef1a53c1210c9c9bbfeb610d0d2253 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 12:35:12 +0300
Subject: [PATCH 4/6] avidemux: Use correct divisor for calculating available
number of vprp field infos
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
gst/avi/gstavidemux.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 64a28d2..6a4bf7a 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -1805,7 +1805,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element,
/* size checking */
/* calculate fields based on size */
- k = (size - G_STRUCT_OFFSET (gst_riff_vprp, field_info)) / vprp->fields;
+ k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
+ field_info)) / sizeof (vprp->field_info[0]);
if (vprp->fields > k) {
GST_WARNING_OBJECT (element,
"vprp header indicated %d fields, only %d available", vprp->fields, k);
From 6b063d86c99298cb8901a4134b82f7bcc84fa6a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 13:22:04 +0300
Subject: [PATCH 5/6] avidemux: Avoid integer overflow in bounds checks when
parsing the index
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
gst/avi/gstavidemux.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 6a4bf7a..20fd207 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -1280,8 +1280,13 @@ gst_avi_demux_parse_superindex (GstAviDemux * avi,
indexes = g_new (guint64, num + 1);
for (i = 0; i < num; i++) {
- if (size < 24 + bpe * (i + 1))
+ gsize required_size;
+
+ if (!g_size_checked_mul (&required_size, bpe, i + 1))
+ break;
+ if (size - 24 < required_size)
break;
+
indexes[i] = GST_READ_UINT64_LE (&data[24 + bpe * i]);
GST_DEBUG_OBJECT (avi, "index %d at %" G_GUINT64_FORMAT, i, indexes[i]);
}
@@ -1568,8 +1573,11 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream,
for (i = 0; i < num; i++) {
GstAviIndexEntry entry;
+ gsize required_size;
- if (map.size < 24 + bpe * (i + 1))
+ if (!g_size_checked_mul (&required_size, bpe, i + 1))
+ break;
+ if (map.size - 24 < required_size)
break;
/* fill in offset and size. offset contains the keyframe flag in the
From a6ac7c3a64bce23d504f0b62313120ae1bfb08e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 13:22:38 +0300
Subject: [PATCH 6/6] avidemux: Don't read a subindex with too many items
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
gst/avi/gstavidemux.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 20fd207..4d3f608 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -1569,6 +1569,10 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream,
if (num == 0)
goto empty_index;
+ /* this can't work out well ... */
+ if (num > G_MAXUINT32 >> 1)
+ goto invalid_params;
+
GST_INFO_OBJECT (avi, "Parsing subindex, nr_entries = %6d", num);
for (i = 0; i < num; i++) {
@@ -1620,6 +1624,11 @@ not_implemented:
gst_buffer_unref (buf);
return FALSE;
}
+invalid_params:
+ {
+ GST_ERROR_OBJECT (avi, "invalid subindex parameters (num = %d)", num);
+ goto done; /* continue */
+ }
empty_index:
{
GST_DEBUG_OBJECT (avi, "the index is empty");

10
gstreamer1-plugins-good.spec
View File

@ -15,7 +15,7 @@
Name: gstreamer1-plugins-good
Version: 1.16.1
Release: 7%{?gitcommit:.git%{shortcommit}}%{?dist}
Release: 7%{?gitcommit:.git%{shortcommit}}%{?dist}.1
Summary: GStreamer plugins with good code and licensing
License: LGPLv2+
@ -42,6 +42,9 @@ Patch9: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
# https://issues.redhat.com/browse/RHEL-184473
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811
Patch10: gstreamer1-plugins-good-1.16.1-CVE-2026-53705.patch
# https://issues.redhat.com/browse/RHEL-239068
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231
Patch11: gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch
BuildRequires: gcc
BuildRequires: gcc-c++
@ -186,6 +189,7 @@ to be installed.
%patch8 -p1
%patch9 -p1
%patch10 -p1
%patch11 -p1
%build
%configure --disable-silent-rules --disable-fatal-warnings \
@ -370,6 +374,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
%changelog
* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.1
- Fix multiple security issues in AVI demuxer (CVE-2026-73433)
Resolves: RHEL-239068
* Fri Jun 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7
- Fix integer overflow vulnerabilities in wavpackdec (CVE-2026-53705)
Resolves: RHEL-184473