From 1a5072bc9711bc46873f45384ee8096f9516dbc2 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Thu, 13 Aug 2026 14:32:05 +0000 Subject: [PATCH] Fix multiple security issues in AVI demuxer (CVE-2026-73433) Backport upstream GStreamer MR !12231 to fix CVE-2026-73433, addressing multiple security issues in the AVI demuxer (gst/avi/gstavidemux.c). The patch includes fixes for bounds checking on FUJIFILM strd parsing, read-only buffer handling, tag pointer dereferencing, vprp field info calculation, integer overflow in index parsing, and subindex item count validation. CVE: CVE-2026-73433 Upstream patches: - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231.patch Resolves: RHEL-239068 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- ...1-plugins-good-1.16.1-CVE-2026-73433.patch | 365 ++++++++++++++++++ gstreamer1-plugins-good.spec | 10 +- 2 files changed, 374 insertions(+), 1 deletion(-) create mode 100644 gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch diff --git a/gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch b/gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch new file mode 100644 index 0000000..986b84c --- /dev/null +++ b/gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch @@ -0,0 +1,365 @@ +From 901efd4d415752fc6b539bdebcb550c9345f6487 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:00:34 +0300 +Subject: [PATCH 1/6] avidemux: Make sure enough data is available when parsing + FUJIFILM strd + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213 + +Part-of: +--- + gst/avi/gstavidemux.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 834af76..4be47b2 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -3821,13 +3821,13 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf) + + ptr += 98; + left -= 98; +- if (!memcmp (ptr, "FUJIFILM", 8)) { ++ if (left >= 10 && !memcmp (ptr, "FUJIFILM", 8)) { + GST_MEMDUMP_OBJECT (avi, "fujifim tag", ptr, 48); + + ptr += 10; + left -= 10; + sub_size = 0; +- while (ptr[sub_size] && sub_size < left) ++ while (sub_size < left && ptr[sub_size]) + sub_size++; + + if (avi->globaltags == NULL) +@@ -3838,21 +3838,24 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf) + parse_tag_value (avi, avi->globaltags, GST_TAG_DEVICE_MODEL, ptr, + sub_size); + +- while (ptr[sub_size] == '\0' && sub_size < left) ++ while (sub_size < left && ptr[sub_size] == '\0') + sub_size++; + + ptr += sub_size; + left -= sub_size; + sub_size = 0; +- while (ptr[sub_size] && sub_size < left) ++ while (sub_size < left && ptr[sub_size]) + sub_size++; +- if (ptr[4] == ':') +- ptr[4] = '-'; +- if (ptr[7] == ':') +- ptr[7] = '-'; + +- parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr, +- sub_size); ++ if (sub_size >= 8) { ++ if (ptr[4] == ':') ++ ptr[4] = '-'; ++ if (ptr[7] == ':') ++ ptr[7] = '-'; ++ ++ parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr, ++ sub_size); ++ } + } + } + } + +From 3f527d85b7280b020b328121ef4c0e62c333f79f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:27:37 +0300 +Subject: [PATCH 2/6] avidemux: Don't modify read-only mapped buffer data + +And improve const-correctness in many places. + +Part-of: +--- + gst/avi/gstavidemux.c | 59 ++++++++++++++++++++++++++++--------------- + 1 file changed, 38 insertions(+), 21 deletions(-) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 4be47b2..7a8957c 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -126,7 +126,7 @@ static void gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf); + static void gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf); + + static void parse_tag_value (GstAviDemux * avi, GstTagList * taglist, +- const gchar * type, guint8 * ptr, guint tsize); ++ const gchar * type, const guint8 * ptr, guint tsize); + + /* GObject methods */ + +@@ -1238,7 +1238,7 @@ gst_avi_demux_parse_superindex (GstAviDemux * avi, + GstBuffer * buf, guint64 ** _indexes) + { + GstMapInfo map; +- guint8 *data; ++ const guint8 *data; + guint16 bpe = 16; + guint32 num, i; + guint64 *indexes; +@@ -1526,7 +1526,7 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream, + GstBuffer * buf) + { + GstMapInfo map; +- guint8 *data; ++ const guint8 *data; + guint16 bpe; + guint32 num, i; + guint64 baseoff; +@@ -1974,7 +1974,7 @@ gst_avi_demux_check_caps (GstAviDemux * avi, GstAviStream * stream, + /* some muxers put invalid bytestream stuff in h264 extra data */ + val = gst_structure_get_value (s, "codec_data"); + if (val && (buf = gst_value_get_buffer (val))) { +- guint8 *data; ++ const guint8 *data; + gint size; + GstMapInfo map; + +@@ -2730,7 +2730,7 @@ gst_avi_demux_parse_index (GstAviDemux * avi, GstBuffer * buf) + { + GstMapInfo map; + guint i, num, n; +- gst_riff_index_entry *index; ++ const gst_riff_index_entry *index; + GstClockTime stamp; + GstAviStream *stream; + GstAviIndexEntry entry; +@@ -3714,7 +3714,7 @@ static void + gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf) + { + GstMapInfo map; +- gchar *ptr; ++ const gchar *ptr; + gsize left; + gchar *safedata = NULL; + +@@ -3732,7 +3732,7 @@ gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf) + */ + + /* skip eventual initial whitespace */ +- ptr = (gchar *) map.data; ++ ptr = (const gchar *) map.data; + left = map.size; + + while (left > 0 && g_ascii_isspace (ptr[0])) { +@@ -3769,7 +3769,7 @@ non_parsable: + + static void + parse_tag_value (GstAviDemux * avi, GstTagList * taglist, const gchar * type, +- guint8 * ptr, guint tsize) ++ const guint8 * ptr, guint tsize) + { + static const gchar *env_vars[] = { "GST_AVI_TAG_ENCODING", + "GST_RIFF_TAG_ENCODING", "GST_TAG_ENCODING", NULL +@@ -3809,7 +3809,7 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf) + + gst_buffer_map (buf, &map, GST_MAP_READ); + if (map.size > 4) { +- guint8 *ptr = map.data; ++ const guint8 *ptr = map.data; + gsize left = map.size; + + /* parsing based on +@@ -3848,13 +3848,17 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf) + sub_size++; + + if (sub_size >= 8) { +- if (ptr[4] == ':') +- ptr[4] = '-'; +- if (ptr[7] == ':') +- ptr[7] = '-'; ++ guint8 *ptr_dup = g_memdup2 (ptr, sub_size); ++ ++ if (ptr_dup[4] == ':') ++ ptr_dup[4] = '-'; ++ if (ptr_dup[7] == ':') ++ ptr_dup[7] = '-'; + +- parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr, ++ parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr_dup, + sub_size); ++ ++ g_free (ptr_dup); + } + } + } +@@ -3877,7 +3881,7 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf, + GstTagList ** _taglist) + { + GstMapInfo info; +- guint8 *ptr; ++ const guint8 *ptr; + gsize left; + guint tsize; + guint32 tag; +@@ -3946,14 +3950,27 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf, + type = GST_TAG_ENCODER; + break; + case 0x13: /* CreationDate */ +- type = GST_TAG_DATE_TIME; +- if (left > 7) { +- if (ptr[4] == ':') +- ptr[4] = '-'; +- if (ptr[7] == ':') +- ptr[7] = '-'; ++ { ++ type = NULL; ++ ++ if (left > 7 && ptr[0] != '\0') { ++ guint8 *ptr_dup = g_memdup2 (ptr, sub_size); ++ ++ if (ptr_dup[4] == ':') ++ ptr_dup[4] = '-'; ++ if (ptr_dup[7] == ':') ++ ptr_dup[7] = '-'; ++ ++ GST_DEBUG_OBJECT (avi, "mapped tag %u to tag %s", sub_tag, ++ GST_TAG_DATE_TIME); ++ ++ parse_tag_value (avi, taglist, GST_TAG_DATE_TIME, ptr_dup, ++ sub_size); ++ ++ g_free (ptr_dup); + } + break; ++ } + default: + type = NULL; + break; + +From 345735b66d7049991fb27a8f64ea1adfc9352e46 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:29:14 +0300 +Subject: [PATCH 3/6] avidemux: Check that at least 1 byte is available before + dereferencing tag pointer + +Part-of: +--- + gst/avi/gstavidemux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 7a8957c..64a28d2 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -3975,7 +3975,7 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf, + type = NULL; + break; + } +- if (type != NULL && ptr[0] != '\0') { ++ if (type != NULL && left > 0 && ptr[0] != '\0') { + GST_DEBUG_OBJECT (avi, "mapped tag %u to tag %s", sub_tag, type); + + parse_tag_value (avi, taglist, type, ptr, sub_size); + +From a224a7a063ef1a53c1210c9c9bbfeb610d0d2253 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:35:12 +0300 +Subject: [PATCH 4/6] avidemux: Use correct divisor for calculating available + number of vprp field infos + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213 + +Part-of: +--- + gst/avi/gstavidemux.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 64a28d2..6a4bf7a 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -1805,7 +1805,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element, + + /* size checking */ + /* calculate fields based on size */ +- k = (size - G_STRUCT_OFFSET (gst_riff_vprp, field_info)) / vprp->fields; ++ k = (size - G_STRUCT_OFFSET (gst_riff_vprp, ++ field_info)) / sizeof (vprp->field_info[0]); + if (vprp->fields > k) { + GST_WARNING_OBJECT (element, + "vprp header indicated %d fields, only %d available", vprp->fields, k); + +From 6b063d86c99298cb8901a4134b82f7bcc84fa6a9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 13:22:04 +0300 +Subject: [PATCH 5/6] avidemux: Avoid integer overflow in bounds checks when + parsing the index + +Part-of: +--- + gst/avi/gstavidemux.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 6a4bf7a..20fd207 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -1280,8 +1280,13 @@ gst_avi_demux_parse_superindex (GstAviDemux * avi, + + indexes = g_new (guint64, num + 1); + for (i = 0; i < num; i++) { +- if (size < 24 + bpe * (i + 1)) ++ gsize required_size; ++ ++ if (!g_size_checked_mul (&required_size, bpe, i + 1)) ++ break; ++ if (size - 24 < required_size) + break; ++ + indexes[i] = GST_READ_UINT64_LE (&data[24 + bpe * i]); + GST_DEBUG_OBJECT (avi, "index %d at %" G_GUINT64_FORMAT, i, indexes[i]); + } +@@ -1568,8 +1573,11 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream, + + for (i = 0; i < num; i++) { + GstAviIndexEntry entry; ++ gsize required_size; + +- if (map.size < 24 + bpe * (i + 1)) ++ if (!g_size_checked_mul (&required_size, bpe, i + 1)) ++ break; ++ if (map.size - 24 < required_size) + break; + + /* fill in offset and size. offset contains the keyframe flag in the + +From a6ac7c3a64bce23d504f0b62313120ae1bfb08e2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 13:22:38 +0300 +Subject: [PATCH 6/6] avidemux: Don't read a subindex with too many items + +Part-of: +--- + gst/avi/gstavidemux.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 20fd207..4d3f608 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -1569,6 +1569,10 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream, + if (num == 0) + goto empty_index; + ++ /* this can't work out well ... */ ++ if (num > G_MAXUINT32 >> 1) ++ goto invalid_params; ++ + GST_INFO_OBJECT (avi, "Parsing subindex, nr_entries = %6d", num); + + for (i = 0; i < num; i++) { +@@ -1620,6 +1624,11 @@ not_implemented: + gst_buffer_unref (buf); + return FALSE; + } ++invalid_params: ++ { ++ GST_ERROR_OBJECT (avi, "invalid subindex parameters (num = %d)", num); ++ goto done; /* continue */ ++ } + empty_index: + { + GST_DEBUG_OBJECT (avi, "the index is empty"); diff --git a/gstreamer1-plugins-good.spec b/gstreamer1-plugins-good.spec index bc94f67..168bc8c 100644 --- a/gstreamer1-plugins-good.spec +++ b/gstreamer1-plugins-good.spec @@ -15,7 +15,7 @@ Name: gstreamer1-plugins-good Version: 1.16.1 -Release: 7%{?gitcommit:.git%{shortcommit}}%{?dist} +Release: 7%{?gitcommit:.git%{shortcommit}}%{?dist}.1 Summary: GStreamer plugins with good code and licensing License: LGPLv2+ @@ -42,6 +42,9 @@ Patch9: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch # https://issues.redhat.com/browse/RHEL-184473 # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811 Patch10: gstreamer1-plugins-good-1.16.1-CVE-2026-53705.patch +# https://issues.redhat.com/browse/RHEL-239068 +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231 +Patch11: gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch BuildRequires: gcc BuildRequires: gcc-c++ @@ -186,6 +189,7 @@ to be installed. %patch8 -p1 %patch9 -p1 %patch10 -p1 +%patch11 -p1 %build %configure --disable-silent-rules --disable-fatal-warnings \ @@ -370,6 +374,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';' %changelog +* Thu Aug 13 2026 RHEL Packaging Agent - 1.16.1-7.1 +- Fix multiple security issues in AVI demuxer (CVE-2026-73433) + Resolves: RHEL-239068 + * Fri Jun 19 2026 RHEL Packaging Agent - 1.16.1-7 - Fix integer overflow vulnerabilities in wavpackdec (CVE-2026-53705) Resolves: RHEL-184473