Fix CVE-2026-18298 in gdkpixbufdec element
Backport upstream MR 12043 fix for CVE-2026-18298 in gdkpixbufdec. The patch drops gdkpixbufdec rank to NONE since gdk-pixbuf is not meant for untrusted inputs, and fixes incorrect handling of format and resolution changes by moving channel/format detection before the negotiation check and extending it to re-negotiate on any format or resolution change, not just on the first frame. CVE: CVE-2026-18298 Upstream patches: - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043.patch Resolves: RHEL-246559 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
parent
bf2b0ac341
commit
385b2c4cf7
113
gstreamer1-plugins-good-1.22.12-CVE-2026-18298.patch
Normal file
113
gstreamer1-plugins-good-1.22.12-CVE-2026-18298.patch
Normal file
@ -0,0 +1,113 @@
|
||||
From f6000a3ca1d340fd05724089c4dff21439e4a1af Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 19 Jun 2026 13:15:02 +0300
|
||||
Subject: [PATCH 1/2] gdkpixbufdec: Drop rank to NONE
|
||||
|
||||
gdk-pixbuf is not mean to be used on untrusted inputs so let's not ask for
|
||||
problems here.
|
||||
|
||||
For the common image formats we have specialized elements with higher ranks and
|
||||
for a proper replacement follow this issue:
|
||||
https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/issues/764
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043>
|
||||
---
|
||||
subprojects/gst-plugins-good/docs/gst_plugins_cache.json | 2 +-
|
||||
subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c | 3 +--
|
||||
2 files changed, 2 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/docs/gst_plugins_cache.json b/subprojects/gst-plugins-good/docs/gst_plugins_cache.json
|
||||
index 54633e6168..821ec5aa7f 100644
|
||||
--- a/subprojects/gst-plugins-good/docs/gst_plugins_cache.json
|
||||
+++ b/subprojects/gst-plugins-good/docs/gst_plugins_cache.json
|
||||
@@ -7160,7 +7160,7 @@
|
||||
"presence": "always"
|
||||
}
|
||||
},
|
||||
- "rank": "secondary"
|
||||
+ "rank": "none"
|
||||
},
|
||||
"gdkpixbufoverlay": {
|
||||
"author": "Tim-Philipp Müller <tim centricular net>",
|
||||
diff --git a/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c b/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c
|
||||
index de5f054964..3279e48753 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c
|
||||
@@ -76,8 +76,7 @@ static gboolean gst_gdk_pixbuf_dec_sink_event (GstPad * pad, GstObject * parent,
|
||||
#define gst_gdk_pixbuf_dec_parent_class parent_class
|
||||
G_DEFINE_TYPE (GstGdkPixbufDec, gst_gdk_pixbuf_dec, GST_TYPE_ELEMENT);
|
||||
GST_ELEMENT_REGISTER_DEFINE_WITH_CODE (gdkpixbufdec, "gdkpixbufdec",
|
||||
- GST_RANK_SECONDARY, GST_TYPE_GDK_PIXBUF_DEC,
|
||||
- gdk_pixbuf_element_init (plugin));
|
||||
+ GST_RANK_NONE, GST_TYPE_GDK_PIXBUF_DEC, gdk_pixbuf_element_init (plugin));
|
||||
|
||||
static gboolean
|
||||
gst_gdk_pixbuf_dec_sink_setcaps (GstGdkPixbufDec * filter, GstCaps * caps)
|
||||
|
||||
From f7835c65f029139dbdc7fb6b801e10326556c7e9 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 19 Jun 2026 13:20:04 +0300
|
||||
Subject: [PATCH 2/2] gdkpixbufdec: Handle format and resolution changes
|
||||
correctly
|
||||
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5121
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043>
|
||||
---
|
||||
.../ext/gdk_pixbuf/gstgdkpixbufdec.c | 31 ++++++++++---------
|
||||
1 file changed, 16 insertions(+), 15 deletions(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c b/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c
|
||||
index 3279e48753..103b0bdd9c 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c
|
||||
@@ -292,6 +292,7 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter)
|
||||
gint width, height;
|
||||
gint n_channels;
|
||||
GstVideoFrame frame;
|
||||
+ GstVideoFormat fmt;
|
||||
|
||||
pixbuf = gdk_pixbuf_loader_get_pixbuf (filter->pixbuf_loader);
|
||||
if (pixbuf == NULL)
|
||||
@@ -300,26 +301,26 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter)
|
||||
width = gdk_pixbuf_get_width (pixbuf);
|
||||
height = gdk_pixbuf_get_height (pixbuf);
|
||||
|
||||
- if (GST_VIDEO_INFO_FORMAT (&filter->info) == GST_VIDEO_FORMAT_UNKNOWN) {
|
||||
+ n_channels = gdk_pixbuf_get_n_channels (pixbuf);
|
||||
+ switch (n_channels) {
|
||||
+ case 3:
|
||||
+ fmt = GST_VIDEO_FORMAT_RGB;
|
||||
+ break;
|
||||
+ case 4:
|
||||
+ fmt = GST_VIDEO_FORMAT_RGBA;
|
||||
+ break;
|
||||
+ default:
|
||||
+ goto channels_not_supported;
|
||||
+ }
|
||||
+
|
||||
+ if (GST_VIDEO_INFO_FORMAT (&filter->info) != fmt ||
|
||||
+ GST_VIDEO_INFO_WIDTH (&filter->info) != width ||
|
||||
+ GST_VIDEO_INFO_HEIGHT (&filter->info) != height) {
|
||||
GstVideoInfo info;
|
||||
- GstVideoFormat fmt;
|
||||
GList *l;
|
||||
|
||||
GST_DEBUG ("Set size to %dx%d", width, height);
|
||||
|
||||
- n_channels = gdk_pixbuf_get_n_channels (pixbuf);
|
||||
- switch (n_channels) {
|
||||
- case 3:
|
||||
- fmt = GST_VIDEO_FORMAT_RGB;
|
||||
- break;
|
||||
- case 4:
|
||||
- fmt = GST_VIDEO_FORMAT_RGBA;
|
||||
- break;
|
||||
- default:
|
||||
- goto channels_not_supported;
|
||||
- }
|
||||
-
|
||||
-
|
||||
gst_video_info_init (&info);
|
||||
if (!gst_video_info_set_format (&info, fmt, width, height))
|
||||
goto format_not_supported;
|
||||
@ -28,7 +28,7 @@
|
||||
|
||||
Name: gstreamer1-plugins-good
|
||||
Version: 1.22.12
|
||||
Release: 12%{?dist}
|
||||
Release: 13%{?dist}
|
||||
Summary: GStreamer plugins with good code and licensing
|
||||
|
||||
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
|
||||
@ -92,6 +92,9 @@ Patch0033: gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch
|
||||
# https://issues.redhat.com/browse/RHEL-246573
|
||||
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12041
|
||||
Patch0034: gstreamer1-plugins-good-1.22.12-CVE-2026-18296.patch
|
||||
# https://issues.redhat.com/browse/RHEL-246559
|
||||
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043
|
||||
Patch0035: gstreamer1-plugins-good-1.22.12-CVE-2026-18298.patch
|
||||
|
||||
BuildRequires: meson >= 0.48.0
|
||||
BuildRequires: gcc
|
||||
@ -285,6 +288,7 @@ to be installed.
|
||||
%patch -P 0032 -p3
|
||||
%patch -P 0033 -p3
|
||||
%patch -P 0034 -p3
|
||||
%patch -P 0035 -p3
|
||||
|
||||
%build
|
||||
%meson \
|
||||
@ -435,6 +439,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
|
||||
|
||||
|
||||
%changelog
|
||||
* Tue Aug 25 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-13
|
||||
- Fix gdkpixbufdec format and resolution change handling
|
||||
(CVE-2026-18298)
|
||||
|
||||
* Mon Aug 24 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-12
|
||||
- Fix heap buffer overflow in MOV/MP4 moov recovery tool
|
||||
(CVE-2026-18296)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user