diff --git a/gstreamer1-plugins-good-1.22.12-CVE-2026-18298.patch b/gstreamer1-plugins-good-1.22.12-CVE-2026-18298.patch new file mode 100644 index 0000000..0a24b61 --- /dev/null +++ b/gstreamer1-plugins-good-1.22.12-CVE-2026-18298.patch @@ -0,0 +1,113 @@ +From f6000a3ca1d340fd05724089c4dff21439e4a1af Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Fri, 19 Jun 2026 13:15:02 +0300 +Subject: [PATCH 1/2] gdkpixbufdec: Drop rank to NONE + +gdk-pixbuf is not mean to be used on untrusted inputs so let's not ask for +problems here. + +For the common image formats we have specialized elements with higher ranks and +for a proper replacement follow this issue: + https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/issues/764 + +Part-of: +--- + subprojects/gst-plugins-good/docs/gst_plugins_cache.json | 2 +- + subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c | 3 +-- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/subprojects/gst-plugins-good/docs/gst_plugins_cache.json b/subprojects/gst-plugins-good/docs/gst_plugins_cache.json +index 54633e6168..821ec5aa7f 100644 +--- a/subprojects/gst-plugins-good/docs/gst_plugins_cache.json ++++ b/subprojects/gst-plugins-good/docs/gst_plugins_cache.json +@@ -7160,7 +7160,7 @@ + "presence": "always" + } + }, +- "rank": "secondary" ++ "rank": "none" + }, + "gdkpixbufoverlay": { + "author": "Tim-Philipp Müller ", +diff --git a/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c b/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c +index de5f054964..3279e48753 100644 +--- a/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c ++++ b/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c +@@ -76,8 +76,7 @@ static gboolean gst_gdk_pixbuf_dec_sink_event (GstPad * pad, GstObject * parent, + #define gst_gdk_pixbuf_dec_parent_class parent_class + G_DEFINE_TYPE (GstGdkPixbufDec, gst_gdk_pixbuf_dec, GST_TYPE_ELEMENT); + GST_ELEMENT_REGISTER_DEFINE_WITH_CODE (gdkpixbufdec, "gdkpixbufdec", +- GST_RANK_SECONDARY, GST_TYPE_GDK_PIXBUF_DEC, +- gdk_pixbuf_element_init (plugin)); ++ GST_RANK_NONE, GST_TYPE_GDK_PIXBUF_DEC, gdk_pixbuf_element_init (plugin)); + + static gboolean + gst_gdk_pixbuf_dec_sink_setcaps (GstGdkPixbufDec * filter, GstCaps * caps) + +From f7835c65f029139dbdc7fb6b801e10326556c7e9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Fri, 19 Jun 2026 13:20:04 +0300 +Subject: [PATCH 2/2] gdkpixbufdec: Handle format and resolution changes + correctly + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5121 + +Part-of: +--- + .../ext/gdk_pixbuf/gstgdkpixbufdec.c | 31 ++++++++++--------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +diff --git a/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c b/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c +index 3279e48753..103b0bdd9c 100644 +--- a/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c ++++ b/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c +@@ -292,6 +292,7 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter) + gint width, height; + gint n_channels; + GstVideoFrame frame; ++ GstVideoFormat fmt; + + pixbuf = gdk_pixbuf_loader_get_pixbuf (filter->pixbuf_loader); + if (pixbuf == NULL) +@@ -300,26 +301,26 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter) + width = gdk_pixbuf_get_width (pixbuf); + height = gdk_pixbuf_get_height (pixbuf); + +- if (GST_VIDEO_INFO_FORMAT (&filter->info) == GST_VIDEO_FORMAT_UNKNOWN) { ++ n_channels = gdk_pixbuf_get_n_channels (pixbuf); ++ switch (n_channels) { ++ case 3: ++ fmt = GST_VIDEO_FORMAT_RGB; ++ break; ++ case 4: ++ fmt = GST_VIDEO_FORMAT_RGBA; ++ break; ++ default: ++ goto channels_not_supported; ++ } ++ ++ if (GST_VIDEO_INFO_FORMAT (&filter->info) != fmt || ++ GST_VIDEO_INFO_WIDTH (&filter->info) != width || ++ GST_VIDEO_INFO_HEIGHT (&filter->info) != height) { + GstVideoInfo info; +- GstVideoFormat fmt; + GList *l; + + GST_DEBUG ("Set size to %dx%d", width, height); + +- n_channels = gdk_pixbuf_get_n_channels (pixbuf); +- switch (n_channels) { +- case 3: +- fmt = GST_VIDEO_FORMAT_RGB; +- break; +- case 4: +- fmt = GST_VIDEO_FORMAT_RGBA; +- break; +- default: +- goto channels_not_supported; +- } +- +- + gst_video_info_init (&info); + if (!gst_video_info_set_format (&info, fmt, width, height)) + goto format_not_supported; diff --git a/gstreamer1-plugins-good.spec b/gstreamer1-plugins-good.spec index 365f543..143ac20 100644 --- a/gstreamer1-plugins-good.spec +++ b/gstreamer1-plugins-good.spec @@ -28,7 +28,7 @@ Name: gstreamer1-plugins-good Version: 1.22.12 -Release: 12%{?dist} +Release: 13%{?dist} Summary: GStreamer plugins with good code and licensing License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0 @@ -92,6 +92,9 @@ Patch0033: gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch # https://issues.redhat.com/browse/RHEL-246573 # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12041 Patch0034: gstreamer1-plugins-good-1.22.12-CVE-2026-18296.patch +# https://issues.redhat.com/browse/RHEL-246559 +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043 +Patch0035: gstreamer1-plugins-good-1.22.12-CVE-2026-18298.patch BuildRequires: meson >= 0.48.0 BuildRequires: gcc @@ -285,6 +288,7 @@ to be installed. %patch -P 0032 -p3 %patch -P 0033 -p3 %patch -P 0034 -p3 +%patch -P 0035 -p3 %build %meson \ @@ -435,6 +439,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';' %changelog +* Tue Aug 25 2026 RHEL Packaging Agent - 1.22.12-13 +- Fix gdkpixbufdec format and resolution change handling + (CVE-2026-18298) + * Mon Aug 24 2026 RHEL Packaging Agent - 1.22.12-12 - Fix heap buffer overflow in MOV/MP4 moov recovery tool (CVE-2026-18296)