Apply patches for CVE-2026-3083, CVE-2026-3085
Resolves: RHEL-156272, RHEL-156273
This commit is contained in:
Wim Taymans
parent
7375f9916a
commit
3a07deba8e
107
0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
Normal file
107
0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
Normal file
@ -0,0 +1,107 @@
|
||||
From 88bc030b7fd223c7e0c4d17995aff06f5a5a5a3f Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Tim-Philipp=20M=C3=BCller?= <tim@centricular.com>
|
||||
Date: Sun, 8 Feb 2026 16:01:21 +0000
|
||||
Subject: [PATCH] rtpqdm2depay: error out if anyone tries to use this element
|
||||
|
||||
Forbid use of this element and comment out all processing code.
|
||||
|
||||
There is no plausible reason this code should ever be executed in 2026
|
||||
seeing that this was a streaming format produced by Darwin Streaming Server
|
||||
ca 2009 which hasn't been in active use for well over a decade.
|
||||
|
||||
We simply error out for now as defensive measure and will remove the
|
||||
element entirely in the next release cycle.
|
||||
|
||||
The processing functions are hairy and rather tedious to fix without
|
||||
at least some sample stream at hand.
|
||||
|
||||
If anyone actually does have a legitimate need for this element and
|
||||
can provide a sample streams, we will happily implement a depayloader
|
||||
in Rust.
|
||||
|
||||
Fixes ZDI-CAN-28850, ZDI-CAN-28851, ZDI-CAN-28851, ZDI-CAN-28850, GST-SA-2026-0008.
|
||||
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4903
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4890
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/10886>
|
||||
---
|
||||
.../gst-plugins-good/gst/rtp/gstrtpqdmdepay.c | 25 ++++++++++++++++++-
|
||||
1 file changed, 24 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c
|
||||
index 3edfb46301..1d69fc2e1c 100644
|
||||
--- a/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c
|
||||
+++ b/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c
|
||||
@@ -57,11 +57,13 @@ G_DEFINE_TYPE (GstRtpQDM2Depay, gst_rtp_qdm2_depay,
|
||||
GST_ELEMENT_REGISTER_DEFINE_WITH_CODE (rtpqdm2depay, "rtpqdm2depay",
|
||||
GST_RANK_SECONDARY, GST_TYPE_RTP_QDM2_DEPAY, _do_init);
|
||||
|
||||
+#if 0
|
||||
static const guint8 headheader[20] = {
|
||||
0x0, 0x0, 0x0, 0xc, 0x66, 0x72, 0x6d, 0x61,
|
||||
0x51, 0x44, 0x4d, 0x32, 0x0, 0x0, 0x0, 0x24,
|
||||
0x51, 0x44, 0x43, 0x41
|
||||
};
|
||||
+#endif
|
||||
|
||||
static void gst_rtp_qdm2_depay_finalize (GObject * object);
|
||||
|
||||
@@ -138,6 +140,7 @@ gst_rtp_qdm2_depay_setcaps (GstRTPBaseDepayload * filter, GstCaps * caps)
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
+#if 0
|
||||
static void
|
||||
flush_data (GstRtpQDM2Depay * depay)
|
||||
{
|
||||
@@ -230,10 +233,26 @@ add_packet (GstRtpQDM2Depay * depay, guint32 pid, guint32 len, guint8 * data)
|
||||
memcpy (packet->data + packet->offs, data, len);
|
||||
packet->offs += len;
|
||||
}
|
||||
+#endif
|
||||
|
||||
static GstBuffer *
|
||||
gst_rtp_qdm2_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
|
||||
{
|
||||
+ /* There is no plausible reason this code should ever be executed in 2026
|
||||
+ * seeing that this was a streaming format produced by Darwin Streaming Server
|
||||
+ * ca 2009 which hasn't been in active use for well over a decade.
|
||||
+ *
|
||||
+ * We simply return here as defensive measure.
|
||||
+ *
|
||||
+ * We post an error message in the state change function, so this processing
|
||||
+ * function should never be reached, we just ifdef the code out for clarity.
|
||||
+ *
|
||||
+ * If anyone actually does have a legitimate need for this and can provide
|
||||
+ * sample streams, we will happily implement a depayloader in Rust.
|
||||
+ */
|
||||
+ return NULL;
|
||||
+
|
||||
+#if 0
|
||||
GstRtpQDM2Depay *rtpqdm2depay;
|
||||
GstBuffer *outbuf = NULL;
|
||||
guint16 seq;
|
||||
@@ -378,6 +397,7 @@ bad_packet:
|
||||
(NULL), ("Packet was too short"));
|
||||
return NULL;
|
||||
}
|
||||
+#endif
|
||||
}
|
||||
|
||||
static GstStateChangeReturn
|
||||
@@ -391,7 +411,10 @@ gst_rtp_qdm2_depay_change_state (GstElement * element,
|
||||
|
||||
switch (transition) {
|
||||
case GST_STATE_CHANGE_NULL_TO_READY:
|
||||
- break;
|
||||
+ GST_ELEMENT_ERROR (rtpqdm2depay, STREAM, DECODE,
|
||||
+ ("This element should not be used."),
|
||||
+ ("Please report an issue if you encounter this message."));
|
||||
+ return GST_STATE_CHANGE_FAILURE;
|
||||
case GST_STATE_CHANGE_READY_TO_PAUSED:
|
||||
gst_adapter_clear (rtpqdm2depay->adapter);
|
||||
break;
|
||||
--
|
||||
2.53.0
|
||||
|
||||
@ -28,7 +28,7 @@
|
||||
|
||||
Name: gstreamer1-plugins-good
|
||||
Version: 1.22.12
|
||||
Release: 4%{?dist}
|
||||
Release: 5%{?dist}
|
||||
Summary: GStreamer plugins with good code and licensing
|
||||
|
||||
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
|
||||
@ -76,6 +76,7 @@ Patch0025: 0025-qtdemux-Actually-handle-errors-returns-from-various-.patch
|
||||
Patch0026: 0026-qtdemux-Check-for-invalid-atom-length-when-extractin.patch
|
||||
Patch0027: 0027-qtdemux-Add-size-check-for-parsing-SMI-SEQH-atom.patch
|
||||
Patch0028: 0028-jpegdec-Directly-error-out-on-negotiation-failures.patch
|
||||
Patch0029: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
|
||||
|
||||
BuildRequires: meson >= 0.48.0
|
||||
BuildRequires: gcc
|
||||
@ -263,6 +264,7 @@ to be installed.
|
||||
%patch -P 0026 -p3
|
||||
%patch -P 0027 -p3
|
||||
%patch -P 0028 -p3
|
||||
%patch -P 0029 -p3
|
||||
|
||||
%build
|
||||
%meson \
|
||||
@ -413,6 +415,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
|
||||
|
||||
|
||||
%changelog
|
||||
* Fri Mar 27 2026 Wim Taymans <wtaymans@redhat.com> - 1.22.12-5
|
||||
- Apply patches for CVE-2026-3083, CVE-2026-3085
|
||||
Resolves: RHEL-156272, RHEL-156273
|
||||
|
||||
* Fri Dec 13 2024 Wim Taymans <wtaymans@redhat.com> - 1.22.12-4
|
||||
- Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540
|
||||
CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546,
|
||||
|
||||
Loading…
Reference in New Issue
Block a user