diff --git a/0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch b/0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch new file mode 100644 index 0000000..00bcde6 --- /dev/null +++ b/0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch @@ -0,0 +1,107 @@ +From 88bc030b7fd223c7e0c4d17995aff06f5a5a5a3f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim-Philipp=20M=C3=BCller?= +Date: Sun, 8 Feb 2026 16:01:21 +0000 +Subject: [PATCH] rtpqdm2depay: error out if anyone tries to use this element + +Forbid use of this element and comment out all processing code. + +There is no plausible reason this code should ever be executed in 2026 +seeing that this was a streaming format produced by Darwin Streaming Server +ca 2009 which hasn't been in active use for well over a decade. + +We simply error out for now as defensive measure and will remove the +element entirely in the next release cycle. + +The processing functions are hairy and rather tedious to fix without +at least some sample stream at hand. + +If anyone actually does have a legitimate need for this element and +can provide a sample streams, we will happily implement a depayloader +in Rust. + +Fixes ZDI-CAN-28850, ZDI-CAN-28851, ZDI-CAN-28851, ZDI-CAN-28850, GST-SA-2026-0008. + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4903 +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4890 + +Part-of: +--- + .../gst-plugins-good/gst/rtp/gstrtpqdmdepay.c | 25 ++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c +index 3edfb46301..1d69fc2e1c 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c +@@ -57,11 +57,13 @@ G_DEFINE_TYPE (GstRtpQDM2Depay, gst_rtp_qdm2_depay, + GST_ELEMENT_REGISTER_DEFINE_WITH_CODE (rtpqdm2depay, "rtpqdm2depay", + GST_RANK_SECONDARY, GST_TYPE_RTP_QDM2_DEPAY, _do_init); + ++#if 0 + static const guint8 headheader[20] = { + 0x0, 0x0, 0x0, 0xc, 0x66, 0x72, 0x6d, 0x61, + 0x51, 0x44, 0x4d, 0x32, 0x0, 0x0, 0x0, 0x24, + 0x51, 0x44, 0x43, 0x41 + }; ++#endif + + static void gst_rtp_qdm2_depay_finalize (GObject * object); + +@@ -138,6 +140,7 @@ gst_rtp_qdm2_depay_setcaps (GstRTPBaseDepayload * filter, GstCaps * caps) + return TRUE; + } + ++#if 0 + static void + flush_data (GstRtpQDM2Depay * depay) + { +@@ -230,10 +233,26 @@ add_packet (GstRtpQDM2Depay * depay, guint32 pid, guint32 len, guint8 * data) + memcpy (packet->data + packet->offs, data, len); + packet->offs += len; + } ++#endif + + static GstBuffer * + gst_rtp_qdm2_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + { ++ /* There is no plausible reason this code should ever be executed in 2026 ++ * seeing that this was a streaming format produced by Darwin Streaming Server ++ * ca 2009 which hasn't been in active use for well over a decade. ++ * ++ * We simply return here as defensive measure. ++ * ++ * We post an error message in the state change function, so this processing ++ * function should never be reached, we just ifdef the code out for clarity. ++ * ++ * If anyone actually does have a legitimate need for this and can provide ++ * sample streams, we will happily implement a depayloader in Rust. ++ */ ++ return NULL; ++ ++#if 0 + GstRtpQDM2Depay *rtpqdm2depay; + GstBuffer *outbuf = NULL; + guint16 seq; +@@ -378,6 +397,7 @@ bad_packet: + (NULL), ("Packet was too short")); + return NULL; + } ++#endif + } + + static GstStateChangeReturn +@@ -391,7 +411,10 @@ gst_rtp_qdm2_depay_change_state (GstElement * element, + + switch (transition) { + case GST_STATE_CHANGE_NULL_TO_READY: +- break; ++ GST_ELEMENT_ERROR (rtpqdm2depay, STREAM, DECODE, ++ ("This element should not be used."), ++ ("Please report an issue if you encounter this message.")); ++ return GST_STATE_CHANGE_FAILURE; + case GST_STATE_CHANGE_READY_TO_PAUSED: + gst_adapter_clear (rtpqdm2depay->adapter); + break; +-- +2.53.0 + diff --git a/gstreamer1-plugins-good.spec b/gstreamer1-plugins-good.spec index fca0b5b..33d51f2 100644 --- a/gstreamer1-plugins-good.spec +++ b/gstreamer1-plugins-good.spec @@ -28,7 +28,7 @@ Name: gstreamer1-plugins-good Version: 1.22.12 -Release: 4%{?dist} +Release: 5%{?dist} Summary: GStreamer plugins with good code and licensing License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0 @@ -76,6 +76,7 @@ Patch0025: 0025-qtdemux-Actually-handle-errors-returns-from-various-.patch Patch0026: 0026-qtdemux-Check-for-invalid-atom-length-when-extractin.patch Patch0027: 0027-qtdemux-Add-size-check-for-parsing-SMI-SEQH-atom.patch Patch0028: 0028-jpegdec-Directly-error-out-on-negotiation-failures.patch +Patch0029: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch BuildRequires: meson >= 0.48.0 BuildRequires: gcc @@ -263,6 +264,7 @@ to be installed. %patch -P 0026 -p3 %patch -P 0027 -p3 %patch -P 0028 -p3 +%patch -P 0029 -p3 %build %meson \ @@ -413,6 +415,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';' %changelog +* Fri Mar 27 2026 Wim Taymans - 1.22.12-5 +- Apply patches for CVE-2026-3083, CVE-2026-3085 + Resolves: RHEL-156272, RHEL-156273 + * Fri Dec 13 2024 Wim Taymans - 1.22.12-4 - Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540 CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546,