rpms/gstreamer1-plugins-good
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-5056: bounds checks in qtdemux uncompressed video

Browse Source 
Backport upstream fix (commit f9567e3e26c9, MR !11242) for
CVE-2026-5056 (ZDI-CAN-29392). The patch adds integer overflow
and bounds checks to uncompressed video (uncv) handling in
qtdemux.c, including upper bounds on cmpd and uncC component
counts, validation of num_components range, component_index
bounds checking, and a guard against GST_VIDEO_FORMAT_UNKNOWN
before using the format.

CVE: CVE-2026-5056
Upstream patches:
 - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11242.patch
Resolves: RHEL-222332

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-11 14:45:58 +00:00
parent bf45d4c419
commit 53fb8e1fe5
2 changed files with 104 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

97
gstreamer1-plugins-good-1.26.7-CVE-2026-5056.patch Normal file
View File

@ -0,0 +1,97 @@
From f54d63a5b1844fd8c404687b13af8e9c37df9825 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Fri, 13 Mar 2026 11:56:45 +0200
Subject: [PATCH] qtdemux: Add various integer overflow and bounds checks to
uncompressed video handling
Fixes ZDI-CAN-29392
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4963
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11242>
---
.../gst-plugins-good/gst/isomp4/qtdemux.c | 37 ++++++++++++++++---
1 file changed, 32 insertions(+), 5 deletions(-)
diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
index b5669275f6..92c61787f2 100644
--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
@@ -12121,6 +12121,14 @@ qtdemux_parse_cmpd (GstQTDemux * qtdemux, GstByteReader * reader,
cmpd->component_count = gst_byte_reader_get_uint32_be_unchecked (reader);
+ /* Let's use 16 as a upper bound here for now to avoid overflows and
+ * allocating lots of memory */
+ if (cmpd->component_count > 16) {
+ GST_ERROR_OBJECT (qtdemux, "Unsupported number of cmpd components %u",
+ cmpd->component_count);
+ goto error;
+ }
+
guint32 minimum_size = cmpd->component_count * 2 + 4; // assuming type_uris are not used
if (gst_byte_reader_get_size (reader) < minimum_size) {
GST_ERROR_OBJECT (qtdemux, "cmpd size is too short");
@@ -12179,6 +12187,14 @@ qtdemux_parse_uncC (GstQTDemux * qtdemux, GstByteReader * reader,
goto error;
}
+ /* Let's use 16 as a upper bound here for now to avoid overflows and
+ * allocating lots of memory */
+ if (uncC->component_count > 16) {
+ GST_ERROR_OBJECT (qtdemux, "Unsupported number of uncC components %u",
+ uncC->component_count);
+ goto error;
+ }
+
guint32 expected_size = uncC->component_count * 5 + 36;
if (gst_byte_reader_get_size (reader) != expected_size) {
GST_ERROR_OBJECT (qtdemux, "uncC size is incorrect");
@@ -12432,7 +12448,6 @@ qtdemux_get_format_from_uncv (GstQTDemux * qtdemux,
guint32 num_components = uncC->component_count;
guint16 component_types[4];
-
if (uncC->version == 1) {
// Determine format with profile
// The only permitted profiles for version 1 are `rgb3`, `rgba`, and `abgr`
@@ -12460,6 +12475,11 @@ qtdemux_get_format_from_uncv (GstQTDemux * qtdemux,
goto unsupported_feature;
}
+ if (num_components > 4 || num_components == 0) {
+ GST_WARNING_OBJECT (qtdemux,
+ "Unsupported number of components for uncC: %u", num_components);
+ goto unsupported_feature;
+ }
/* Assert that components are similar */
UncompressedFrameConfigComponent *first_comp = &uncC->components[0];
@@ -12501,6 +12521,11 @@ qtdemux_get_format_from_uncv (GstQTDemux * qtdemux,
// Get Component Types
for (guint32 i = 0; i < num_components; i++) {
guint16 component_index = uncC->components[i].index;
+ if (component_index >= cmpd->component_count) {
+ GST_WARNING_OBJECT (qtdemux,
+ "Invalid component index %u for component %u", component_index, i);
+ goto unsupported_feature;
+ }
component_types[i] = cmpd->types[component_index];
}
@@ -18919,10 +18944,12 @@ qtdemux_video_caps (GstQTDemux * qtdemux, QtDemuxStream * stream,
}
format = qtdemux_get_format_from_uncv (qtdemux, &uncC, &cmpd);
- gst_video_info_set_format (&stream->pre_info, format, entry->width,
- entry->height);
- qtdemux_set_info_from_uncv (qtdemux, entry, &uncC, &stream->pre_info);
- stream->alignment = 32;
+ if (format != GST_VIDEO_FORMAT_UNKNOWN) {
+ gst_video_info_set_format (&stream->pre_info, format, entry->width,
+ entry->height);
+ qtdemux_set_info_from_uncv (qtdemux, entry, &uncC, &stream->pre_info);
+ stream->alignment = 32;
+ }
/* Free Memory */
qtdemux_clear_uncC (&uncC);

8
gstreamer1-plugins-good.spec
View File

@ -35,7 +35,7 @@
Name: gstreamer1-plugins-good
Version: 1.26.7
Release: 4%{?dist}
Release: 5%{?dist}
Summary: GStreamer plugins with good code and licensing
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
@ -60,6 +60,8 @@ Patch: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-53705.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-18649.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11242
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-5056.patch
BuildRequires: meson >= 0.48.0
BuildRequires: gcc
@ -380,6 +382,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
%changelog
* Tue Aug 11 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-5
- Fix CVE-2026-5056: bounds checks in qtdemux uncompressed video
Resolves: RHEL-222332
* Tue Aug 11 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-4
- Fix RTP H264/H265 depayloader fragmentation unit handling (CVE-2026-18649)
Resolves: RHEL-224159