import Oracle_OSS gstreamer1-plugins-good-1.22.12-7.el9_8.4
This commit is contained in:
AlmaLinux RelEng Bot
parent
c54a738afe
commit
61e8ee6853
66
SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch
Normal file
66
SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch
Normal file
@ -0,0 +1,66 @@
|
||||
From 40b14bf40e761a85b067b5c0b2946651f2a22dd4 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Tue, 14 Jul 2026 12:00:34 +0300
|
||||
Subject: [PATCH] avidemux: Make sure enough data is available when parsing
|
||||
FUJIFILM strd
|
||||
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
|
||||
---
|
||||
.../gst-plugins-good/gst/avi/gstavidemux.c | 23 +++++++++++--------
|
||||
1 file changed, 13 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
|
||||
index 0d18a6495c..5d7ed2edd6 100644
|
||||
--- a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
|
||||
+++ b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
|
||||
@@ -3828,13 +3828,13 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
|
||||
|
||||
ptr += 98;
|
||||
left -= 98;
|
||||
- if (!memcmp (ptr, "FUJIFILM", 8)) {
|
||||
+ if (left >= 10 && !memcmp (ptr, "FUJIFILM", 8)) {
|
||||
GST_MEMDUMP_OBJECT (avi, "fujifim tag", ptr, 48);
|
||||
|
||||
ptr += 10;
|
||||
left -= 10;
|
||||
sub_size = 0;
|
||||
- while (ptr[sub_size] && sub_size < left)
|
||||
+ while (sub_size < left && ptr[sub_size])
|
||||
sub_size++;
|
||||
|
||||
if (avi->globaltags == NULL)
|
||||
@@ -3845,21 +3845,24 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
|
||||
parse_tag_value (avi, avi->globaltags, GST_TAG_DEVICE_MODEL, ptr,
|
||||
sub_size);
|
||||
|
||||
- while (ptr[sub_size] == '\0' && sub_size < left)
|
||||
+ while (sub_size < left && ptr[sub_size] == '\0')
|
||||
sub_size++;
|
||||
|
||||
ptr += sub_size;
|
||||
left -= sub_size;
|
||||
sub_size = 0;
|
||||
- while (ptr[sub_size] && sub_size < left)
|
||||
+ while (sub_size < left && ptr[sub_size])
|
||||
sub_size++;
|
||||
- if (ptr[4] == ':')
|
||||
- ptr[4] = '-';
|
||||
- if (ptr[7] == ':')
|
||||
- ptr[7] = '-';
|
||||
|
||||
- parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
|
||||
- sub_size);
|
||||
+ if (sub_size >= 8) {
|
||||
+ if (ptr[4] == ':')
|
||||
+ ptr[4] = '-';
|
||||
+ if (ptr[7] == ':')
|
||||
+ ptr[7] = '-';
|
||||
+
|
||||
+ parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
|
||||
+ sub_size);
|
||||
+ }
|
||||
}
|
||||
}
|
||||
}
|
||||
27
SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch
Normal file
27
SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch
Normal file
@ -0,0 +1,27 @@
|
||||
From ee1e2423941f1798e4f5031388c3e82c03edca3d Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Tue, 14 Jul 2026 12:35:12 +0300
|
||||
Subject: [PATCH] avidemux: Use correct divisor for calculating available
|
||||
number of vprp field infos
|
||||
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
|
||||
---
|
||||
gst/avi/gstavidemux.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
|
||||
index 0d18a64..379c654 100644
|
||||
--- a/gst/avi/gstavidemux.c
|
||||
+++ b/gst/avi/gstavidemux.c
|
||||
@@ -1808,7 +1808,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element,
|
||||
|
||||
/* size checking */
|
||||
/* calculate fields based on size */
|
||||
- k = (size - G_STRUCT_OFFSET (gst_riff_vprp, field_info)) / vprp->fields;
|
||||
+ k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
|
||||
+ field_info)) / sizeof (vprp->field_info[0]);
|
||||
if (vprp->fields > k) {
|
||||
GST_WARNING_OBJECT (element,
|
||||
"vprp header indicated %d fields, only %d available", vprp->fields, k);
|
||||
@ -28,7 +28,7 @@
|
||||
|
||||
Name: gstreamer1-plugins-good
|
||||
Version: 1.22.12
|
||||
Release: 7%{?dist}.2
|
||||
Release: 7%{?dist}.4
|
||||
Summary: GStreamer plugins with good code and licensing
|
||||
|
||||
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
|
||||
@ -80,6 +80,10 @@ Patch0029: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
|
||||
Patch0030: 0029-wavpackdec-Avoid-integer-overflow-when-calculating-.patch
|
||||
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234
|
||||
Patch0031: gstreamer1-plugins-good-1.22.12-CVE-2026-18649.patch
|
||||
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231
|
||||
Patch0032: gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch
|
||||
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231
|
||||
Patch0033: gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch
|
||||
|
||||
BuildRequires: meson >= 0.48.0
|
||||
BuildRequires: gcc
|
||||
@ -270,6 +274,8 @@ to be installed.
|
||||
%patch -P 0029 -p3
|
||||
%patch -P 0030 -p3
|
||||
%patch -P 0031 -p3
|
||||
%patch -P 0032 -p3
|
||||
%patch -P 0033 -p1
|
||||
|
||||
%build
|
||||
%meson \
|
||||
@ -420,6 +426,15 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
|
||||
|
||||
|
||||
%changelog
|
||||
* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-7.4
|
||||
- Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling
|
||||
Resolves: RHEL-239042
|
||||
|
||||
* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-7.3
|
||||
- Fix CVE-2026-73433: add bounds checks to FUJIFILM strd metadata
|
||||
parsing in avidemux to prevent unsigned integer underflow
|
||||
Resolves: RHEL-239060
|
||||
|
||||
* Fri Aug 07 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-7.2
|
||||
- Fix CVE-2026-18649: limit fragmentation unit size in RTP H.264/H.265
|
||||
depayloaders to prevent excessive memory usage
|
||||
|
||||
Loading…
Reference in New Issue
Block a user