diff --git a/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch b/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch new file mode 100644 index 0000000..beeadbb --- /dev/null +++ b/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch @@ -0,0 +1,66 @@ +From 40b14bf40e761a85b067b5c0b2946651f2a22dd4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:00:34 +0300 +Subject: [PATCH] avidemux: Make sure enough data is available when parsing + FUJIFILM strd + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213 + +Part-of: +--- + .../gst-plugins-good/gst/avi/gstavidemux.c | 23 +++++++++++-------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c +index 0d18a6495c..5d7ed2edd6 100644 +--- a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c ++++ b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c +@@ -3828,13 +3828,13 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf) + + ptr += 98; + left -= 98; +- if (!memcmp (ptr, "FUJIFILM", 8)) { ++ if (left >= 10 && !memcmp (ptr, "FUJIFILM", 8)) { + GST_MEMDUMP_OBJECT (avi, "fujifim tag", ptr, 48); + + ptr += 10; + left -= 10; + sub_size = 0; +- while (ptr[sub_size] && sub_size < left) ++ while (sub_size < left && ptr[sub_size]) + sub_size++; + + if (avi->globaltags == NULL) +@@ -3845,21 +3845,24 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf) + parse_tag_value (avi, avi->globaltags, GST_TAG_DEVICE_MODEL, ptr, + sub_size); + +- while (ptr[sub_size] == '\0' && sub_size < left) ++ while (sub_size < left && ptr[sub_size] == '\0') + sub_size++; + + ptr += sub_size; + left -= sub_size; + sub_size = 0; +- while (ptr[sub_size] && sub_size < left) ++ while (sub_size < left && ptr[sub_size]) + sub_size++; +- if (ptr[4] == ':') +- ptr[4] = '-'; +- if (ptr[7] == ':') +- ptr[7] = '-'; + +- parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr, +- sub_size); ++ if (sub_size >= 8) { ++ if (ptr[4] == ':') ++ ptr[4] = '-'; ++ if (ptr[7] == ':') ++ ptr[7] = '-'; ++ ++ parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr, ++ sub_size); ++ } + } + } + } diff --git a/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch b/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch new file mode 100644 index 0000000..1c7c0f1 --- /dev/null +++ b/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch @@ -0,0 +1,27 @@ +From ee1e2423941f1798e4f5031388c3e82c03edca3d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:35:12 +0300 +Subject: [PATCH] avidemux: Use correct divisor for calculating available + number of vprp field infos + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213 + +Part-of: +--- + gst/avi/gstavidemux.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 0d18a64..379c654 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -1808,7 +1808,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element, + + /* size checking */ + /* calculate fields based on size */ +- k = (size - G_STRUCT_OFFSET (gst_riff_vprp, field_info)) / vprp->fields; ++ k = (size - G_STRUCT_OFFSET (gst_riff_vprp, ++ field_info)) / sizeof (vprp->field_info[0]); + if (vprp->fields > k) { + GST_WARNING_OBJECT (element, + "vprp header indicated %d fields, only %d available", vprp->fields, k); diff --git a/SPECS/gstreamer1-plugins-good.spec b/SPECS/gstreamer1-plugins-good.spec index 747124c..ec4e314 100644 --- a/SPECS/gstreamer1-plugins-good.spec +++ b/SPECS/gstreamer1-plugins-good.spec @@ -28,7 +28,7 @@ Name: gstreamer1-plugins-good Version: 1.22.12 -Release: 7%{?dist}.2 +Release: 7%{?dist}.4 Summary: GStreamer plugins with good code and licensing License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0 @@ -80,6 +80,10 @@ Patch0029: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch Patch0030: 0029-wavpackdec-Avoid-integer-overflow-when-calculating-.patch # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234 Patch0031: gstreamer1-plugins-good-1.22.12-CVE-2026-18649.patch +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231 +Patch0032: gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231 +Patch0033: gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch BuildRequires: meson >= 0.48.0 BuildRequires: gcc @@ -270,6 +274,8 @@ to be installed. %patch -P 0029 -p3 %patch -P 0030 -p3 %patch -P 0031 -p3 +%patch -P 0032 -p3 +%patch -P 0033 -p1 %build %meson \ @@ -420,6 +426,15 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';' %changelog +* Thu Aug 13 2026 RHEL Packaging Agent - 1.22.12-7.4 +- Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling + Resolves: RHEL-239042 + +* Thu Aug 13 2026 RHEL Packaging Agent - 1.22.12-7.3 +- Fix CVE-2026-73433: add bounds checks to FUJIFILM strd metadata + parsing in avidemux to prevent unsigned integer underflow + Resolves: RHEL-239060 + * Fri Aug 07 2026 RHEL Packaging Agent - 1.22.12-7.2 - Fix CVE-2026-18649: limit fragmentation unit size in RTP H.264/H.265 depayloaders to prevent excessive memory usage