rpms/gstreamer1-plugins-good
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-73433: out-of-bounds reads in AVI FUJIFILM strd parsing

Browse Source 
Backport upstream commit bb8fb5a9bf15fb845863430281e4bf908aec7090
to fix CVE-2026-73433. The patch adds bounds checks in
gst_avi_demux_parse_strd() to prevent buffer underflows when
parsing FUJIFILM metadata in AVI files, ensuring sufficient
data is available before memory access and correcting loop
condition ordering.

CVE: CVE-2026-73433
Upstream patches:
 - bb8fb5a9bf.patch
Resolves: RHEL-239066

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-17 08:35:15 +00:00
parent 67028be52b
commit 81bea5fd9a
2 changed files with 75 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch Normal file
View File

@ -0,0 +1,66 @@
From 4bf12dcb5c2722e35e4a5c4f70a94cb833b72ed6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 12:00:34 +0300
Subject: [PATCH] avidemux: Make sure enough data is available when parsing
FUJIFILM strd
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
.../gst-plugins-good/gst/avi/gstavidemux.c | 23 +++++++++++--------
1 file changed, 13 insertions(+), 10 deletions(-)
diff --git a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
index 0d18a6495c..5d7ed2edd6 100644
--- a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
+++ b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
@@ -3828,13 +3828,13 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
ptr += 98;
left -= 98;
- if (!memcmp (ptr, "FUJIFILM", 8)) {
+ if (left >= 10 && !memcmp (ptr, "FUJIFILM", 8)) {
GST_MEMDUMP_OBJECT (avi, "fujifim tag", ptr, 48);
ptr += 10;
left -= 10;
sub_size = 0;
- while (ptr[sub_size] && sub_size < left)
+ while (sub_size < left && ptr[sub_size])
sub_size++;
if (avi->globaltags == NULL)
@@ -3845,21 +3845,24 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
parse_tag_value (avi, avi->globaltags, GST_TAG_DEVICE_MODEL, ptr,
sub_size);
- while (ptr[sub_size] == '\0' && sub_size < left)
+ while (sub_size < left && ptr[sub_size] == '\0')
sub_size++;
ptr += sub_size;
left -= sub_size;
sub_size = 0;
- while (ptr[sub_size] && sub_size < left)
+ while (sub_size < left && ptr[sub_size])
sub_size++;
- if (ptr[4] == ':')
- ptr[4] = '-';
- if (ptr[7] == ':')
- ptr[7] = '-';
- parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
- sub_size);
+ if (sub_size >= 8) {
+ if (ptr[4] == ':')
+ ptr[4] = '-';
+ if (ptr[7] == ':')
+ ptr[7] = '-';
+
+ parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
+ sub_size);
+ }
}
}
}

10
gstreamer1-plugins-good.spec
View File

@ -28,7 +28,7 @@
Name: gstreamer1-plugins-good
Version: 1.22.12
Release: 9%{?dist}
Release: 10%{?dist}
Summary: GStreamer plugins with good code and licensing
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
@ -83,6 +83,9 @@ Patch0030: gstreamer1-plugins-good-1.22.12-CVE-2026-53705.patch
# https://issues.redhat.com/browse/RHEL-224165
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234
Patch0031: gstreamer1-plugins-good-1.22.12-CVE-2026-18649.patch
# https://issues.redhat.com/browse/RHEL-239066
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/bb8fb5a9bf15fb845863430281e4bf908aec7090
Patch0032: gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch
BuildRequires: meson >= 0.48.0
BuildRequires: gcc
@ -273,6 +276,7 @@ to be installed.
%patch -P 0029 -p3
%patch -P 0030 -p3
%patch -P 0031 -p3
%patch -P 0032 -p3
%build
%meson \
@ -423,6 +427,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
%changelog
* Mon Aug 17 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-10
- Fix out-of-bounds reads in AVI FUJIFILM strd parsing
(CVE-2026-73433)
* Tue Aug 11 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-9
- Limit maximum fragmentation unit size in RTP H264/H265
depayloaders to prevent excessive memory usage