Fix integer overflow in wavpack decoder (CVE-2026-53705)
Backport CVE-2026-53705 fix from upstream GStreamer MR #11797 (4 commits) to address integer overflow vulnerabilities in the wavpack decoder. The patch uses g_size_checked_mul to avoid integer overflow when calculating output buffer size, corrects variable types to prevent overflow, fixes integer overflow in input buffer size check, and unmaps input buffer earlier to prevent use-after-free in error paths. CVE: CVE-2026-53705 Upstream patches: - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797.patch Resolves: RHEL-184481 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
parent
b440b1b761
commit
9b48c1cc9b
152
gstreamer1-plugins-good-1.26.7-CVE-2026-53705.patch
Normal file
152
gstreamer1-plugins-good-1.26.7-CVE-2026-53705.patch
Normal file
@ -0,0 +1,152 @@
|
||||
From eb30f41bd862fbe014cdc673212c77e3dc48825c Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 5 Jun 2026 11:24:21 +0300
|
||||
Subject: [PATCH 1/4] wavpackdec: Avoid integer overflow when calculating
|
||||
output buffer size
|
||||
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5069
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797>
|
||||
---
|
||||
subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c | 7 ++++++-
|
||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
index 47368929e6..df5bb936c7 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
@@ -294,6 +294,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
gint width, depth, i, j, max, wavpack_mode;
|
||||
gboolean mode_float;
|
||||
gint32 *dec_data = NULL;
|
||||
+ gsize dec_data_size;
|
||||
guint8 *out_data;
|
||||
GstMapInfo map, omap;
|
||||
|
||||
@@ -371,7 +372,11 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
}
|
||||
|
||||
/* alloc output buffer */
|
||||
- dec_data = g_malloc (4 * wph.block_samples * dec->channels);
|
||||
+ dec_data_size = 4;
|
||||
+ if (!g_size_checked_mul (&dec_data_size, dec_data_size, wph.block_samples) ||
|
||||
+ !g_size_checked_mul (&dec_data_size, dec_data_size, dec->channels))
|
||||
+ goto invalid_header;
|
||||
+ dec_data = g_malloc (dec_data_size);
|
||||
|
||||
/* decode */
|
||||
decoded = WavpackUnpackSamples (dec->context, dec_data, wph.block_samples);
|
||||
|
||||
From b6619703d2a7b0d0550ec3953a90761f0811b123 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 5 Jun 2026 11:24:25 +0300
|
||||
Subject: [PATCH 2/4] wavpackdec: Use correctly-sized variable types
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797>
|
||||
---
|
||||
subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
index df5bb936c7..a9528657df 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
@@ -289,12 +289,12 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
GstBuffer *outbuf = NULL;
|
||||
GstFlowReturn ret = GST_FLOW_OK;
|
||||
WavpackHeader wph;
|
||||
- int32_t decoded, unpacked_size;
|
||||
gboolean format_changed;
|
||||
- gint width, depth, i, j, max, wavpack_mode;
|
||||
+ gint width, depth, wavpack_mode;
|
||||
gboolean mode_float;
|
||||
gint32 *dec_data = NULL;
|
||||
- gsize dec_data_size;
|
||||
+ gsize i, j, dec_data_size, unpacked_size, max;
|
||||
+ uint32_t decoded;
|
||||
guint8 *out_data;
|
||||
GstMapInfo map, omap;
|
||||
|
||||
|
||||
From 585a54a936cf1083915fee60aa45f3686f5d593b Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 5 Jun 2026 11:24:29 +0300
|
||||
Subject: [PATCH 3/4] wavpackdec: Avoid integer overflow when checking input
|
||||
buffer size
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797>
|
||||
---
|
||||
subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
index a9528657df..4fe05671f3 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
@@ -311,7 +311,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
if (!gst_wavpack_read_header (&wph, map.data))
|
||||
goto invalid_header;
|
||||
|
||||
- if (map.size < wph.ckSize + 4 * 1 + 4)
|
||||
+ if (map.size - 4 * 1 - 4 < wph.ckSize)
|
||||
goto input_not_framed;
|
||||
|
||||
if (!(wph.flags & INITIAL_BLOCK))
|
||||
|
||||
From fa92385a82aeb070425bc50c574618786634054f Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 5 Jun 2026 11:24:33 +0300
|
||||
Subject: [PATCH 4/4] wavpackdec: Unmap input buffer directly after decoding
|
||||
|
||||
In case of decoder errors we would otherwise unmap the buffer after
|
||||
finish_frame(), which potentially invalidates the input buffer already.
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797>
|
||||
---
|
||||
subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c | 9 +++++----
|
||||
1 file changed, 5 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
index 4fe05671f3..7d1e95d6df 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
@@ -295,6 +295,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
gint32 *dec_data = NULL;
|
||||
gsize i, j, dec_data_size, unpacked_size, max;
|
||||
uint32_t decoded;
|
||||
+ guint64 offset;
|
||||
guint8 *out_data;
|
||||
GstMapInfo map, omap;
|
||||
|
||||
@@ -377,9 +378,12 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
!g_size_checked_mul (&dec_data_size, dec_data_size, dec->channels))
|
||||
goto invalid_header;
|
||||
dec_data = g_malloc (dec_data_size);
|
||||
+ offset = GST_BUFFER_OFFSET (buf);
|
||||
|
||||
/* decode */
|
||||
decoded = WavpackUnpackSamples (dec->context, dec_data, wph.block_samples);
|
||||
+ gst_buffer_unmap (buf, &map);
|
||||
+ buf = NULL;
|
||||
if (decoded != wph.block_samples)
|
||||
goto decode_error;
|
||||
|
||||
@@ -387,7 +391,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
outbuf = gst_buffer_new_and_alloc (unpacked_size);
|
||||
|
||||
/* legacy; pass along offset, whatever that might entail */
|
||||
- GST_BUFFER_OFFSET (outbuf) = GST_BUFFER_OFFSET (buf);
|
||||
+ GST_BUFFER_OFFSET (outbuf) = offset;
|
||||
|
||||
gst_buffer_map (outbuf, &omap, GST_MAP_WRITE);
|
||||
out_data = omap.data;
|
||||
@@ -432,9 +436,6 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
}
|
||||
|
||||
gst_buffer_unmap (outbuf, &omap);
|
||||
- gst_buffer_unmap (buf, &map);
|
||||
- buf = NULL;
|
||||
-
|
||||
g_free (dec_data);
|
||||
|
||||
ret = gst_audio_decoder_finish_frame (bdec, outbuf, 1);
|
||||
@ -35,7 +35,7 @@
|
||||
|
||||
Name: gstreamer1-plugins-good
|
||||
Version: 1.26.7
|
||||
Release: 2%{?dist}
|
||||
Release: 3%{?dist}
|
||||
Summary: GStreamer plugins with good code and licensing
|
||||
|
||||
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
|
||||
@ -56,6 +56,8 @@ Source0: http://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugin
|
||||
Source1: gstreamer-good.appdata.xml
|
||||
|
||||
Patch: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
|
||||
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797
|
||||
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-53705.patch
|
||||
|
||||
BuildRequires: meson >= 0.48.0
|
||||
BuildRequires: gcc
|
||||
@ -376,6 +378,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
|
||||
|
||||
|
||||
%changelog
|
||||
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-3
|
||||
- Fix integer overflow in wavpack decoder (CVE-2026-53705)
|
||||
Resolves: RHEL-184481
|
||||
|
||||
* Tue Mar 31 2026 Wim Taymans <wtaymans@redhat.com> - 1.26.7-2
|
||||
- Add patch for CVE-2026-3083 and CVE-2026-3085
|
||||
Resolves: RHEL-156142, RHEL-156119
|
||||
|
||||
Loading…
Reference in New Issue
Block a user