Fix integer overflow in wavpack decoder (CVE-2026-53705)
Backport CVE-2026-53705 fix from upstream GStreamer MR !11797 (4 commits by Sebastian Dröge) to address integer overflow vulnerabilities in the wavpackdec element. The patch fixes integer overflows when calculating output buffer size and checking input buffer size, uses correctly-sized variable types, and unmaps the input buffer directly after decoding to avoid use-after-free scenarios. CVE: CVE-2026-53705 Upstream patches: - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797.patch Resolves: RHEL-184478 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
parent
9c7ac40184
commit
a8a9c25b9f
152
gstreamer1-plugins-good-1.22.12-CVE-2026-53705.patch
Normal file
152
gstreamer1-plugins-good-1.22.12-CVE-2026-53705.patch
Normal file
@ -0,0 +1,152 @@
|
||||
From 5eff61803423463ffdf32f2ef55fd004275110ed Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 5 Jun 2026 11:24:21 +0300
|
||||
Subject: [PATCH 1/4] wavpackdec: Avoid integer overflow when calculating
|
||||
output buffer size
|
||||
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5069
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797>
|
||||
---
|
||||
subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c | 7 ++++++-
|
||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
index 47368929e6..df5bb936c7 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
@@ -294,6 +294,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
gint width, depth, i, j, max, wavpack_mode;
|
||||
gboolean mode_float;
|
||||
gint32 *dec_data = NULL;
|
||||
+ gsize dec_data_size;
|
||||
guint8 *out_data;
|
||||
GstMapInfo map, omap;
|
||||
|
||||
@@ -371,7 +372,11 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
}
|
||||
|
||||
/* alloc output buffer */
|
||||
- dec_data = g_malloc (4 * wph.block_samples * dec->channels);
|
||||
+ dec_data_size = 4;
|
||||
+ if (!g_size_checked_mul (&dec_data_size, dec_data_size, wph.block_samples) ||
|
||||
+ !g_size_checked_mul (&dec_data_size, dec_data_size, dec->channels))
|
||||
+ goto invalid_header;
|
||||
+ dec_data = g_malloc (dec_data_size);
|
||||
|
||||
/* decode */
|
||||
decoded = WavpackUnpackSamples (dec->context, dec_data, wph.block_samples);
|
||||
|
||||
From 63f76cba50c00903e6c57f46d26fc262e8d65cd8 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 5 Jun 2026 11:24:25 +0300
|
||||
Subject: [PATCH 2/4] wavpackdec: Use correctly-sized variable types
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797>
|
||||
---
|
||||
subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
index df5bb936c7..a9528657df 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
@@ -289,12 +289,12 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
GstBuffer *outbuf = NULL;
|
||||
GstFlowReturn ret = GST_FLOW_OK;
|
||||
WavpackHeader wph;
|
||||
- int32_t decoded, unpacked_size;
|
||||
gboolean format_changed;
|
||||
- gint width, depth, i, j, max, wavpack_mode;
|
||||
+ gint width, depth, wavpack_mode;
|
||||
gboolean mode_float;
|
||||
gint32 *dec_data = NULL;
|
||||
- gsize dec_data_size;
|
||||
+ gsize i, j, dec_data_size, unpacked_size, max;
|
||||
+ uint32_t decoded;
|
||||
guint8 *out_data;
|
||||
GstMapInfo map, omap;
|
||||
|
||||
|
||||
From 551d65f4f0b14977c06c9edcaa40efaf9ec936f6 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 5 Jun 2026 11:24:29 +0300
|
||||
Subject: [PATCH 3/4] wavpackdec: Avoid integer overflow when checking input
|
||||
buffer size
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797>
|
||||
---
|
||||
subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
index a9528657df..4fe05671f3 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
@@ -311,7 +311,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
if (!gst_wavpack_read_header (&wph, map.data))
|
||||
goto invalid_header;
|
||||
|
||||
- if (map.size < wph.ckSize + 4 * 1 + 4)
|
||||
+ if (map.size - 4 * 1 - 4 < wph.ckSize)
|
||||
goto input_not_framed;
|
||||
|
||||
if (!(wph.flags & INITIAL_BLOCK))
|
||||
|
||||
From 4dfb24b7fb5eb3b2eee7ed48dc381b66bd622573 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 5 Jun 2026 11:24:33 +0300
|
||||
Subject: [PATCH 4/4] wavpackdec: Unmap input buffer directly after decoding
|
||||
|
||||
In case of decoder errors we would otherwise unmap the buffer after
|
||||
finish_frame(), which potentially invalidates the input buffer already.
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797>
|
||||
---
|
||||
subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c | 9 +++++----
|
||||
1 file changed, 5 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
index 4fe05671f3..7d1e95d6df 100644
|
||||
--- a/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
+++ b/subprojects/gst-plugins-good/ext/wavpack/gstwavpackdec.c
|
||||
@@ -295,6 +295,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
gint32 *dec_data = NULL;
|
||||
gsize i, j, dec_data_size, unpacked_size, max;
|
||||
uint32_t decoded;
|
||||
+ guint64 offset;
|
||||
guint8 *out_data;
|
||||
GstMapInfo map, omap;
|
||||
|
||||
@@ -377,9 +378,12 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
!g_size_checked_mul (&dec_data_size, dec_data_size, dec->channels))
|
||||
goto invalid_header;
|
||||
dec_data = g_malloc (dec_data_size);
|
||||
+ offset = GST_BUFFER_OFFSET (buf);
|
||||
|
||||
/* decode */
|
||||
decoded = WavpackUnpackSamples (dec->context, dec_data, wph.block_samples);
|
||||
+ gst_buffer_unmap (buf, &map);
|
||||
+ buf = NULL;
|
||||
if (decoded != wph.block_samples)
|
||||
goto decode_error;
|
||||
|
||||
@@ -387,7 +391,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
outbuf = gst_buffer_new_and_alloc (unpacked_size);
|
||||
|
||||
/* legacy; pass along offset, whatever that might entail */
|
||||
- GST_BUFFER_OFFSET (outbuf) = GST_BUFFER_OFFSET (buf);
|
||||
+ GST_BUFFER_OFFSET (outbuf) = offset;
|
||||
|
||||
gst_buffer_map (outbuf, &omap, GST_MAP_WRITE);
|
||||
out_data = omap.data;
|
||||
@@ -432,9 +436,6 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
|
||||
}
|
||||
|
||||
gst_buffer_unmap (outbuf, &omap);
|
||||
- gst_buffer_unmap (buf, &map);
|
||||
- buf = NULL;
|
||||
-
|
||||
g_free (dec_data);
|
||||
|
||||
ret = gst_audio_decoder_finish_frame (bdec, outbuf, 1);
|
||||
@ -28,7 +28,7 @@
|
||||
|
||||
Name: gstreamer1-plugins-good
|
||||
Version: 1.22.12
|
||||
Release: 7%{?dist}
|
||||
Release: 8%{?dist}
|
||||
Summary: GStreamer plugins with good code and licensing
|
||||
|
||||
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
|
||||
@ -77,6 +77,9 @@ Patch0026: 0026-qtdemux-Check-for-invalid-atom-length-when-extractin.patch
|
||||
Patch0027: 0027-qtdemux-Add-size-check-for-parsing-SMI-SEQH-atom.patch
|
||||
Patch0028: 0028-jpegdec-Directly-error-out-on-negotiation-failures.patch
|
||||
Patch0029: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
|
||||
# https://issues.redhat.com/browse/RHEL-184478
|
||||
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11797
|
||||
Patch0030: gstreamer1-plugins-good-1.22.12-CVE-2026-53705.patch
|
||||
|
||||
BuildRequires: meson >= 0.48.0
|
||||
BuildRequires: gcc
|
||||
@ -265,6 +268,7 @@ to be installed.
|
||||
%patch -P 0027 -p3
|
||||
%patch -P 0028 -p3
|
||||
%patch -P 0029 -p3
|
||||
%patch -P 0030 -p3
|
||||
|
||||
%build
|
||||
%meson \
|
||||
@ -415,6 +419,9 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
|
||||
|
||||
|
||||
%changelog
|
||||
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-8
|
||||
- Fix integer overflows in wavpackdec (CVE-2026-53705)
|
||||
|
||||
* Tue Mar 31 2026 Veronika Kabatova <vkabatov@redhat.com> - 1.22.12-7
|
||||
- Rebuild to fix missing binaries due to buildsystem oversight
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user