rpms/gstreamer1-plugins-good
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS git gstreamer1-plugins-good-1.16.1-7.el8_10.3

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-19 10:17:02 -04:00
parent c727b83381
commit b045dfd302
4 changed files with 721 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

296
SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-18649.patch Normal file
View File

@ -0,0 +1,296 @@
From 07cbde0479905b968c54f6ca22999aa9b62bd653 Mon Sep 17 00:00:00 2001
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
Date: Fri, 7 Aug 2026 14:34:04 +0000
Subject: [PATCH] rtph264depay: rtph265depay: Limit the maximum fragmentation
unit size
Adds a max-fragmentation-unit-size property (default 32 MB) to both
H.264 and H.265 RTP depayloaders. If a fragmentation unit exceeds
this limit while being assembled, it is dropped and the depayloader
state is reset to prevent excessive memory usage.
Adapted from upstream commits:
- 5cd490c125e04676659593b0f5b19130fc2face7
- 820bd15585b13af8be9b0131699655194ae68a5b
Fixes: CVE-2026-18649
---
gst/rtp/gstrtph264depay.c | 79 ++++++++++++++++++++++++++++++++++++++-
gst/rtp/gstrtph264depay.h | 2 +
gst/rtp/gstrtph265depay.c | 75 +++++++++++++++++++++++++++++++++++++
gst/rtp/gstrtph265depay.h | 2 +
4 files changed, 157 insertions(+), 1 deletion(-)
diff --git a/gst/rtp/gstrtph264depay.c b/gst/rtp/gstrtph264depay.c
index 275a9a0..625244f 100644
--- a/gst/rtp/gstrtph264depay.c
+++ b/gst/rtp/gstrtph264depay.c
@@ -38,6 +38,13 @@ GST_DEBUG_CATEGORY_STATIC (rtph264depay_debug);
* expressed a restriction or preference via caps */
#define DEFAULT_BYTE_STREAM TRUE
#define DEFAULT_ACCESS_UNIT FALSE
+#define DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE (32 * 1024 * 1024)
+
+enum
+{
+ PROP_0,
+ PROP_MAX_FRAGMENTATION_UNIT_SIZE,
+};
/* 3 zero bytes syncword */
static const guint8 sync_bytes[] = { 0, 0, 0, 1 };
@@ -83,6 +90,10 @@ G_DEFINE_TYPE (GstRtpH264Depay, gst_rtp_h264_depay,
GST_TYPE_RTP_BASE_DEPAYLOAD);
static void gst_rtp_h264_depay_finalize (GObject * object);
+static void gst_rtp_h264_depay_set_property (GObject * object, guint prop_id,
+ const GValue * value, GParamSpec * pspec);
+static void gst_rtp_h264_depay_get_property (GObject * object, guint prop_id,
+ GValue * value, GParamSpec * pspec);
static GstStateChangeReturn gst_rtp_h264_depay_change_state (GstElement *
element, GstStateChange transition);
@@ -111,6 +122,24 @@ gst_rtp_h264_depay_class_init (GstRtpH264DepayClass * klass)
gstrtpbasedepayload_class = (GstRTPBaseDepayloadClass *) klass;
gobject_class->finalize = gst_rtp_h264_depay_finalize;
+ gobject_class->set_property = gst_rtp_h264_depay_set_property;
+ gobject_class->get_property = gst_rtp_h264_depay_get_property;
+
+ /**
+ * GstRtpH264Depay:max-fragmentation-unit-size:
+ *
+ * Maximum size in bytes for a fragmentation unit. Larger units
+ * will be dropped to prevent excessive memory usage.
+ *
+ * Use 0 for automatic.
+ */
+ g_object_class_install_property (gobject_class,
+ PROP_MAX_FRAGMENTATION_UNIT_SIZE,
+ g_param_spec_uint ("max-fragmentation-unit-size",
+ "Max Fragmentation Unit Size",
+ "Maximum size in bytes for a fragmentation unit (0 = auto)", 0,
+ G_MAXUINT, DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE,
+ G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
gst_element_class_add_static_pad_template (gstelement_class,
&gst_rtp_h264_depay_src_template);
@@ -128,6 +157,38 @@ gst_rtp_h264_depay_class_init (GstRtpH264DepayClass * klass)
gstrtpbasedepayload_class->handle_event = gst_rtp_h264_depay_handle_event;
}
+static void
+gst_rtp_h264_depay_set_property (GObject * object, guint prop_id,
+ const GValue * value, GParamSpec * pspec)
+{
+ GstRtpH264Depay *self = GST_RTP_H264_DEPAY (object);
+
+ switch (prop_id) {
+ case PROP_MAX_FRAGMENTATION_UNIT_SIZE:
+ self->max_fragmentation_unit_size = g_value_get_uint (value);
+ break;
+ default:
+ G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+ break;
+ }
+}
+
+static void
+gst_rtp_h264_depay_get_property (GObject * object, guint prop_id,
+ GValue * value, GParamSpec * pspec)
+{
+ GstRtpH264Depay *self = GST_RTP_H264_DEPAY (object);
+
+ switch (prop_id) {
+ case PROP_MAX_FRAGMENTATION_UNIT_SIZE:
+ g_value_set_uint (value, self->max_fragmentation_unit_size);
+ break;
+ default:
+ G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+ break;
+ }
+}
+
static void
gst_rtp_h264_depay_init (GstRtpH264Depay * rtph264depay)
{
@@ -139,6 +200,8 @@ gst_rtp_h264_depay_init (GstRtpH264Depay * rtph264depay)
(GDestroyNotify) gst_buffer_unref);
rtph264depay->pps = g_ptr_array_new_with_free_func (
(GDestroyNotify) gst_buffer_unref);
+ rtph264depay->max_fragmentation_unit_size =
+ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE;
}
static void
@@ -1241,8 +1304,22 @@ gst_rtp_h264_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
rtph264depay->fu_marker = marker;
/* if NAL unit ends, flush the adapter */
- if (E)
+ if (E) {
gst_rtp_h264_finish_fragmentation_unit (rtph264depay);
+ GST_DEBUG_OBJECT (rtph264depay, "End of Fragmentation Unit");
+ } else {
+ guint limit = rtph264depay->max_fragmentation_unit_size ?
+ rtph264depay->max_fragmentation_unit_size :
+ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE;
+ if (gst_adapter_available (rtph264depay->adapter) > limit) {
+ GST_WARNING_OBJECT (rtph264depay,
+ "Too big (> %u bytes) fragmentation unit, dropping.", limit);
+ rtph264depay->wait_start = TRUE;
+ rtph264depay->current_fu_type = 0;
+ gst_adapter_clear (rtph264depay->adapter);
+ return NULL;
+ }
+ }
break;
}
default:
diff --git a/gst/rtp/gstrtph264depay.h b/gst/rtp/gstrtph264depay.h
index ba41312..a02a65d 100644
--- a/gst/rtp/gstrtph264depay.h
+++ b/gst/rtp/gstrtph264depay.h
@@ -62,6 +62,8 @@ struct _GstRtpH264Depay
GstClockTime fu_timestamp;
gboolean fu_marker;
+ guint max_fragmentation_unit_size;
+
/* misc */
GPtrArray *sps;
GPtrArray *pps;
diff --git a/gst/rtp/gstrtph265depay.c b/gst/rtp/gstrtph265depay.c
index 551e08a..b046030 100644
--- a/gst/rtp/gstrtph265depay.c
+++ b/gst/rtp/gstrtph265depay.c
@@ -38,6 +38,13 @@ GST_DEBUG_CATEGORY_STATIC (rtph265depay_debug);
* expressed a restriction or preference via caps */
#define DEFAULT_STREAM_FORMAT GST_H265_STREAM_FORMAT_BYTESTREAM
#define DEFAULT_ACCESS_UNIT FALSE
+#define DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE (32 * 1024 * 1024)
+
+enum
+{
+ PROP_0,
+ PROP_MAX_FRAGMENTATION_UNIT_SIZE,
+};
/* 3 zero bytes syncword */
static const guint8 sync_bytes[] = { 0, 0, 0, 1 };
@@ -99,6 +106,10 @@ G_DEFINE_TYPE (GstRtpH265Depay, gst_rtp_h265_depay,
GST_TYPE_RTP_BASE_DEPAYLOAD);
static void gst_rtp_h265_depay_finalize (GObject * object);
+static void gst_rtp_h265_depay_set_property (GObject * object, guint prop_id,
+ const GValue * value, GParamSpec * pspec);
+static void gst_rtp_h265_depay_get_property (GObject * object, guint prop_id,
+ GValue * value, GParamSpec * pspec);
static GstStateChangeReturn gst_rtp_h265_depay_change_state (GstElement *
element, GstStateChange transition);
@@ -128,6 +139,24 @@ gst_rtp_h265_depay_class_init (GstRtpH265DepayClass * klass)
gstrtpbasedepayload_class = (GstRTPBaseDepayloadClass *) klass;
gobject_class->finalize = gst_rtp_h265_depay_finalize;
+ gobject_class->set_property = gst_rtp_h265_depay_set_property;
+ gobject_class->get_property = gst_rtp_h265_depay_get_property;
+
+ /**
+ * GstRtpH265Depay:max-fragmentation-unit-size:
+ *
+ * Maximum size in bytes for a fragmentation unit. Larger units
+ * will be dropped to prevent excessive memory usage.
+ *
+ * Use 0 for automatic.
+ */
+ g_object_class_install_property (gobject_class,
+ PROP_MAX_FRAGMENTATION_UNIT_SIZE,
+ g_param_spec_uint ("max-fragmentation-unit-size",
+ "Max Fragmentation Unit Size",
+ "Maximum size in bytes for a fragmentation unit (0 = auto)", 0,
+ G_MAXUINT, DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE,
+ G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
gst_element_class_add_static_pad_template (gstelement_class,
&gst_rtp_h265_depay_src_template);
@@ -145,6 +174,38 @@ gst_rtp_h265_depay_class_init (GstRtpH265DepayClass * klass)
gstrtpbasedepayload_class->handle_event = gst_rtp_h265_depay_handle_event;
}
+static void
+gst_rtp_h265_depay_set_property (GObject * object, guint prop_id,
+ const GValue * value, GParamSpec * pspec)
+{
+ GstRtpH265Depay *self = GST_RTP_H265_DEPAY (object);
+
+ switch (prop_id) {
+ case PROP_MAX_FRAGMENTATION_UNIT_SIZE:
+ self->max_fragmentation_unit_size = g_value_get_uint (value);
+ break;
+ default:
+ G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+ break;
+ }
+}
+
+static void
+gst_rtp_h265_depay_get_property (GObject * object, guint prop_id,
+ GValue * value, GParamSpec * pspec)
+{
+ GstRtpH265Depay *self = GST_RTP_H265_DEPAY (object);
+
+ switch (prop_id) {
+ case PROP_MAX_FRAGMENTATION_UNIT_SIZE:
+ g_value_set_uint (value, self->max_fragmentation_unit_size);
+ break;
+ default:
+ G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+ break;
+ }
+}
+
static void
gst_rtp_h265_depay_init (GstRtpH265Depay * rtph265depay)
{
@@ -161,6 +222,8 @@ gst_rtp_h265_depay_init (GstRtpH265Depay * rtph265depay)
(GDestroyNotify) gst_buffer_unref);
rtph265depay->pps = g_ptr_array_new_with_free_func (
(GDestroyNotify) gst_buffer_unref);
+ rtph265depay->max_fragmentation_unit_size =
+ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE;
}
static void
@@ -1520,6 +1583,18 @@ gst_rtp_h265_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
if (E) {
gst_rtp_h265_finish_fragmentation_unit (rtph265depay);
GST_DEBUG_OBJECT (rtph265depay, "End of Fragmentation Unit");
+ } else {
+ guint limit = rtph265depay->max_fragmentation_unit_size ?
+ rtph265depay->max_fragmentation_unit_size :
+ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE;
+ if (gst_adapter_available (rtph265depay->adapter) > limit) {
+ GST_WARNING_OBJECT (rtph265depay,
+ "Too big (> %u bytes) fragmentation unit, dropping.", limit);
+ rtph265depay->wait_start = TRUE;
+ rtph265depay->current_fu_type = 0;
+ gst_adapter_clear (rtph265depay->adapter);
+ return NULL;
+ }
}
break;
}
diff --git a/gst/rtp/gstrtph265depay.h b/gst/rtp/gstrtph265depay.h
index cf17694..e851d3b 100644
--- a/gst/rtp/gstrtph265depay.h
+++ b/gst/rtp/gstrtph265depay.h
@@ -76,6 +76,8 @@ struct _GstRtpH265Depay
GstClockTime fu_timestamp;
gboolean fu_marker;
+ guint max_fragmentation_unit_size;
+
/* misc */
GPtrArray *vps;
GPtrArray *sps;

365
SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch Normal file
View File

@ -0,0 +1,365 @@
From 901efd4d415752fc6b539bdebcb550c9345f6487 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 12:00:34 +0300
Subject: [PATCH 1/6] avidemux: Make sure enough data is available when parsing
FUJIFILM strd
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
gst/avi/gstavidemux.c | 23 +++++++++++++----------
1 file changed, 13 insertions(+), 10 deletions(-)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 834af76..4be47b2 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -3821,13 +3821,13 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
ptr += 98;
left -= 98;
- if (!memcmp (ptr, "FUJIFILM", 8)) {
+ if (left >= 10 && !memcmp (ptr, "FUJIFILM", 8)) {
GST_MEMDUMP_OBJECT (avi, "fujifim tag", ptr, 48);
ptr += 10;
left -= 10;
sub_size = 0;
- while (ptr[sub_size] && sub_size < left)
+ while (sub_size < left && ptr[sub_size])
sub_size++;
if (avi->globaltags == NULL)
@@ -3838,21 +3838,24 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
parse_tag_value (avi, avi->globaltags, GST_TAG_DEVICE_MODEL, ptr,
sub_size);
- while (ptr[sub_size] == '\0' && sub_size < left)
+ while (sub_size < left && ptr[sub_size] == '\0')
sub_size++;
ptr += sub_size;
left -= sub_size;
sub_size = 0;
- while (ptr[sub_size] && sub_size < left)
+ while (sub_size < left && ptr[sub_size])
sub_size++;
- if (ptr[4] == ':')
- ptr[4] = '-';
- if (ptr[7] == ':')
- ptr[7] = '-';
- parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
- sub_size);
+ if (sub_size >= 8) {
+ if (ptr[4] == ':')
+ ptr[4] = '-';
+ if (ptr[7] == ':')
+ ptr[7] = '-';
+
+ parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
+ sub_size);
+ }
}
}
}
From 3f527d85b7280b020b328121ef4c0e62c333f79f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 12:27:37 +0300
Subject: [PATCH 2/6] avidemux: Don't modify read-only mapped buffer data
And improve const-correctness in many places.
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
gst/avi/gstavidemux.c | 59 ++++++++++++++++++++++++++++---------------
1 file changed, 38 insertions(+), 21 deletions(-)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 4be47b2..7a8957c 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -126,7 +126,7 @@ static void gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf);
static void gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf);
static void parse_tag_value (GstAviDemux * avi, GstTagList * taglist,
- const gchar * type, guint8 * ptr, guint tsize);
+ const gchar * type, const guint8 * ptr, guint tsize);
/* GObject methods */
@@ -1238,7 +1238,7 @@ gst_avi_demux_parse_superindex (GstAviDemux * avi,
GstBuffer * buf, guint64 ** _indexes)
{
GstMapInfo map;
- guint8 *data;
+ const guint8 *data;
guint16 bpe = 16;
guint32 num, i;
guint64 *indexes;
@@ -1526,7 +1526,7 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream,
GstBuffer * buf)
{
GstMapInfo map;
- guint8 *data;
+ const guint8 *data;
guint16 bpe;
guint32 num, i;
guint64 baseoff;
@@ -1974,7 +1974,7 @@ gst_avi_demux_check_caps (GstAviDemux * avi, GstAviStream * stream,
/* some muxers put invalid bytestream stuff in h264 extra data */
val = gst_structure_get_value (s, "codec_data");
if (val && (buf = gst_value_get_buffer (val))) {
- guint8 *data;
+ const guint8 *data;
gint size;
GstMapInfo map;
@@ -2730,7 +2730,7 @@ gst_avi_demux_parse_index (GstAviDemux * avi, GstBuffer * buf)
{
GstMapInfo map;
guint i, num, n;
- gst_riff_index_entry *index;
+ const gst_riff_index_entry *index;
GstClockTime stamp;
GstAviStream *stream;
GstAviIndexEntry entry;
@@ -3714,7 +3714,7 @@ static void
gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf)
{
GstMapInfo map;
- gchar *ptr;
+ const gchar *ptr;
gsize left;
gchar *safedata = NULL;
@@ -3732,7 +3732,7 @@ gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf)
*/
/* skip eventual initial whitespace */
- ptr = (gchar *) map.data;
+ ptr = (const gchar *) map.data;
left = map.size;
while (left > 0 && g_ascii_isspace (ptr[0])) {
@@ -3769,7 +3769,7 @@ non_parsable:
static void
parse_tag_value (GstAviDemux * avi, GstTagList * taglist, const gchar * type,
- guint8 * ptr, guint tsize)
+ const guint8 * ptr, guint tsize)
{
static const gchar *env_vars[] = { "GST_AVI_TAG_ENCODING",
"GST_RIFF_TAG_ENCODING", "GST_TAG_ENCODING", NULL
@@ -3809,7 +3809,7 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
gst_buffer_map (buf, &map, GST_MAP_READ);
if (map.size > 4) {
- guint8 *ptr = map.data;
+ const guint8 *ptr = map.data;
gsize left = map.size;
/* parsing based on
@@ -3848,13 +3848,17 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
sub_size++;
if (sub_size >= 8) {
- if (ptr[4] == ':')
- ptr[4] = '-';
- if (ptr[7] == ':')
- ptr[7] = '-';
+ guint8 *ptr_dup = g_memdup2 (ptr, sub_size);
+
+ if (ptr_dup[4] == ':')
+ ptr_dup[4] = '-';
+ if (ptr_dup[7] == ':')
+ ptr_dup[7] = '-';
- parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
+ parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr_dup,
sub_size);
+
+ g_free (ptr_dup);
}
}
}
@@ -3877,7 +3881,7 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf,
GstTagList ** _taglist)
{
GstMapInfo info;
- guint8 *ptr;
+ const guint8 *ptr;
gsize left;
guint tsize;
guint32 tag;
@@ -3946,14 +3950,27 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf,
type = GST_TAG_ENCODER;
break;
case 0x13: /* CreationDate */
- type = GST_TAG_DATE_TIME;
- if (left > 7) {
- if (ptr[4] == ':')
- ptr[4] = '-';
- if (ptr[7] == ':')
- ptr[7] = '-';
+ {
+ type = NULL;
+
+ if (left > 7 && ptr[0] != '\0') {
+ guint8 *ptr_dup = g_memdup2 (ptr, sub_size);
+
+ if (ptr_dup[4] == ':')
+ ptr_dup[4] = '-';
+ if (ptr_dup[7] == ':')
+ ptr_dup[7] = '-';
+
+ GST_DEBUG_OBJECT (avi, "mapped tag %u to tag %s", sub_tag,
+ GST_TAG_DATE_TIME);
+
+ parse_tag_value (avi, taglist, GST_TAG_DATE_TIME, ptr_dup,
+ sub_size);
+
+ g_free (ptr_dup);
}
break;
+ }
default:
type = NULL;
break;
From 345735b66d7049991fb27a8f64ea1adfc9352e46 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 12:29:14 +0300
Subject: [PATCH 3/6] avidemux: Check that at least 1 byte is available before
dereferencing tag pointer
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
gst/avi/gstavidemux.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 7a8957c..64a28d2 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -3975,7 +3975,7 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf,
type = NULL;
break;
}
- if (type != NULL && ptr[0] != '\0') {
+ if (type != NULL && left > 0 && ptr[0] != '\0') {
GST_DEBUG_OBJECT (avi, "mapped tag %u to tag %s", sub_tag, type);
parse_tag_value (avi, taglist, type, ptr, sub_size);
From a224a7a063ef1a53c1210c9c9bbfeb610d0d2253 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 12:35:12 +0300
Subject: [PATCH 4/6] avidemux: Use correct divisor for calculating available
number of vprp field infos
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
gst/avi/gstavidemux.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 64a28d2..6a4bf7a 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -1805,7 +1805,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element,
/* size checking */
/* calculate fields based on size */
- k = (size - G_STRUCT_OFFSET (gst_riff_vprp, field_info)) / vprp->fields;
+ k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
+ field_info)) / sizeof (vprp->field_info[0]);
if (vprp->fields > k) {
GST_WARNING_OBJECT (element,
"vprp header indicated %d fields, only %d available", vprp->fields, k);
From 6b063d86c99298cb8901a4134b82f7bcc84fa6a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 13:22:04 +0300
Subject: [PATCH 5/6] avidemux: Avoid integer overflow in bounds checks when
parsing the index
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
gst/avi/gstavidemux.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 6a4bf7a..20fd207 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -1280,8 +1280,13 @@ gst_avi_demux_parse_superindex (GstAviDemux * avi,
indexes = g_new (guint64, num + 1);
for (i = 0; i < num; i++) {
- if (size < 24 + bpe * (i + 1))
+ gsize required_size;
+
+ if (!g_size_checked_mul (&required_size, bpe, i + 1))
+ break;
+ if (size - 24 < required_size)
break;
+
indexes[i] = GST_READ_UINT64_LE (&data[24 + bpe * i]);
GST_DEBUG_OBJECT (avi, "index %d at %" G_GUINT64_FORMAT, i, indexes[i]);
}
@@ -1568,8 +1573,11 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream,
for (i = 0; i < num; i++) {
GstAviIndexEntry entry;
+ gsize required_size;
- if (map.size < 24 + bpe * (i + 1))
+ if (!g_size_checked_mul (&required_size, bpe, i + 1))
+ break;
+ if (map.size - 24 < required_size)
break;
/* fill in offset and size. offset contains the keyframe flag in the
From a6ac7c3a64bce23d504f0b62313120ae1bfb08e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 13:22:38 +0300
Subject: [PATCH 6/6] avidemux: Don't read a subindex with too many items
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
gst/avi/gstavidemux.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 20fd207..4d3f608 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -1569,6 +1569,10 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream,
if (num == 0)
goto empty_index;
+ /* this can't work out well ... */
+ if (num > G_MAXUINT32 >> 1)
+ goto invalid_params;
+
GST_INFO_OBJECT (avi, "Parsing subindex, nr_entries = %6d", num);
for (i = 0; i < num; i++) {
@@ -1620,6 +1624,11 @@ not_implemented:
gst_buffer_unref (buf);
return FALSE;
}
+invalid_params:
+ {
+ GST_ERROR_OBJECT (avi, "invalid subindex parameters (num = %d)", num);
+ goto done; /* continue */
+ }
empty_index:
{
GST_DEBUG_OBJECT (avi, "the index is empty");

35
SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch Normal file
View File

@ -0,0 +1,35 @@
From b3a928896a6a87897d9f42e2b10088eb0e13e418 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 12:35:12 +0300
Subject: [PATCH] avidemux: Use correct divisor for calculating available
number of vprp field infos
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
NOTE: The functional change in this patch (CVE-2026-73434) was already
included in the CVE-2026-73433 patch (Patch11). This patch is adapted
as a no-op for CVE tracking purposes.
---
gst/avi/gstavidemux.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
index 4be47b2..dbe0d88 100644
--- a/gst/avi/gstavidemux.c
+++ b/gst/avi/gstavidemux.c
@@ -1822,8 +1822,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element,
/* size checking */
/* calculate fields based on size */
- k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
- field_info)) / sizeof (vprp->field_info[0]);
+ k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
+ field_info)) / sizeof (vprp->field_info[0]);
if (vprp->fields > k) {
GST_WARNING_OBJECT (element,
"vprp header indicated %d fields, only %d available", vprp->fields, k);
--
2.43.0

26
SPECS/gstreamer1-plugins-good.spec
View File

@ -15,7 +15,7 @@
Name: gstreamer1-plugins-good
Version: 1.16.1
Release: 7%{?gitcommit:.git%{shortcommit}}%{?dist}
Release: 7%{?gitcommit:.git%{shortcommit}}%{?dist}.3
Summary: GStreamer plugins with good code and licensing
License: LGPLv2+
@ -42,6 +42,15 @@ Patch9: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
# https://issues.redhat.com/browse/RHEL-184473
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811
Patch10: gstreamer1-plugins-good-1.16.1-CVE-2026-53705.patch
# https://issues.redhat.com/browse/RHEL-239068
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231
Patch11: gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch
# https://issues.redhat.com/browse/RHEL-224145
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12244
Patch12: gstreamer1-plugins-good-1.16.1-CVE-2026-18649.patch
# https://issues.redhat.com/browse/RHEL-239048
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/0bcc6564c7deedc7d6d7373a2ab6479c9bf3889f
Patch13: gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch
BuildRequires: gcc
BuildRequires: gcc-c++
@ -186,6 +195,9 @@ to be installed.
%patch8 -p1
%patch9 -p1
%patch10 -p1
%patch11 -p1
%patch12 -p1
%patch13 -p1
%build
%configure --disable-silent-rules --disable-fatal-warnings \
@ -370,6 +382,18 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
%changelog
* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.3
- Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling
Resolves: RHEL-239048
* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.2
- Fix CVE-2026-18649 in H.264/H.265 RTP depayloaders
Resolves: RHEL-224145
* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.1
- Fix multiple security issues in AVI demuxer (CVE-2026-73433)
Resolves: RHEL-239068
* Fri Jun 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7
- Fix integer overflow vulnerabilities in wavpackdec (CVE-2026-53705)
Resolves: RHEL-184473