From b045dfd3029223aea7b964c40154d3ce83865539 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Wed, 19 Aug 2026 10:17:02 -0400 Subject: [PATCH] import CS git gstreamer1-plugins-good-1.16.1-7.el8_10.3 --- ...1-plugins-good-1.16.1-CVE-2026-18649.patch | 296 ++++++++++++++ ...1-plugins-good-1.16.1-CVE-2026-73433.patch | 365 ++++++++++++++++++ ...1-plugins-good-1.16.1-CVE-2026-73434.patch | 35 ++ SPECS/gstreamer1-plugins-good.spec | 26 +- 4 files changed, 721 insertions(+), 1 deletion(-) create mode 100644 SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-18649.patch create mode 100644 SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch create mode 100644 SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch diff --git a/SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-18649.patch b/SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-18649.patch new file mode 100644 index 0000000..81ccae0 --- /dev/null +++ b/SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-18649.patch @@ -0,0 +1,296 @@ +From 07cbde0479905b968c54f6ca22999aa9b62bd653 Mon Sep 17 00:00:00 2001 +From: RHEL Packaging Agent +Date: Fri, 7 Aug 2026 14:34:04 +0000 +Subject: [PATCH] rtph264depay: rtph265depay: Limit the maximum fragmentation + unit size + +Adds a max-fragmentation-unit-size property (default 32 MB) to both +H.264 and H.265 RTP depayloaders. If a fragmentation unit exceeds +this limit while being assembled, it is dropped and the depayloader +state is reset to prevent excessive memory usage. + +Adapted from upstream commits: +- 5cd490c125e04676659593b0f5b19130fc2face7 +- 820bd15585b13af8be9b0131699655194ae68a5b + +Fixes: CVE-2026-18649 +--- + gst/rtp/gstrtph264depay.c | 79 ++++++++++++++++++++++++++++++++++++++- + gst/rtp/gstrtph264depay.h | 2 + + gst/rtp/gstrtph265depay.c | 75 +++++++++++++++++++++++++++++++++++++ + gst/rtp/gstrtph265depay.h | 2 + + 4 files changed, 157 insertions(+), 1 deletion(-) + +diff --git a/gst/rtp/gstrtph264depay.c b/gst/rtp/gstrtph264depay.c +index 275a9a0..625244f 100644 +--- a/gst/rtp/gstrtph264depay.c ++++ b/gst/rtp/gstrtph264depay.c +@@ -38,6 +38,13 @@ GST_DEBUG_CATEGORY_STATIC (rtph264depay_debug); + * expressed a restriction or preference via caps */ + #define DEFAULT_BYTE_STREAM TRUE + #define DEFAULT_ACCESS_UNIT FALSE ++#define DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE (32 * 1024 * 1024) ++ ++enum ++{ ++ PROP_0, ++ PROP_MAX_FRAGMENTATION_UNIT_SIZE, ++}; + + /* 3 zero bytes syncword */ + static const guint8 sync_bytes[] = { 0, 0, 0, 1 }; +@@ -83,6 +90,10 @@ G_DEFINE_TYPE (GstRtpH264Depay, gst_rtp_h264_depay, + GST_TYPE_RTP_BASE_DEPAYLOAD); + + static void gst_rtp_h264_depay_finalize (GObject * object); ++static void gst_rtp_h264_depay_set_property (GObject * object, guint prop_id, ++ const GValue * value, GParamSpec * pspec); ++static void gst_rtp_h264_depay_get_property (GObject * object, guint prop_id, ++ GValue * value, GParamSpec * pspec); + + static GstStateChangeReturn gst_rtp_h264_depay_change_state (GstElement * + element, GstStateChange transition); +@@ -111,6 +122,24 @@ gst_rtp_h264_depay_class_init (GstRtpH264DepayClass * klass) + gstrtpbasedepayload_class = (GstRTPBaseDepayloadClass *) klass; + + gobject_class->finalize = gst_rtp_h264_depay_finalize; ++ gobject_class->set_property = gst_rtp_h264_depay_set_property; ++ gobject_class->get_property = gst_rtp_h264_depay_get_property; ++ ++ /** ++ * GstRtpH264Depay:max-fragmentation-unit-size: ++ * ++ * Maximum size in bytes for a fragmentation unit. Larger units ++ * will be dropped to prevent excessive memory usage. ++ * ++ * Use 0 for automatic. ++ */ ++ g_object_class_install_property (gobject_class, ++ PROP_MAX_FRAGMENTATION_UNIT_SIZE, ++ g_param_spec_uint ("max-fragmentation-unit-size", ++ "Max Fragmentation Unit Size", ++ "Maximum size in bytes for a fragmentation unit (0 = auto)", 0, ++ G_MAXUINT, DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE, ++ G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS)); + + gst_element_class_add_static_pad_template (gstelement_class, + &gst_rtp_h264_depay_src_template); +@@ -128,6 +157,38 @@ gst_rtp_h264_depay_class_init (GstRtpH264DepayClass * klass) + gstrtpbasedepayload_class->handle_event = gst_rtp_h264_depay_handle_event; + } + ++static void ++gst_rtp_h264_depay_set_property (GObject * object, guint prop_id, ++ const GValue * value, GParamSpec * pspec) ++{ ++ GstRtpH264Depay *self = GST_RTP_H264_DEPAY (object); ++ ++ switch (prop_id) { ++ case PROP_MAX_FRAGMENTATION_UNIT_SIZE: ++ self->max_fragmentation_unit_size = g_value_get_uint (value); ++ break; ++ default: ++ G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); ++ break; ++ } ++} ++ ++static void ++gst_rtp_h264_depay_get_property (GObject * object, guint prop_id, ++ GValue * value, GParamSpec * pspec) ++{ ++ GstRtpH264Depay *self = GST_RTP_H264_DEPAY (object); ++ ++ switch (prop_id) { ++ case PROP_MAX_FRAGMENTATION_UNIT_SIZE: ++ g_value_set_uint (value, self->max_fragmentation_unit_size); ++ break; ++ default: ++ G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); ++ break; ++ } ++} ++ + static void + gst_rtp_h264_depay_init (GstRtpH264Depay * rtph264depay) + { +@@ -139,6 +200,8 @@ gst_rtp_h264_depay_init (GstRtpH264Depay * rtph264depay) + (GDestroyNotify) gst_buffer_unref); + rtph264depay->pps = g_ptr_array_new_with_free_func ( + (GDestroyNotify) gst_buffer_unref); ++ rtph264depay->max_fragmentation_unit_size = ++ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE; + } + + static void +@@ -1241,8 +1304,22 @@ gst_rtp_h264_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + rtph264depay->fu_marker = marker; + + /* if NAL unit ends, flush the adapter */ +- if (E) ++ if (E) { + gst_rtp_h264_finish_fragmentation_unit (rtph264depay); ++ GST_DEBUG_OBJECT (rtph264depay, "End of Fragmentation Unit"); ++ } else { ++ guint limit = rtph264depay->max_fragmentation_unit_size ? ++ rtph264depay->max_fragmentation_unit_size : ++ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE; ++ if (gst_adapter_available (rtph264depay->adapter) > limit) { ++ GST_WARNING_OBJECT (rtph264depay, ++ "Too big (> %u bytes) fragmentation unit, dropping.", limit); ++ rtph264depay->wait_start = TRUE; ++ rtph264depay->current_fu_type = 0; ++ gst_adapter_clear (rtph264depay->adapter); ++ return NULL; ++ } ++ } + break; + } + default: +diff --git a/gst/rtp/gstrtph264depay.h b/gst/rtp/gstrtph264depay.h +index ba41312..a02a65d 100644 +--- a/gst/rtp/gstrtph264depay.h ++++ b/gst/rtp/gstrtph264depay.h +@@ -62,6 +62,8 @@ struct _GstRtpH264Depay + GstClockTime fu_timestamp; + gboolean fu_marker; + ++ guint max_fragmentation_unit_size; ++ + /* misc */ + GPtrArray *sps; + GPtrArray *pps; +diff --git a/gst/rtp/gstrtph265depay.c b/gst/rtp/gstrtph265depay.c +index 551e08a..b046030 100644 +--- a/gst/rtp/gstrtph265depay.c ++++ b/gst/rtp/gstrtph265depay.c +@@ -38,6 +38,13 @@ GST_DEBUG_CATEGORY_STATIC (rtph265depay_debug); + * expressed a restriction or preference via caps */ + #define DEFAULT_STREAM_FORMAT GST_H265_STREAM_FORMAT_BYTESTREAM + #define DEFAULT_ACCESS_UNIT FALSE ++#define DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE (32 * 1024 * 1024) ++ ++enum ++{ ++ PROP_0, ++ PROP_MAX_FRAGMENTATION_UNIT_SIZE, ++}; + + /* 3 zero bytes syncword */ + static const guint8 sync_bytes[] = { 0, 0, 0, 1 }; +@@ -99,6 +106,10 @@ G_DEFINE_TYPE (GstRtpH265Depay, gst_rtp_h265_depay, + GST_TYPE_RTP_BASE_DEPAYLOAD); + + static void gst_rtp_h265_depay_finalize (GObject * object); ++static void gst_rtp_h265_depay_set_property (GObject * object, guint prop_id, ++ const GValue * value, GParamSpec * pspec); ++static void gst_rtp_h265_depay_get_property (GObject * object, guint prop_id, ++ GValue * value, GParamSpec * pspec); + + static GstStateChangeReturn gst_rtp_h265_depay_change_state (GstElement * + element, GstStateChange transition); +@@ -128,6 +139,24 @@ gst_rtp_h265_depay_class_init (GstRtpH265DepayClass * klass) + gstrtpbasedepayload_class = (GstRTPBaseDepayloadClass *) klass; + + gobject_class->finalize = gst_rtp_h265_depay_finalize; ++ gobject_class->set_property = gst_rtp_h265_depay_set_property; ++ gobject_class->get_property = gst_rtp_h265_depay_get_property; ++ ++ /** ++ * GstRtpH265Depay:max-fragmentation-unit-size: ++ * ++ * Maximum size in bytes for a fragmentation unit. Larger units ++ * will be dropped to prevent excessive memory usage. ++ * ++ * Use 0 for automatic. ++ */ ++ g_object_class_install_property (gobject_class, ++ PROP_MAX_FRAGMENTATION_UNIT_SIZE, ++ g_param_spec_uint ("max-fragmentation-unit-size", ++ "Max Fragmentation Unit Size", ++ "Maximum size in bytes for a fragmentation unit (0 = auto)", 0, ++ G_MAXUINT, DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE, ++ G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS)); + + gst_element_class_add_static_pad_template (gstelement_class, + &gst_rtp_h265_depay_src_template); +@@ -145,6 +174,38 @@ gst_rtp_h265_depay_class_init (GstRtpH265DepayClass * klass) + gstrtpbasedepayload_class->handle_event = gst_rtp_h265_depay_handle_event; + } + ++static void ++gst_rtp_h265_depay_set_property (GObject * object, guint prop_id, ++ const GValue * value, GParamSpec * pspec) ++{ ++ GstRtpH265Depay *self = GST_RTP_H265_DEPAY (object); ++ ++ switch (prop_id) { ++ case PROP_MAX_FRAGMENTATION_UNIT_SIZE: ++ self->max_fragmentation_unit_size = g_value_get_uint (value); ++ break; ++ default: ++ G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); ++ break; ++ } ++} ++ ++static void ++gst_rtp_h265_depay_get_property (GObject * object, guint prop_id, ++ GValue * value, GParamSpec * pspec) ++{ ++ GstRtpH265Depay *self = GST_RTP_H265_DEPAY (object); ++ ++ switch (prop_id) { ++ case PROP_MAX_FRAGMENTATION_UNIT_SIZE: ++ g_value_set_uint (value, self->max_fragmentation_unit_size); ++ break; ++ default: ++ G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); ++ break; ++ } ++} ++ + static void + gst_rtp_h265_depay_init (GstRtpH265Depay * rtph265depay) + { +@@ -161,6 +222,8 @@ gst_rtp_h265_depay_init (GstRtpH265Depay * rtph265depay) + (GDestroyNotify) gst_buffer_unref); + rtph265depay->pps = g_ptr_array_new_with_free_func ( + (GDestroyNotify) gst_buffer_unref); ++ rtph265depay->max_fragmentation_unit_size = ++ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE; + } + + static void +@@ -1520,6 +1583,18 @@ gst_rtp_h265_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + if (E) { + gst_rtp_h265_finish_fragmentation_unit (rtph265depay); + GST_DEBUG_OBJECT (rtph265depay, "End of Fragmentation Unit"); ++ } else { ++ guint limit = rtph265depay->max_fragmentation_unit_size ? ++ rtph265depay->max_fragmentation_unit_size : ++ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE; ++ if (gst_adapter_available (rtph265depay->adapter) > limit) { ++ GST_WARNING_OBJECT (rtph265depay, ++ "Too big (> %u bytes) fragmentation unit, dropping.", limit); ++ rtph265depay->wait_start = TRUE; ++ rtph265depay->current_fu_type = 0; ++ gst_adapter_clear (rtph265depay->adapter); ++ return NULL; ++ } + } + break; + } +diff --git a/gst/rtp/gstrtph265depay.h b/gst/rtp/gstrtph265depay.h +index cf17694..e851d3b 100644 +--- a/gst/rtp/gstrtph265depay.h ++++ b/gst/rtp/gstrtph265depay.h +@@ -76,6 +76,8 @@ struct _GstRtpH265Depay + GstClockTime fu_timestamp; + gboolean fu_marker; + ++ guint max_fragmentation_unit_size; ++ + /* misc */ + GPtrArray *vps; + GPtrArray *sps; diff --git a/SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch b/SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch new file mode 100644 index 0000000..986b84c --- /dev/null +++ b/SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch @@ -0,0 +1,365 @@ +From 901efd4d415752fc6b539bdebcb550c9345f6487 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:00:34 +0300 +Subject: [PATCH 1/6] avidemux: Make sure enough data is available when parsing + FUJIFILM strd + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213 + +Part-of: +--- + gst/avi/gstavidemux.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 834af76..4be47b2 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -3821,13 +3821,13 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf) + + ptr += 98; + left -= 98; +- if (!memcmp (ptr, "FUJIFILM", 8)) { ++ if (left >= 10 && !memcmp (ptr, "FUJIFILM", 8)) { + GST_MEMDUMP_OBJECT (avi, "fujifim tag", ptr, 48); + + ptr += 10; + left -= 10; + sub_size = 0; +- while (ptr[sub_size] && sub_size < left) ++ while (sub_size < left && ptr[sub_size]) + sub_size++; + + if (avi->globaltags == NULL) +@@ -3838,21 +3838,24 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf) + parse_tag_value (avi, avi->globaltags, GST_TAG_DEVICE_MODEL, ptr, + sub_size); + +- while (ptr[sub_size] == '\0' && sub_size < left) ++ while (sub_size < left && ptr[sub_size] == '\0') + sub_size++; + + ptr += sub_size; + left -= sub_size; + sub_size = 0; +- while (ptr[sub_size] && sub_size < left) ++ while (sub_size < left && ptr[sub_size]) + sub_size++; +- if (ptr[4] == ':') +- ptr[4] = '-'; +- if (ptr[7] == ':') +- ptr[7] = '-'; + +- parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr, +- sub_size); ++ if (sub_size >= 8) { ++ if (ptr[4] == ':') ++ ptr[4] = '-'; ++ if (ptr[7] == ':') ++ ptr[7] = '-'; ++ ++ parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr, ++ sub_size); ++ } + } + } + } + +From 3f527d85b7280b020b328121ef4c0e62c333f79f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:27:37 +0300 +Subject: [PATCH 2/6] avidemux: Don't modify read-only mapped buffer data + +And improve const-correctness in many places. + +Part-of: +--- + gst/avi/gstavidemux.c | 59 ++++++++++++++++++++++++++++--------------- + 1 file changed, 38 insertions(+), 21 deletions(-) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 4be47b2..7a8957c 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -126,7 +126,7 @@ static void gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf); + static void gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf); + + static void parse_tag_value (GstAviDemux * avi, GstTagList * taglist, +- const gchar * type, guint8 * ptr, guint tsize); ++ const gchar * type, const guint8 * ptr, guint tsize); + + /* GObject methods */ + +@@ -1238,7 +1238,7 @@ gst_avi_demux_parse_superindex (GstAviDemux * avi, + GstBuffer * buf, guint64 ** _indexes) + { + GstMapInfo map; +- guint8 *data; ++ const guint8 *data; + guint16 bpe = 16; + guint32 num, i; + guint64 *indexes; +@@ -1526,7 +1526,7 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream, + GstBuffer * buf) + { + GstMapInfo map; +- guint8 *data; ++ const guint8 *data; + guint16 bpe; + guint32 num, i; + guint64 baseoff; +@@ -1974,7 +1974,7 @@ gst_avi_demux_check_caps (GstAviDemux * avi, GstAviStream * stream, + /* some muxers put invalid bytestream stuff in h264 extra data */ + val = gst_structure_get_value (s, "codec_data"); + if (val && (buf = gst_value_get_buffer (val))) { +- guint8 *data; ++ const guint8 *data; + gint size; + GstMapInfo map; + +@@ -2730,7 +2730,7 @@ gst_avi_demux_parse_index (GstAviDemux * avi, GstBuffer * buf) + { + GstMapInfo map; + guint i, num, n; +- gst_riff_index_entry *index; ++ const gst_riff_index_entry *index; + GstClockTime stamp; + GstAviStream *stream; + GstAviIndexEntry entry; +@@ -3714,7 +3714,7 @@ static void + gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf) + { + GstMapInfo map; +- gchar *ptr; ++ const gchar *ptr; + gsize left; + gchar *safedata = NULL; + +@@ -3732,7 +3732,7 @@ gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf) + */ + + /* skip eventual initial whitespace */ +- ptr = (gchar *) map.data; ++ ptr = (const gchar *) map.data; + left = map.size; + + while (left > 0 && g_ascii_isspace (ptr[0])) { +@@ -3769,7 +3769,7 @@ non_parsable: + + static void + parse_tag_value (GstAviDemux * avi, GstTagList * taglist, const gchar * type, +- guint8 * ptr, guint tsize) ++ const guint8 * ptr, guint tsize) + { + static const gchar *env_vars[] = { "GST_AVI_TAG_ENCODING", + "GST_RIFF_TAG_ENCODING", "GST_TAG_ENCODING", NULL +@@ -3809,7 +3809,7 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf) + + gst_buffer_map (buf, &map, GST_MAP_READ); + if (map.size > 4) { +- guint8 *ptr = map.data; ++ const guint8 *ptr = map.data; + gsize left = map.size; + + /* parsing based on +@@ -3848,13 +3848,17 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf) + sub_size++; + + if (sub_size >= 8) { +- if (ptr[4] == ':') +- ptr[4] = '-'; +- if (ptr[7] == ':') +- ptr[7] = '-'; ++ guint8 *ptr_dup = g_memdup2 (ptr, sub_size); ++ ++ if (ptr_dup[4] == ':') ++ ptr_dup[4] = '-'; ++ if (ptr_dup[7] == ':') ++ ptr_dup[7] = '-'; + +- parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr, ++ parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr_dup, + sub_size); ++ ++ g_free (ptr_dup); + } + } + } +@@ -3877,7 +3881,7 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf, + GstTagList ** _taglist) + { + GstMapInfo info; +- guint8 *ptr; ++ const guint8 *ptr; + gsize left; + guint tsize; + guint32 tag; +@@ -3946,14 +3950,27 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf, + type = GST_TAG_ENCODER; + break; + case 0x13: /* CreationDate */ +- type = GST_TAG_DATE_TIME; +- if (left > 7) { +- if (ptr[4] == ':') +- ptr[4] = '-'; +- if (ptr[7] == ':') +- ptr[7] = '-'; ++ { ++ type = NULL; ++ ++ if (left > 7 && ptr[0] != '\0') { ++ guint8 *ptr_dup = g_memdup2 (ptr, sub_size); ++ ++ if (ptr_dup[4] == ':') ++ ptr_dup[4] = '-'; ++ if (ptr_dup[7] == ':') ++ ptr_dup[7] = '-'; ++ ++ GST_DEBUG_OBJECT (avi, "mapped tag %u to tag %s", sub_tag, ++ GST_TAG_DATE_TIME); ++ ++ parse_tag_value (avi, taglist, GST_TAG_DATE_TIME, ptr_dup, ++ sub_size); ++ ++ g_free (ptr_dup); + } + break; ++ } + default: + type = NULL; + break; + +From 345735b66d7049991fb27a8f64ea1adfc9352e46 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:29:14 +0300 +Subject: [PATCH 3/6] avidemux: Check that at least 1 byte is available before + dereferencing tag pointer + +Part-of: +--- + gst/avi/gstavidemux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 7a8957c..64a28d2 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -3975,7 +3975,7 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf, + type = NULL; + break; + } +- if (type != NULL && ptr[0] != '\0') { ++ if (type != NULL && left > 0 && ptr[0] != '\0') { + GST_DEBUG_OBJECT (avi, "mapped tag %u to tag %s", sub_tag, type); + + parse_tag_value (avi, taglist, type, ptr, sub_size); + +From a224a7a063ef1a53c1210c9c9bbfeb610d0d2253 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:35:12 +0300 +Subject: [PATCH 4/6] avidemux: Use correct divisor for calculating available + number of vprp field infos + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213 + +Part-of: +--- + gst/avi/gstavidemux.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 64a28d2..6a4bf7a 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -1805,7 +1805,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element, + + /* size checking */ + /* calculate fields based on size */ +- k = (size - G_STRUCT_OFFSET (gst_riff_vprp, field_info)) / vprp->fields; ++ k = (size - G_STRUCT_OFFSET (gst_riff_vprp, ++ field_info)) / sizeof (vprp->field_info[0]); + if (vprp->fields > k) { + GST_WARNING_OBJECT (element, + "vprp header indicated %d fields, only %d available", vprp->fields, k); + +From 6b063d86c99298cb8901a4134b82f7bcc84fa6a9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 13:22:04 +0300 +Subject: [PATCH 5/6] avidemux: Avoid integer overflow in bounds checks when + parsing the index + +Part-of: +--- + gst/avi/gstavidemux.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 6a4bf7a..20fd207 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -1280,8 +1280,13 @@ gst_avi_demux_parse_superindex (GstAviDemux * avi, + + indexes = g_new (guint64, num + 1); + for (i = 0; i < num; i++) { +- if (size < 24 + bpe * (i + 1)) ++ gsize required_size; ++ ++ if (!g_size_checked_mul (&required_size, bpe, i + 1)) ++ break; ++ if (size - 24 < required_size) + break; ++ + indexes[i] = GST_READ_UINT64_LE (&data[24 + bpe * i]); + GST_DEBUG_OBJECT (avi, "index %d at %" G_GUINT64_FORMAT, i, indexes[i]); + } +@@ -1568,8 +1573,11 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream, + + for (i = 0; i < num; i++) { + GstAviIndexEntry entry; ++ gsize required_size; + +- if (map.size < 24 + bpe * (i + 1)) ++ if (!g_size_checked_mul (&required_size, bpe, i + 1)) ++ break; ++ if (map.size - 24 < required_size) + break; + + /* fill in offset and size. offset contains the keyframe flag in the + +From a6ac7c3a64bce23d504f0b62313120ae1bfb08e2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 13:22:38 +0300 +Subject: [PATCH 6/6] avidemux: Don't read a subindex with too many items + +Part-of: +--- + gst/avi/gstavidemux.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 20fd207..4d3f608 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -1569,6 +1569,10 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream, + if (num == 0) + goto empty_index; + ++ /* this can't work out well ... */ ++ if (num > G_MAXUINT32 >> 1) ++ goto invalid_params; ++ + GST_INFO_OBJECT (avi, "Parsing subindex, nr_entries = %6d", num); + + for (i = 0; i < num; i++) { +@@ -1620,6 +1624,11 @@ not_implemented: + gst_buffer_unref (buf); + return FALSE; + } ++invalid_params: ++ { ++ GST_ERROR_OBJECT (avi, "invalid subindex parameters (num = %d)", num); ++ goto done; /* continue */ ++ } + empty_index: + { + GST_DEBUG_OBJECT (avi, "the index is empty"); diff --git a/SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch b/SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch new file mode 100644 index 0000000..7ea128d --- /dev/null +++ b/SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch @@ -0,0 +1,35 @@ +From b3a928896a6a87897d9f42e2b10088eb0e13e418 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:35:12 +0300 +Subject: [PATCH] avidemux: Use correct divisor for calculating available + number of vprp field infos + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213 + +Part-of: + +NOTE: The functional change in this patch (CVE-2026-73434) was already +included in the CVE-2026-73433 patch (Patch11). This patch is adapted +as a no-op for CVE tracking purposes. +--- + gst/avi/gstavidemux.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c +index 4be47b2..dbe0d88 100644 +--- a/gst/avi/gstavidemux.c ++++ b/gst/avi/gstavidemux.c +@@ -1822,8 +1822,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element, + + /* size checking */ + /* calculate fields based on size */ +- k = (size - G_STRUCT_OFFSET (gst_riff_vprp, +- field_info)) / sizeof (vprp->field_info[0]); ++ k = (size - G_STRUCT_OFFSET (gst_riff_vprp, ++ field_info)) / sizeof (vprp->field_info[0]); + if (vprp->fields > k) { + GST_WARNING_OBJECT (element, + "vprp header indicated %d fields, only %d available", vprp->fields, k); +-- +2.43.0 + diff --git a/SPECS/gstreamer1-plugins-good.spec b/SPECS/gstreamer1-plugins-good.spec index bc94f67..418cb40 100644 --- a/SPECS/gstreamer1-plugins-good.spec +++ b/SPECS/gstreamer1-plugins-good.spec @@ -15,7 +15,7 @@ Name: gstreamer1-plugins-good Version: 1.16.1 -Release: 7%{?gitcommit:.git%{shortcommit}}%{?dist} +Release: 7%{?gitcommit:.git%{shortcommit}}%{?dist}.3 Summary: GStreamer plugins with good code and licensing License: LGPLv2+ @@ -42,6 +42,15 @@ Patch9: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch # https://issues.redhat.com/browse/RHEL-184473 # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811 Patch10: gstreamer1-plugins-good-1.16.1-CVE-2026-53705.patch +# https://issues.redhat.com/browse/RHEL-239068 +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231 +Patch11: gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch +# https://issues.redhat.com/browse/RHEL-224145 +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12244 +Patch12: gstreamer1-plugins-good-1.16.1-CVE-2026-18649.patch +# https://issues.redhat.com/browse/RHEL-239048 +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/0bcc6564c7deedc7d6d7373a2ab6479c9bf3889f +Patch13: gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch BuildRequires: gcc BuildRequires: gcc-c++ @@ -186,6 +195,9 @@ to be installed. %patch8 -p1 %patch9 -p1 %patch10 -p1 +%patch11 -p1 +%patch12 -p1 +%patch13 -p1 %build %configure --disable-silent-rules --disable-fatal-warnings \ @@ -370,6 +382,18 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';' %changelog +* Thu Aug 13 2026 RHEL Packaging Agent - 1.16.1-7.3 +- Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling + Resolves: RHEL-239048 + +* Thu Aug 13 2026 RHEL Packaging Agent - 1.16.1-7.2 +- Fix CVE-2026-18649 in H.264/H.265 RTP depayloaders + Resolves: RHEL-224145 + +* Thu Aug 13 2026 RHEL Packaging Agent - 1.16.1-7.1 +- Fix multiple security issues in AVI demuxer (CVE-2026-73433) + Resolves: RHEL-239068 + * Fri Jun 19 2026 RHEL Packaging Agent - 1.16.1-7 - Fix integer overflow vulnerabilities in wavpackdec (CVE-2026-53705) Resolves: RHEL-184473