Add patch for CVE-2026-3083 and CVE-2026-3085
Resolves: RHEL-156142, RHEL-156119
This commit is contained in:
Wim Taymans
parent
64a6fd029b
commit
b440b1b761
107
0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
Normal file
107
0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
Normal file
@ -0,0 +1,107 @@
|
||||
From 88eb53d12c19f16ce9b3b6b8766084effcadfc1a Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Tim-Philipp=20M=C3=BCller?= <tim@centricular.com>
|
||||
Date: Sun, 8 Feb 2026 16:01:21 +0000
|
||||
Subject: [PATCH] rtpqdm2depay: error out if anyone tries to use this element
|
||||
|
||||
Forbid use of this element and comment out all processing code.
|
||||
|
||||
There is no plausible reason this code should ever be executed in 2026
|
||||
seeing that this was a streaming format produced by Darwin Streaming Server
|
||||
ca 2009 which hasn't been in active use for well over a decade.
|
||||
|
||||
We simply error out for now as defensive measure and will remove the
|
||||
element entirely in the next release cycle.
|
||||
|
||||
The processing functions are hairy and rather tedious to fix without
|
||||
at least some sample stream at hand.
|
||||
|
||||
If anyone actually does have a legitimate need for this element and
|
||||
can provide a sample streams, we will happily implement a depayloader
|
||||
in Rust.
|
||||
|
||||
Fixes ZDI-CAN-28850, ZDI-CAN-28851, ZDI-CAN-28851, ZDI-CAN-28850, GST-SA-2026-0008.
|
||||
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4903
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4890
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/10886>
|
||||
---
|
||||
.../gst-plugins-good/gst/rtp/gstrtpqdmdepay.c | 25 ++++++++++++++++++-
|
||||
1 file changed, 24 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c
|
||||
index 3edfb46301..1d69fc2e1c 100644
|
||||
--- a/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c
|
||||
+++ b/subprojects/gst-plugins-good/gst/rtp/gstrtpqdmdepay.c
|
||||
@@ -57,11 +57,13 @@ G_DEFINE_TYPE (GstRtpQDM2Depay, gst_rtp_qdm2_depay,
|
||||
GST_ELEMENT_REGISTER_DEFINE_WITH_CODE (rtpqdm2depay, "rtpqdm2depay",
|
||||
GST_RANK_SECONDARY, GST_TYPE_RTP_QDM2_DEPAY, _do_init);
|
||||
|
||||
+#if 0
|
||||
static const guint8 headheader[20] = {
|
||||
0x0, 0x0, 0x0, 0xc, 0x66, 0x72, 0x6d, 0x61,
|
||||
0x51, 0x44, 0x4d, 0x32, 0x0, 0x0, 0x0, 0x24,
|
||||
0x51, 0x44, 0x43, 0x41
|
||||
};
|
||||
+#endif
|
||||
|
||||
static void gst_rtp_qdm2_depay_finalize (GObject * object);
|
||||
|
||||
@@ -138,6 +140,7 @@ gst_rtp_qdm2_depay_setcaps (GstRTPBaseDepayload * filter, GstCaps * caps)
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
+#if 0
|
||||
static void
|
||||
flush_data (GstRtpQDM2Depay * depay)
|
||||
{
|
||||
@@ -230,10 +233,26 @@ add_packet (GstRtpQDM2Depay * depay, guint32 pid, guint32 len, guint8 * data)
|
||||
memcpy (packet->data + packet->offs, data, len);
|
||||
packet->offs += len;
|
||||
}
|
||||
+#endif
|
||||
|
||||
static GstBuffer *
|
||||
gst_rtp_qdm2_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
|
||||
{
|
||||
+ /* There is no plausible reason this code should ever be executed in 2026
|
||||
+ * seeing that this was a streaming format produced by Darwin Streaming Server
|
||||
+ * ca 2009 which hasn't been in active use for well over a decade.
|
||||
+ *
|
||||
+ * We simply return here as defensive measure.
|
||||
+ *
|
||||
+ * We post an error message in the state change function, so this processing
|
||||
+ * function should never be reached, we just ifdef the code out for clarity.
|
||||
+ *
|
||||
+ * If anyone actually does have a legitimate need for this and can provide
|
||||
+ * sample streams, we will happily implement a depayloader in Rust.
|
||||
+ */
|
||||
+ return NULL;
|
||||
+
|
||||
+#if 0
|
||||
GstRtpQDM2Depay *rtpqdm2depay;
|
||||
GstBuffer *outbuf = NULL;
|
||||
guint16 seq;
|
||||
@@ -378,6 +397,7 @@ bad_packet:
|
||||
(NULL), ("Packet was too short"));
|
||||
return NULL;
|
||||
}
|
||||
+#endif
|
||||
}
|
||||
|
||||
static GstStateChangeReturn
|
||||
@@ -391,7 +411,10 @@ gst_rtp_qdm2_depay_change_state (GstElement * element,
|
||||
|
||||
switch (transition) {
|
||||
case GST_STATE_CHANGE_NULL_TO_READY:
|
||||
- break;
|
||||
+ GST_ELEMENT_ERROR (rtpqdm2depay, STREAM, DECODE,
|
||||
+ ("This element should not be used."),
|
||||
+ ("Please report an issue if you encounter this message."));
|
||||
+ return GST_STATE_CHANGE_FAILURE;
|
||||
case GST_STATE_CHANGE_READY_TO_PAUSED:
|
||||
gst_adapter_clear (rtpqdm2depay->adapter);
|
||||
break;
|
||||
--
|
||||
2.53.0
|
||||
|
||||
@ -35,7 +35,7 @@
|
||||
|
||||
Name: gstreamer1-plugins-good
|
||||
Version: 1.26.7
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
Summary: GStreamer plugins with good code and licensing
|
||||
|
||||
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
|
||||
@ -55,6 +55,8 @@ Source0: http://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugin
|
||||
# See http://www.freedesktop.org/software/appstream/docs/ for more details.
|
||||
Source1: gstreamer-good.appdata.xml
|
||||
|
||||
Patch: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
|
||||
|
||||
BuildRequires: meson >= 0.48.0
|
||||
BuildRequires: gcc
|
||||
BuildRequires: gcc-c++
|
||||
@ -215,7 +217,8 @@ to be installed.
|
||||
|
||||
|
||||
%prep
|
||||
%setup -q -n gst-plugins-good-%{version}
|
||||
%autosetup -n gst-plugins-good-%{version} -p3
|
||||
|
||||
|
||||
%build
|
||||
%meson \
|
||||
@ -373,6 +376,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
|
||||
|
||||
|
||||
%changelog
|
||||
* Tue Mar 31 2026 Wim Taymans <wtaymans@redhat.com> - 1.26.7-2
|
||||
- Add patch for CVE-2026-3083 and CVE-2026-3085
|
||||
Resolves: RHEL-156142, RHEL-156119
|
||||
|
||||
* Tue Nov 04 2025 Wim Taymans <wtaymans@redhat.com> - 1.26.7-1
|
||||
- Update to 1.26.7
|
||||
Resolves: RHEL-126057
|
||||
|
||||
Loading…
Reference in New Issue
Block a user