From c0a04e4244ec7e08e8e808dfee3259889dc5eca5 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 17 Aug 2026 11:40:50 -0400 Subject: [PATCH] import Oracle_OSS gstreamer1-plugins-good-1.26.7-2.el10_2.5 --- ...1-plugins-good-1.26.7-CVE-2026-73433.patch | 66 +++++++++++++++++++ ...1-plugins-good-1.26.7-CVE-2026-73434.patch | 27 ++++++++ gstreamer1-plugins-good.spec | 15 ++++- 3 files changed, 107 insertions(+), 1 deletion(-) create mode 100644 gstreamer1-plugins-good-1.26.7-CVE-2026-73433.patch create mode 100644 gstreamer1-plugins-good-1.26.7-CVE-2026-73434.patch diff --git a/gstreamer1-plugins-good-1.26.7-CVE-2026-73433.patch b/gstreamer1-plugins-good-1.26.7-CVE-2026-73433.patch new file mode 100644 index 0000000..f200a1c --- /dev/null +++ b/gstreamer1-plugins-good-1.26.7-CVE-2026-73433.patch @@ -0,0 +1,66 @@ +From 8fba360469fdd60ce516b9a4c5a374228cb57721 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:00:34 +0300 +Subject: [PATCH] avidemux: Make sure enough data is available when parsing + FUJIFILM strd + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213 + +Part-of: +--- + .../gst-plugins-good/gst/avi/gstavidemux.c | 23 +++++++++++-------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c +index 82d5d4857c..4da9447b9a 100644 +--- a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c ++++ b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c +@@ -3828,13 +3828,13 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf) + + ptr += 98; + left -= 98; +- if (!memcmp (ptr, "FUJIFILM", 8)) { ++ if (left >= 10 && !memcmp (ptr, "FUJIFILM", 8)) { + GST_MEMDUMP_OBJECT (avi, "fujifim tag", ptr, 48); + + ptr += 10; + left -= 10; + sub_size = 0; +- while (ptr[sub_size] && sub_size < left) ++ while (sub_size < left && ptr[sub_size]) + sub_size++; + + if (avi->globaltags == NULL) +@@ -3845,21 +3845,24 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf) + parse_tag_value (avi, avi->globaltags, GST_TAG_DEVICE_MODEL, ptr, + sub_size); + +- while (ptr[sub_size] == '\0' && sub_size < left) ++ while (sub_size < left && ptr[sub_size] == '\0') + sub_size++; + + ptr += sub_size; + left -= sub_size; + sub_size = 0; +- while (ptr[sub_size] && sub_size < left) ++ while (sub_size < left && ptr[sub_size]) + sub_size++; +- if (ptr[4] == ':') +- ptr[4] = '-'; +- if (ptr[7] == ':') +- ptr[7] = '-'; + +- parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr, +- sub_size); ++ if (sub_size >= 8) { ++ if (ptr[4] == ':') ++ ptr[4] = '-'; ++ if (ptr[7] == ':') ++ ptr[7] = '-'; ++ ++ parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr, ++ sub_size); ++ } + } + } + } diff --git a/gstreamer1-plugins-good-1.26.7-CVE-2026-73434.patch b/gstreamer1-plugins-good-1.26.7-CVE-2026-73434.patch new file mode 100644 index 0000000..d88458a --- /dev/null +++ b/gstreamer1-plugins-good-1.26.7-CVE-2026-73434.patch @@ -0,0 +1,27 @@ +From 91452c4f39f2d21dd9cbbd5ee453211132e65e52 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 14 Jul 2026 12:35:12 +0300 +Subject: [PATCH] avidemux: Use correct divisor for calculating available + number of vprp field infos + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213 + +Part-of: +--- + subprojects/gst-plugins-good/gst/avi/gstavidemux.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c +index 82d5d4857c..3a85909eb0 100644 +--- a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c ++++ b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c +@@ -1808,7 +1808,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element, + + /* size checking */ + /* calculate fields based on size */ +- k = (size - G_STRUCT_OFFSET (gst_riff_vprp, field_info)) / vprp->fields; ++ k = (size - G_STRUCT_OFFSET (gst_riff_vprp, ++ field_info)) / sizeof (vprp->field_info[0]); + if (vprp->fields > k) { + GST_WARNING_OBJECT (element, + "vprp header indicated %d fields, only %d available", vprp->fields, k); diff --git a/gstreamer1-plugins-good.spec b/gstreamer1-plugins-good.spec index 9e7a93e..b8427e2 100644 --- a/gstreamer1-plugins-good.spec +++ b/gstreamer1-plugins-good.spec @@ -35,7 +35,7 @@ Name: gstreamer1-plugins-good Version: 1.26.7 -Release: 2%{?dist}.3 +Release: 2%{?dist}.5 Summary: GStreamer plugins with good code and licensing License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0 @@ -65,6 +65,10 @@ Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-53705.patch Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-5056.patch # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234 Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-18649.patch +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/bb8fb5a9bf15fb845863430281e4bf908aec7090 +Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-73433.patch +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/0bcc6564c7deedc7d6d7373a2ab6479c9bf3889f +Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-73434.patch BuildRequires: meson >= 0.48.0 BuildRequires: gcc @@ -385,6 +389,15 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';' %changelog +* Thu Aug 13 2026 RHEL Packaging Agent - 1.26.7-2.5 +- Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling + Resolves: RHEL-239045 + +* Thu Aug 13 2026 RHEL Packaging Agent - 1.26.7-2.4 +- Fix out-of-bounds reads when parsing FUJIFILM strd metadata in AVI + files (CVE-2026-73433) + Resolves: RHEL-239062 + * Fri Aug 07 2026 RHEL Packaging Agent - 1.26.7-2.3 - Fix excessive memory allocation from malicious RTP fragmentation unit packets in rtph264depay/rtph265depay (CVE-2026-18649)