From c54a738afe179fdba6d0d779d4cc2510d4ef9c1c Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 11 Aug 2026 21:38:07 -0400 Subject: [PATCH] import Oracle_OSS gstreamer1-plugins-good-1.22.12-7.el9_8.2 --- ...-plugins-good-1.22.12-CVE-2026-18649.patch | 349 ++++++++++++++++++ SPECS/gstreamer1-plugins-good.spec | 10 +- 2 files changed, 358 insertions(+), 1 deletion(-) create mode 100644 SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18649.patch diff --git a/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18649.patch b/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18649.patch new file mode 100644 index 0000000..a242734 --- /dev/null +++ b/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18649.patch @@ -0,0 +1,349 @@ +From 00fc47790c66d86944f48b49beda8e688de22390 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Wed, 29 Jul 2026 17:39:56 +0300 +Subject: [PATCH 1/3] rtph264depay: rtph265depay: Limit the maximum + fragmentation unit size + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5224 + +Part-of: +--- + .../gst/rtp/gstrtph264depay.c | 43 ++++++++++- + .../gst/rtp/gstrtph264depay.h | 1 + + .../gst/rtp/gstrtph265depay.c | 71 +++++++++++++++++++ + .../gst/rtp/gstrtph265depay.h | 2 + + 4 files changed, 116 insertions(+), 1 deletion(-) + +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c +index 9cef347c21..9ccd8ab24e 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c +@@ -41,12 +41,14 @@ GST_DEBUG_CATEGORY_STATIC (rtph264depay_debug); + #define DEFAULT_ACCESS_UNIT FALSE + #define DEFAULT_WAIT_FOR_KEYFRAME FALSE + #define DEFAULT_REQUEST_KEYFRAME FALSE ++#define DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE (32 * 1024 * 1024) + + enum + { + PROP_0, + PROP_WAIT_FOR_KEYFRAME, + PROP_REQUEST_KEYFRAME, ++ PROP_MAX_FRAGMENTATION_UNIT_SIZE, + }; + + +@@ -126,6 +128,9 @@ gst_rtp_h264_depay_set_property (GObject * object, guint prop_id, + case PROP_REQUEST_KEYFRAME: + self->request_keyframe = g_value_get_boolean (value); + break; ++ case PROP_MAX_FRAGMENTATION_UNIT_SIZE: ++ self->max_fragmentation_unit_size = g_value_get_uint (value); ++ break; + default: + G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); + break; +@@ -145,6 +150,9 @@ gst_rtp_h264_depay_get_property (GObject * object, guint prop_id, + case PROP_REQUEST_KEYFRAME: + g_value_set_boolean (value, self->request_keyframe); + break; ++ case PROP_MAX_FRAGMENTATION_UNIT_SIZE: ++ g_value_set_uint (value, self->max_fragmentation_unit_size); ++ break; + default: + G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); + break; +@@ -194,6 +202,24 @@ gst_rtp_h264_depay_class_init (GstRtpH264DepayClass * klass) + DEFAULT_REQUEST_KEYFRAME, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS)); + ++ /** ++ * GstRtpH264Depay:max-fragmentation-unit-size: ++ * ++ * Maximum size in bytes for a fragmentation unit. Larger units ++ * will be dropped to prevent excessive memory usage. ++ * ++ * Use 0 for automatic. ++ * ++ * Since: 1.28.6 ++ */ ++ g_object_class_install_property (gobject_class, ++ PROP_MAX_FRAGMENTATION_UNIT_SIZE, ++ g_param_spec_uint ("max-fragmentation-unit-size", ++ "Max Fragmentation Unit Size", ++ "Maximum size in bytes for a fragmentation unit (0 = auto)", 0, ++ G_MAXUINT, DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE, ++ G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS)); ++ + gst_element_class_add_static_pad_template (gstelement_class, + &gst_rtp_h264_depay_src_template); + gst_element_class_add_static_pad_template (gstelement_class, +@@ -223,6 +249,8 @@ gst_rtp_h264_depay_init (GstRtpH264Depay * rtph264depay) + (GDestroyNotify) gst_buffer_unref); + rtph264depay->wait_for_keyframe = DEFAULT_WAIT_FOR_KEYFRAME; + rtph264depay->request_keyframe = DEFAULT_REQUEST_KEYFRAME; ++ rtph264depay->max_fragmentation_unit_size = ++ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE; + } + + static void +@@ -1396,8 +1424,21 @@ gst_rtp_h264_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + rtph264depay->fu_marker = marker; + + /* if NAL unit ends, flush the adapter */ +- if (E) ++ if (E) { + gst_rtp_h264_finish_fragmentation_unit (rtph264depay); ++ GST_DEBUG_OBJECT (rtph264depay, "End of Fragmentation Unit"); ++ } else { ++ guint limit = rtph264depay->max_fragmentation_unit_size ? ++ rtph264depay->max_fragmentation_unit_size : ++ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE; ++ if (gst_adapter_available (rtph264depay->adapter) > limit) { ++ GST_WARNING_OBJECT (rtph264depay, ++ "Too big (> %u bytes) fragmentation unit, dropping.", limit); ++ gst_rtp_base_depayload_flush (depayload, FALSE); ++ gst_adapter_clear (rtph264depay->adapter); ++ return NULL; ++ } ++ } + break; + } + default: +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.h b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.h +index 8ca7381beb..ae3ee4a6e2 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.h ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.h +@@ -75,6 +75,7 @@ struct _GstRtpH264Depay + gboolean wait_for_keyframe; + gboolean request_keyframe; + gboolean waiting_for_keyframe; ++ guint max_fragmentation_unit_size; + }; + + struct _GstRtpH264DepayClass +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c +index 41d2762ffe..b8d2943228 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c +@@ -39,6 +39,13 @@ GST_DEBUG_CATEGORY_STATIC (rtph265depay_debug); + * expressed a restriction or preference via caps */ + #define DEFAULT_STREAM_FORMAT GST_H265_STREAM_FORMAT_BYTESTREAM + #define DEFAULT_ACCESS_UNIT FALSE ++#define DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE (32 * 1024 * 1024) ++ ++enum ++{ ++ PROP_0, ++ PROP_MAX_FRAGMENTATION_UNIT_SIZE, ++}; + + /* 3 zero bytes syncword */ + static const guint8 sync_bytes[] = { 0, 0, 0, 1 }; +@@ -119,6 +126,37 @@ static void gst_rtp_h265_depay_push (GstRtpH265Depay * rtph265depay, + GstBuffer * outbuf, gboolean keyframe, GstClockTime timestamp, + gboolean marker); + ++static void ++gst_rtp_h265_depay_set_property (GObject * object, guint prop_id, ++ const GValue * value, GParamSpec * pspec) ++{ ++ GstRtpH265Depay *self = GST_RTP_H265_DEPAY (object); ++ ++ switch (prop_id) { ++ case PROP_MAX_FRAGMENTATION_UNIT_SIZE: ++ self->max_fragmentation_unit_size = g_value_get_uint (value); ++ break; ++ default: ++ G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); ++ break; ++ } ++} ++ ++static void ++gst_rtp_h265_depay_get_property (GObject * object, guint prop_id, ++ GValue * value, GParamSpec * pspec) ++{ ++ GstRtpH265Depay *self = GST_RTP_H265_DEPAY (object); ++ ++ switch (prop_id) { ++ case PROP_MAX_FRAGMENTATION_UNIT_SIZE: ++ g_value_set_uint (value, self->max_fragmentation_unit_size); ++ break; ++ default: ++ G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); ++ break; ++ } ++} + + static void + gst_rtp_h265_depay_class_init (GstRtpH265DepayClass * klass) +@@ -132,6 +170,26 @@ gst_rtp_h265_depay_class_init (GstRtpH265DepayClass * klass) + gstrtpbasedepayload_class = (GstRTPBaseDepayloadClass *) klass; + + gobject_class->finalize = gst_rtp_h265_depay_finalize; ++ gobject_class->set_property = gst_rtp_h265_depay_set_property; ++ gobject_class->get_property = gst_rtp_h265_depay_get_property; ++ ++ /** ++ * GstRtpH265Depay:max-fragmentation-unit-size: ++ * ++ * Maximum size in bytes for a fragmentation unit. Larger units ++ * will be dropped to prevent excessive memory usage. ++ * ++ * Use 0 for automatic. ++ * ++ * Since: 1.28.6 ++ */ ++ g_object_class_install_property (gobject_class, ++ PROP_MAX_FRAGMENTATION_UNIT_SIZE, ++ g_param_spec_uint ("max-fragmentation-unit-size", ++ "Max Fragmentation Unit Size", ++ "Maximum size in bytes for a fragmentation unit (0 = auto)", 0, ++ G_MAXUINT, DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE, ++ G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS)); + + gst_element_class_add_static_pad_template (gstelement_class, + &gst_rtp_h265_depay_src_template); +@@ -165,6 +223,8 @@ gst_rtp_h265_depay_init (GstRtpH265Depay * rtph265depay) + (GDestroyNotify) gst_buffer_unref); + rtph265depay->pps = g_ptr_array_new_with_free_func ( + (GDestroyNotify) gst_buffer_unref); ++ rtph265depay->max_fragmentation_unit_size = ++ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE; + } + + static void +@@ -1516,6 +1576,17 @@ gst_rtp_h265_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + if (E) { + gst_rtp_h265_finish_fragmentation_unit (rtph265depay); + GST_DEBUG_OBJECT (rtph265depay, "End of Fragmentation Unit"); ++ } else { ++ guint limit = rtph265depay->max_fragmentation_unit_size ? ++ rtph265depay->max_fragmentation_unit_size : ++ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE; ++ if (gst_adapter_available (rtph265depay->adapter) > limit) { ++ GST_WARNING_OBJECT (rtph265depay, ++ "Too big (> %u bytes) fragmentation unit, dropping.", limit); ++ gst_rtp_base_depayload_flush (depayload, FALSE); ++ gst_adapter_clear (rtph265depay->adapter); ++ return NULL; ++ } + } + break; + } +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.h b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.h +index 505bdb5cd1..6e525cc086 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.h ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.h +@@ -86,6 +86,8 @@ struct _GstRtpH265Depay + /* downstream allocator */ + GstAllocator *allocator; + GstAllocationParams params; ++ ++ guint max_fragmentation_unit_size; + }; + + struct _GstRtpH265DepayClass + +From 1aa863158fe51cf41f7369a7f51a94c2cd6f19ba Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 4 Aug 2026 20:05:57 +0300 +Subject: [PATCH 2/3] rtph264depay: rtph265depay: Reset missing fields when + resetting during fragmentation unit handling + +Part-of: +--- + subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c | 6 ++++++ + subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c | 6 ++++++ + 2 files changed, 12 insertions(+) + +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c +index 9ccd8ab24e..3117f01737 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c +@@ -1399,6 +1399,9 @@ gst_rtp_h264_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + "%u to %u within Fragmentation Unit. Data was lost, dropping " + "stored.", rtph264depay->last_fu_seqnum, + gst_rtp_buffer_get_seq (rtp)); ++ rtph264depay->wait_start = TRUE; ++ rtph264depay->current_fu_type = 0; ++ rtph264depay->last_fu_seqnum = 0; + gst_adapter_clear (rtph264depay->adapter); + return NULL; + } +@@ -1434,6 +1437,9 @@ gst_rtp_h264_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + if (gst_adapter_available (rtph264depay->adapter) > limit) { + GST_WARNING_OBJECT (rtph264depay, + "Too big (> %u bytes) fragmentation unit, dropping.", limit); ++ rtph264depay->wait_start = TRUE; ++ rtph264depay->current_fu_type = 0; ++ rtph264depay->last_fu_seqnum = 0; + gst_rtp_base_depayload_flush (depayload, FALSE); + gst_adapter_clear (rtph264depay->adapter); + return NULL; +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c +index b8d2943228..14de691892 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c +@@ -1545,6 +1545,9 @@ gst_rtp_h265_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + "%u to %u within Fragmentation Unit. Data was lost, dropping " + "stored.", rtph265depay->last_fu_seqnum, + gst_rtp_buffer_get_seq (rtp)); ++ rtph265depay->wait_start = TRUE; ++ rtph265depay->current_fu_type = 0; ++ rtph265depay->last_fu_seqnum = 0; + gst_adapter_clear (rtph265depay->adapter); + return NULL; + } +@@ -1583,6 +1586,9 @@ gst_rtp_h265_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + if (gst_adapter_available (rtph265depay->adapter) > limit) { + GST_WARNING_OBJECT (rtph265depay, + "Too big (> %u bytes) fragmentation unit, dropping.", limit); ++ rtph265depay->wait_start = TRUE; ++ rtph265depay->current_fu_type = 0; ++ rtph265depay->last_fu_seqnum = 0; + gst_rtp_base_depayload_flush (depayload, FALSE); + gst_adapter_clear (rtph265depay->adapter); + return NULL; + +From 56eff30cdad2c1c6adf9068b1f1fd2da835c10b6 Mon Sep 17 00:00:00 2001 +From: RHEL Packaging Agent +Date: Fri, 7 Aug 2026 14:22:35 +0000 +Subject: [PATCH 3/3] Remove gst_rtp_base_depayload_flush calls unavailable in + GStreamer 1.22 + +The function gst_rtp_base_depayload_flush was introduced in a newer +GStreamer version (1.28+) and is not available in the gstreamer1-plugins-base +shipped with RHEL 9.8 (GStreamer 1.22.x). Remove the calls to this function +as the security fix still works without them: the adapter is cleared, +state is reset, and NULL is returned to drop oversized fragmentation units. +--- + subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c | 1 - + subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c +index 3117f01737..5467a51848 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c +@@ -1440,7 +1440,6 @@ gst_rtp_h264_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + rtph264depay->wait_start = TRUE; + rtph264depay->current_fu_type = 0; + rtph264depay->last_fu_seqnum = 0; +- gst_rtp_base_depayload_flush (depayload, FALSE); + gst_adapter_clear (rtph264depay->adapter); + return NULL; + } +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c +index 14de691892..c555835436 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c +@@ -1589,7 +1589,6 @@ gst_rtp_h265_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + rtph265depay->wait_start = TRUE; + rtph265depay->current_fu_type = 0; + rtph265depay->last_fu_seqnum = 0; +- gst_rtp_base_depayload_flush (depayload, FALSE); + gst_adapter_clear (rtph265depay->adapter); + return NULL; + } diff --git a/SPECS/gstreamer1-plugins-good.spec b/SPECS/gstreamer1-plugins-good.spec index a57f7bf..747124c 100644 --- a/SPECS/gstreamer1-plugins-good.spec +++ b/SPECS/gstreamer1-plugins-good.spec @@ -28,7 +28,7 @@ Name: gstreamer1-plugins-good Version: 1.22.12 -Release: 7%{?dist}.1 +Release: 7%{?dist}.2 Summary: GStreamer plugins with good code and licensing License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0 @@ -78,6 +78,8 @@ Patch0027: 0027-qtdemux-Add-size-check-for-parsing-SMI-SEQH-atom.patch Patch0028: 0028-jpegdec-Directly-error-out-on-negotiation-failures.patch Patch0029: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch Patch0030: 0029-wavpackdec-Avoid-integer-overflow-when-calculating-.patch +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234 +Patch0031: gstreamer1-plugins-good-1.22.12-CVE-2026-18649.patch BuildRequires: meson >= 0.48.0 BuildRequires: gcc @@ -267,6 +269,7 @@ to be installed. %patch -P 0028 -p3 %patch -P 0029 -p3 %patch -P 0030 -p3 +%patch -P 0031 -p3 %build %meson \ @@ -417,6 +420,11 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';' %changelog +* Fri Aug 07 2026 RHEL Packaging Agent - 1.22.12-7.2 +- Fix CVE-2026-18649: limit fragmentation unit size in RTP H.264/H.265 + depayloaders to prevent excessive memory usage + Resolves: RHEL-224162 + * Wed Jul 08 2026 Tomas Pelka - 1.22.12-7.1 - Rebase rhel-9.8.0 from 1.18.4 to 1.22.12 to resync with rhel-9.7.0/c9s (this branch had regressed to a stale pre-1.22.12 base)