rpms/gstreamer1-plugins-good
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import Oracle_OSS gstreamer1-plugins-good-1.22.12-7.el9_8.8

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-25 10:46:06 -04:00
parent 61e8ee6853
commit c740b70e10
4 changed files with 512 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

259
SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18296.patch Normal file
View File

@ -0,0 +1,259 @@
From cb26610b282e74b1fcc6d894fbc482a6ec0c1656 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Wed, 17 Jun 2026 16:18:50 +0300
Subject: [PATCH] qtmoovrecover: Validate box sizes
Also validate box versions where it matters.
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5118
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5120
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12041>
---
gst/isomp4/atomsrecovery.c | 88 ++++++++++++++++++++++++++++++++++++--
1 file changed, 84 insertions(+), 4 deletions(-)
diff --git a/gst/isomp4/atomsrecovery.c b/gst/isomp4/atomsrecovery.c
index edc4434..1761854 100644
--- a/gst/isomp4/atomsrecovery.c
+++ b/gst/isomp4/atomsrecovery.c
@@ -283,6 +283,8 @@ moov_recov_file_parse_prefix (MoovRecovFile * moovrf)
if (!read_atom_header (moovrf->file, &fourcc, &size)) {
return FALSE;
}
+ if (size < 8)
+ return FALSE;
if (fourcc != FOURCC_ftyp) {
/* we might have a prefix here */
@@ -294,6 +296,8 @@ moov_recov_file_parse_prefix (MoovRecovFile * moovrf)
/* now read the ftyp */
if (!read_atom_header (moovrf->file, &fourcc, &size))
return FALSE;
+ if (size < 8)
+ return FALSE;
}
/* this has to be the ftyp */
@@ -315,12 +319,25 @@ moov_recov_file_parse_mvhd (MoovRecovFile * moovrf)
/* check for sanity */
if (fourcc != FOURCC_mvhd)
return FALSE;
+ if (size < 8)
+ return FALSE;
moovrf->mvhd_size = size;
moovrf->mvhd_pos = ftell (moovrf->file) - 8;
+ guint8 version;
+ if (fread (&version, 1, 1, moovrf->file) != 1)
+ return FALSE;
+ if (version != 0) {
+ GST_WARNING ("Version %d mvhd not supported", version);
+ return FALSE;
+ }
+
+ if (size != 108)
+ return FALSE;
+
/* skip the remaining of the mvhd in the file */
- return fseek (moovrf->file, size - 8, SEEK_CUR) == 0;
+ return fseek (moovrf->file, size - 8 - 1, SEEK_CUR) == 0;
}
static gboolean
@@ -357,6 +374,8 @@ mdat_recov_file_find_mdat (FILE * file, GError ** err)
case FOURCC_ftyp:
case FOURCC_free:
case FOURCC_udta:
+ if (size < 8)
+ return FALSE;
if (fseek (file, size - 8, SEEK_CUR) != 0) {
goto file_seek_error;
}
@@ -486,6 +505,8 @@ skip_atom (MoovRecovFile * moovrf, guint32 expected_fourcc)
return FALSE;
if (fourcc != expected_fourcc)
return FALSE;
+ if (size < 8)
+ return FALSE;
return (fseek (moovrf->file, size - 8, SEEK_CUR) == 0);
}
@@ -502,11 +523,24 @@ moov_recov_parse_tkhd (MoovRecovFile * moovrf, TrakRecovData * trakrd)
return FALSE;
if (fourcc != FOURCC_tkhd)
return FALSE;
+ if (size < 8)
+ return FALSE;
trakrd->tkhd_file_offset = ftell (moovrf->file) - 8;
- /* move 8 bytes forward to the trak_id pos */
- if (fseek (moovrf->file, 12, SEEK_CUR) != 0)
+ guint8 version;
+ if (fread (&version, 1, 1, moovrf->file) != 1)
+ return FALSE;
+ if (version != 0) {
+ GST_WARNING ("Version %d tkhd not supported", version);
+ return FALSE;
+ }
+
+ if (size != 92)
+ return FALSE;
+
+ /* move 12-1 bytes forward to the trak_id pos */
+ if (fseek (moovrf->file, 12 - 1, SEEK_CUR) != 0)
return FALSE;
if (fread (data, 1, 4, moovrf->file) != 4)
return FALSE;
@@ -530,6 +564,8 @@ moov_recov_parse_stbl (MoovRecovFile * moovrf, TrakRecovData * trakrd)
return FALSE;
if (fourcc != FOURCC_stbl)
return FALSE;
+ if (size < 8)
+ return FALSE;
trakrd->stbl_file_offset = ftell (moovrf->file) - 8;
trakrd->stbl_size = size;
@@ -539,12 +575,17 @@ moov_recov_parse_stbl (MoovRecovFile * moovrf, TrakRecovData * trakrd)
return FALSE;
if (fourcc != FOURCC_stsd)
return FALSE;
+ if (auxsize < 8)
+ return FALSE;
if (fseek (moovrf->file, auxsize - 8, SEEK_CUR) != 0)
return FALSE;
trakrd->stsd_size = auxsize;
trakrd->post_stsd_offset = ftell (moovrf->file);
+ if (trakrd->stbl_size < trakrd->post_stsd_offset - trakrd->stbl_file_offset)
+ return FALSE;
+
/* as this is the last atom we parse, we don't skip forward */
return TRUE;
@@ -556,11 +597,14 @@ moov_recov_parse_minf (MoovRecovFile * moovrf, TrakRecovData * trakrd)
guint32 size;
guint32 fourcc;
guint32 auxsize;
+ guint64 offset;
if (!read_atom_header (moovrf->file, &fourcc, &size))
return FALSE;
if (fourcc != FOURCC_minf)
return FALSE;
+ if (size < 8)
+ return FALSE;
trakrd->minf_file_offset = ftell (moovrf->file) - 8;
trakrd->minf_size = size;
@@ -571,17 +615,23 @@ moov_recov_parse_minf (MoovRecovFile * moovrf, TrakRecovData * trakrd)
if (fourcc != FOURCC_vmhd && fourcc != FOURCC_smhd && fourcc != FOURCC_hmhd &&
fourcc != FOURCC_gmhd)
return FALSE;
+ if (auxsize < 8)
+ return FALSE;
if (fseek (moovrf->file, auxsize - 8, SEEK_CUR))
return FALSE;
/* skip a possible hdlr and the following dinf */
if (!read_atom_header (moovrf->file, &fourcc, &auxsize))
return FALSE;
+ if (auxsize < 8)
+ return FALSE;
if (fourcc == FOURCC_hdlr) {
if (fseek (moovrf->file, auxsize - 8, SEEK_CUR))
return FALSE;
if (!read_atom_header (moovrf->file, &fourcc, &auxsize))
return FALSE;
+ if (auxsize < 8)
+ return FALSE;
}
if (fourcc != FOURCC_dinf)
return FALSE;
@@ -592,6 +642,10 @@ moov_recov_parse_minf (MoovRecovFile * moovrf, TrakRecovData * trakrd)
if (!moov_recov_parse_stbl (moovrf, trakrd))
return FALSE;
+ offset = ftell (moovrf->file);
+ if (trakrd->minf_size < offset - trakrd->minf_file_offset)
+ return FALSE;
+
return TRUE;
}
@@ -607,11 +661,24 @@ moov_recov_parse_mdhd (MoovRecovFile * moovrf, TrakRecovData * trakrd)
return FALSE;
if (fourcc != FOURCC_mdhd)
return FALSE;
+ if (size < 8)
+ return FALSE;
trakrd->mdhd_file_offset = ftell (moovrf->file) - 8;
+ guint8 version;
+ if (fread (&version, 1, 1, moovrf->file) != 1)
+ return FALSE;
+ if (version != 0) {
+ GST_WARNING ("Version %d mdhd not supported", version);
+ return FALSE;
+ }
+
+ if (size != 32)
+ return FALSE;
+
/* get the timescale */
- if (fseek (moovrf->file, 12, SEEK_CUR) != 0)
+ if (fseek (moovrf->file, 12 - 1, SEEK_CUR) != 0)
return FALSE;
if (fread (data, 1, 4, moovrf->file) != 4)
return FALSE;
@@ -626,12 +693,15 @@ moov_recov_parse_mdia (MoovRecovFile * moovrf, TrakRecovData * trakrd)
{
guint32 size;
guint32 fourcc;
+ guint64 offset;
/* make sure we are on a tkhd atom */
if (!read_atom_header (moovrf->file, &fourcc, &size))
return FALSE;
if (fourcc != FOURCC_mdia)
return FALSE;
+ if (size < 8)
+ return FALSE;
trakrd->mdia_file_offset = ftell (moovrf->file) - 8;
trakrd->mdia_size = size;
@@ -643,6 +713,11 @@ moov_recov_parse_mdia (MoovRecovFile * moovrf, TrakRecovData * trakrd)
return FALSE;
if (!moov_recov_parse_minf (moovrf, trakrd))
return FALSE;
+
+ offset = ftell (moovrf->file);
+ if (trakrd->mdia_size < offset - trakrd->mdia_file_offset)
+ return FALSE;
+
return TRUE;
}
@@ -665,6 +740,8 @@ moov_recov_parse_trak (MoovRecovFile * moovrf, TrakRecovData * trakrd)
if (fourcc != FOURCC_trak) {
return FALSE;
}
+ if (size < 8)
+ return FALSE;
trakrd->trak_size = size;
/* now we should have a trak header 'tkhd' */
@@ -683,6 +760,9 @@ moov_recov_parse_trak (MoovRecovFile * moovrf, TrakRecovData * trakrd)
return FALSE;
trakrd->extra_atoms_offset = ftell (moovrf->file);
+ if (trakrd->trak_size < trakrd->extra_atoms_offset - offset)
+ return FALSE;
+
trakrd->extra_atoms_size = size - (trakrd->extra_atoms_offset - offset);
trakrd->file_offset = offset;

113
SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18298.patch Normal file
View File

@ -0,0 +1,113 @@
From 1e19d059b0e89225f3afbbb0b34ea37672540e55 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Fri, 19 Jun 2026 13:15:02 +0300
Subject: [PATCH 1/2] gdkpixbufdec: Drop rank to NONE
gdk-pixbuf is not mean to be used on untrusted inputs so let's not ask for
problems here.
For the common image formats we have specialized elements with higher ranks and
for a proper replacement follow this issue:
https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/issues/764
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043>
---
docs/gst_plugins_cache.json | 2 +-
ext/gdk_pixbuf/gstgdkpixbufdec.c | 3 +--
2 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/docs/gst_plugins_cache.json b/docs/gst_plugins_cache.json
index 54633e6..821ec5a 100644
--- a/docs/gst_plugins_cache.json
+++ b/docs/gst_plugins_cache.json
@@ -7160,7 +7160,7 @@
"presence": "always"
}
},
- "rank": "secondary"
+ "rank": "none"
},
"gdkpixbufoverlay": {
"author": "Tim-Philipp Müller <tim centricular net>",
diff --git a/ext/gdk_pixbuf/gstgdkpixbufdec.c b/ext/gdk_pixbuf/gstgdkpixbufdec.c
index de5f054..3279e48 100644
--- a/ext/gdk_pixbuf/gstgdkpixbufdec.c
+++ b/ext/gdk_pixbuf/gstgdkpixbufdec.c
@@ -76,8 +76,7 @@ static gboolean gst_gdk_pixbuf_dec_sink_event (GstPad * pad, GstObject * parent,
#define gst_gdk_pixbuf_dec_parent_class parent_class
G_DEFINE_TYPE (GstGdkPixbufDec, gst_gdk_pixbuf_dec, GST_TYPE_ELEMENT);
GST_ELEMENT_REGISTER_DEFINE_WITH_CODE (gdkpixbufdec, "gdkpixbufdec",
- GST_RANK_SECONDARY, GST_TYPE_GDK_PIXBUF_DEC,
- gdk_pixbuf_element_init (plugin));
+ GST_RANK_NONE, GST_TYPE_GDK_PIXBUF_DEC, gdk_pixbuf_element_init (plugin));
static gboolean
gst_gdk_pixbuf_dec_sink_setcaps (GstGdkPixbufDec * filter, GstCaps * caps)
From 36e8cc64db5024eed4490ce0e3752689684450c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Fri, 19 Jun 2026 13:20:04 +0300
Subject: [PATCH 2/2] gdkpixbufdec: Handle format and resolution changes
correctly
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5121
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043>
---
ext/gdk_pixbuf/gstgdkpixbufdec.c | 31 ++++++++++++++++---------------
1 file changed, 16 insertions(+), 15 deletions(-)
diff --git a/ext/gdk_pixbuf/gstgdkpixbufdec.c b/ext/gdk_pixbuf/gstgdkpixbufdec.c
index 3279e48..103b0bd 100644
--- a/ext/gdk_pixbuf/gstgdkpixbufdec.c
+++ b/ext/gdk_pixbuf/gstgdkpixbufdec.c
@@ -292,6 +292,7 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter)
gint width, height;
gint n_channels;
GstVideoFrame frame;
+ GstVideoFormat fmt;
pixbuf = gdk_pixbuf_loader_get_pixbuf (filter->pixbuf_loader);
if (pixbuf == NULL)
@@ -300,26 +301,26 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter)
width = gdk_pixbuf_get_width (pixbuf);
height = gdk_pixbuf_get_height (pixbuf);
- if (GST_VIDEO_INFO_FORMAT (&filter->info) == GST_VIDEO_FORMAT_UNKNOWN) {
+ n_channels = gdk_pixbuf_get_n_channels (pixbuf);
+ switch (n_channels) {
+ case 3:
+ fmt = GST_VIDEO_FORMAT_RGB;
+ break;
+ case 4:
+ fmt = GST_VIDEO_FORMAT_RGBA;
+ break;
+ default:
+ goto channels_not_supported;
+ }
+
+ if (GST_VIDEO_INFO_FORMAT (&filter->info) != fmt ||
+ GST_VIDEO_INFO_WIDTH (&filter->info) != width ||
+ GST_VIDEO_INFO_HEIGHT (&filter->info) != height) {
GstVideoInfo info;
- GstVideoFormat fmt;
GList *l;
GST_DEBUG ("Set size to %dx%d", width, height);
- n_channels = gdk_pixbuf_get_n_channels (pixbuf);
- switch (n_channels) {
- case 3:
- fmt = GST_VIDEO_FORMAT_RGB;
- break;
- case 4:
- fmt = GST_VIDEO_FORMAT_RGBA;
- break;
- default:
- goto channels_not_supported;
- }
-
-
gst_video_info_init (&info);
if (!gst_video_info_set_format (&info, fmt, width, height))
goto format_not_supported;

111
SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18299.patch Normal file
View File

@ -0,0 +1,111 @@
From 65589b93f6937dca0156c552d453295b54da4ddb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Fri, 19 Jun 2026 12:50:32 +0300
Subject: [PATCH 1/3] rtpsbcdepay: Check for available data in the adapter
before getting data
Consider empty packets with the last flag as bad packets.
Also reset buffers to NULL after giving away ownership of them to avoid
returning an already freed buffer.
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5119
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042>
---
gst/rtp/gstrtpsbcdepay.c | 29 ++++++++++++++++++-----------
1 file changed, 18 insertions(+), 11 deletions(-)
diff --git a/gst/rtp/gstrtpsbcdepay.c b/gst/rtp/gstrtpsbcdepay.c
index f5dec8b..e2ff02b 100644
--- a/gst/rtp/gstrtpsbcdepay.c
+++ b/gst/rtp/gstrtpsbcdepay.c
@@ -327,19 +327,26 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp)
}
gst_adapter_push (depay->adapter, data);
+ data = NULL;
if (last) {
- gint framelen, samples;
- guint8 header[4];
-
- data = gst_adapter_take_buffer (depay->adapter,
- gst_adapter_available (depay->adapter));
- gst_rtp_drop_non_audio_meta (depay, data);
-
- if (gst_buffer_extract (data, 0, &header, 4) != 4 ||
- gst_rtp_sbc_depay_get_params (depay, header,
- payload_len, &framelen, &samples) < 0) {
- gst_buffer_unref (data);
+ if (gst_adapter_available (depay->adapter)) {
+ gint framelen, samples;
+ guint8 header[4];
+
+ data = gst_adapter_take_buffer (depay->adapter,
+ gst_adapter_available (depay->adapter));
+ gst_rtp_drop_non_audio_meta (depay, data);
+
+ if (gst_buffer_extract (data, 0, &header, 4) != 4 ||
+ gst_rtp_sbc_depay_get_params (depay, header,
+ payload_len, &framelen, &samples) < 0) {
+ gst_buffer_unref (data);
+ data = NULL;
+ goto bad_packet;
+ }
+ } else {
+ data = NULL;
goto bad_packet;
}
} else {
From adef5ce7e5cb144aa6e66e864e7553722277fea9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Fri, 19 Jun 2026 12:55:34 +0300
Subject: [PATCH 2/3] rtpsbcdepay: Check that enough data is available for the
payload header
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042>
---
gst/rtp/gstrtpsbcdepay.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/gst/rtp/gstrtpsbcdepay.c b/gst/rtp/gstrtpsbcdepay.c
index e2ff02b..f195b88 100644
--- a/gst/rtp/gstrtpsbcdepay.c
+++ b/gst/rtp/gstrtpsbcdepay.c
@@ -300,6 +300,8 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp)
payload = gst_rtp_buffer_get_payload (rtp);
payload_len = gst_rtp_buffer_get_payload_len (rtp);
+ if (payload_len < 1)
+ goto bad_packet;
fragment = payload[0] & 0x80;
start = payload[0] & 0x40;
From bf67efd18ca02ca24fb037be8c708ae526457f76 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Fri, 19 Jun 2026 13:00:27 +0300
Subject: [PATCH 3/3] rtpsbcdepay: Remove wrong variable shadowing
`samples` is expected to be set in the outer scope at a later time.
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042>
---
gst/rtp/gstrtpsbcdepay.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/gst/rtp/gstrtpsbcdepay.c b/gst/rtp/gstrtpsbcdepay.c
index f195b88..0dc9172 100644
--- a/gst/rtp/gstrtpsbcdepay.c
+++ b/gst/rtp/gstrtpsbcdepay.c
@@ -333,7 +333,7 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp)
if (last) {
if (gst_adapter_available (depay->adapter)) {
- gint framelen, samples;
+ gint framelen;
guint8 header[4];
data = gst_adapter_take_buffer (depay->adapter,

30
SPECS/gstreamer1-plugins-good.spec
View File

@ -28,7 +28,7 @@
Name: gstreamer1-plugins-good
Version: 1.22.12
Release: 7%{?dist}.4
Release: 7%{?dist}.8
Summary: GStreamer plugins with good code and licensing
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
@ -84,6 +84,14 @@ Patch0031: gstreamer1-plugins-good-1.22.12-CVE-2026-18649.patch
Patch0032: gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231
Patch0033: gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12041
Patch0034: gstreamer1-plugins-good-1.22.12-CVE-2026-18296.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043
Patch0035: gstreamer1-plugins-good-1.22.12-CVE-2026-18298.patch
# CVE-2026-18295 is the same upstream fix as CVE-2026-18296 (Patch0034);
# no separate patch file is needed (Patch0036 intentionally unused).
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042
Patch0037: gstreamer1-plugins-good-1.22.12-CVE-2026-18299.patch
BuildRequires: meson >= 0.48.0
BuildRequires: gcc
@ -276,6 +284,9 @@ to be installed.
%patch -P 0031 -p3
%patch -P 0032 -p3
%patch -P 0033 -p1
%patch -P 0034 -p1
%patch -P 0035 -p1
%patch -P 0037 -p1
%build
%meson \
@ -426,6 +437,23 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
%changelog
* Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-7.8
- Fix CVE-2026-18299: Use-After-Free in rtpsbcdepay
Resolves: RHEL-246619
* Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-7.7
- Fix CVE-2026-18296: size validation in qtmoovrecover MRF parsing
Resolves: RHEL-246558
* Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-7.6
- Fix CVE-2026-18298 in gdkpixbufdec element
Resolves: RHEL-246572
* Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-7.5
- Fix CVE-2026-18295: validate box sizes in qtmoovrecover to prevent
heap buffer overflow (same upstream fix as CVE-2026-18296)
Resolves: RHEL-246380
* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-7.4
- Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling
Resolves: RHEL-239042