diff --git a/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18296.patch b/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18296.patch new file mode 100644 index 0000000..7e48a5c --- /dev/null +++ b/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18296.patch @@ -0,0 +1,259 @@ +From cb26610b282e74b1fcc6d894fbc482a6ec0c1656 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Wed, 17 Jun 2026 16:18:50 +0300 +Subject: [PATCH] qtmoovrecover: Validate box sizes + +Also validate box versions where it matters. + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5118 +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5120 + +Part-of: +--- + gst/isomp4/atomsrecovery.c | 88 ++++++++++++++++++++++++++++++++++++-- + 1 file changed, 84 insertions(+), 4 deletions(-) + +diff --git a/gst/isomp4/atomsrecovery.c b/gst/isomp4/atomsrecovery.c +index edc4434..1761854 100644 +--- a/gst/isomp4/atomsrecovery.c ++++ b/gst/isomp4/atomsrecovery.c +@@ -283,6 +283,8 @@ moov_recov_file_parse_prefix (MoovRecovFile * moovrf) + if (!read_atom_header (moovrf->file, &fourcc, &size)) { + return FALSE; + } ++ if (size < 8) ++ return FALSE; + + if (fourcc != FOURCC_ftyp) { + /* we might have a prefix here */ +@@ -294,6 +296,8 @@ moov_recov_file_parse_prefix (MoovRecovFile * moovrf) + /* now read the ftyp */ + if (!read_atom_header (moovrf->file, &fourcc, &size)) + return FALSE; ++ if (size < 8) ++ return FALSE; + } + + /* this has to be the ftyp */ +@@ -315,12 +319,25 @@ moov_recov_file_parse_mvhd (MoovRecovFile * moovrf) + /* check for sanity */ + if (fourcc != FOURCC_mvhd) + return FALSE; ++ if (size < 8) ++ return FALSE; + + moovrf->mvhd_size = size; + moovrf->mvhd_pos = ftell (moovrf->file) - 8; + ++ guint8 version; ++ if (fread (&version, 1, 1, moovrf->file) != 1) ++ return FALSE; ++ if (version != 0) { ++ GST_WARNING ("Version %d mvhd not supported", version); ++ return FALSE; ++ } ++ ++ if (size != 108) ++ return FALSE; ++ + /* skip the remaining of the mvhd in the file */ +- return fseek (moovrf->file, size - 8, SEEK_CUR) == 0; ++ return fseek (moovrf->file, size - 8 - 1, SEEK_CUR) == 0; + } + + static gboolean +@@ -357,6 +374,8 @@ mdat_recov_file_find_mdat (FILE * file, GError ** err) + case FOURCC_ftyp: + case FOURCC_free: + case FOURCC_udta: ++ if (size < 8) ++ return FALSE; + if (fseek (file, size - 8, SEEK_CUR) != 0) { + goto file_seek_error; + } +@@ -486,6 +505,8 @@ skip_atom (MoovRecovFile * moovrf, guint32 expected_fourcc) + return FALSE; + if (fourcc != expected_fourcc) + return FALSE; ++ if (size < 8) ++ return FALSE; + + return (fseek (moovrf->file, size - 8, SEEK_CUR) == 0); + } +@@ -502,11 +523,24 @@ moov_recov_parse_tkhd (MoovRecovFile * moovrf, TrakRecovData * trakrd) + return FALSE; + if (fourcc != FOURCC_tkhd) + return FALSE; ++ if (size < 8) ++ return FALSE; + + trakrd->tkhd_file_offset = ftell (moovrf->file) - 8; + +- /* move 8 bytes forward to the trak_id pos */ +- if (fseek (moovrf->file, 12, SEEK_CUR) != 0) ++ guint8 version; ++ if (fread (&version, 1, 1, moovrf->file) != 1) ++ return FALSE; ++ if (version != 0) { ++ GST_WARNING ("Version %d tkhd not supported", version); ++ return FALSE; ++ } ++ ++ if (size != 92) ++ return FALSE; ++ ++ /* move 12-1 bytes forward to the trak_id pos */ ++ if (fseek (moovrf->file, 12 - 1, SEEK_CUR) != 0) + return FALSE; + if (fread (data, 1, 4, moovrf->file) != 4) + return FALSE; +@@ -530,6 +564,8 @@ moov_recov_parse_stbl (MoovRecovFile * moovrf, TrakRecovData * trakrd) + return FALSE; + if (fourcc != FOURCC_stbl) + return FALSE; ++ if (size < 8) ++ return FALSE; + + trakrd->stbl_file_offset = ftell (moovrf->file) - 8; + trakrd->stbl_size = size; +@@ -539,12 +575,17 @@ moov_recov_parse_stbl (MoovRecovFile * moovrf, TrakRecovData * trakrd) + return FALSE; + if (fourcc != FOURCC_stsd) + return FALSE; ++ if (auxsize < 8) ++ return FALSE; + if (fseek (moovrf->file, auxsize - 8, SEEK_CUR) != 0) + return FALSE; + + trakrd->stsd_size = auxsize; + trakrd->post_stsd_offset = ftell (moovrf->file); + ++ if (trakrd->stbl_size < trakrd->post_stsd_offset - trakrd->stbl_file_offset) ++ return FALSE; ++ + /* as this is the last atom we parse, we don't skip forward */ + + return TRUE; +@@ -556,11 +597,14 @@ moov_recov_parse_minf (MoovRecovFile * moovrf, TrakRecovData * trakrd) + guint32 size; + guint32 fourcc; + guint32 auxsize; ++ guint64 offset; + + if (!read_atom_header (moovrf->file, &fourcc, &size)) + return FALSE; + if (fourcc != FOURCC_minf) + return FALSE; ++ if (size < 8) ++ return FALSE; + + trakrd->minf_file_offset = ftell (moovrf->file) - 8; + trakrd->minf_size = size; +@@ -571,17 +615,23 @@ moov_recov_parse_minf (MoovRecovFile * moovrf, TrakRecovData * trakrd) + if (fourcc != FOURCC_vmhd && fourcc != FOURCC_smhd && fourcc != FOURCC_hmhd && + fourcc != FOURCC_gmhd) + return FALSE; ++ if (auxsize < 8) ++ return FALSE; + if (fseek (moovrf->file, auxsize - 8, SEEK_CUR)) + return FALSE; + + /* skip a possible hdlr and the following dinf */ + if (!read_atom_header (moovrf->file, &fourcc, &auxsize)) + return FALSE; ++ if (auxsize < 8) ++ return FALSE; + if (fourcc == FOURCC_hdlr) { + if (fseek (moovrf->file, auxsize - 8, SEEK_CUR)) + return FALSE; + if (!read_atom_header (moovrf->file, &fourcc, &auxsize)) + return FALSE; ++ if (auxsize < 8) ++ return FALSE; + } + if (fourcc != FOURCC_dinf) + return FALSE; +@@ -592,6 +642,10 @@ moov_recov_parse_minf (MoovRecovFile * moovrf, TrakRecovData * trakrd) + if (!moov_recov_parse_stbl (moovrf, trakrd)) + return FALSE; + ++ offset = ftell (moovrf->file); ++ if (trakrd->minf_size < offset - trakrd->minf_file_offset) ++ return FALSE; ++ + return TRUE; + } + +@@ -607,11 +661,24 @@ moov_recov_parse_mdhd (MoovRecovFile * moovrf, TrakRecovData * trakrd) + return FALSE; + if (fourcc != FOURCC_mdhd) + return FALSE; ++ if (size < 8) ++ return FALSE; + + trakrd->mdhd_file_offset = ftell (moovrf->file) - 8; + ++ guint8 version; ++ if (fread (&version, 1, 1, moovrf->file) != 1) ++ return FALSE; ++ if (version != 0) { ++ GST_WARNING ("Version %d mdhd not supported", version); ++ return FALSE; ++ } ++ ++ if (size != 32) ++ return FALSE; ++ + /* get the timescale */ +- if (fseek (moovrf->file, 12, SEEK_CUR) != 0) ++ if (fseek (moovrf->file, 12 - 1, SEEK_CUR) != 0) + return FALSE; + if (fread (data, 1, 4, moovrf->file) != 4) + return FALSE; +@@ -626,12 +693,15 @@ moov_recov_parse_mdia (MoovRecovFile * moovrf, TrakRecovData * trakrd) + { + guint32 size; + guint32 fourcc; ++ guint64 offset; + + /* make sure we are on a tkhd atom */ + if (!read_atom_header (moovrf->file, &fourcc, &size)) + return FALSE; + if (fourcc != FOURCC_mdia) + return FALSE; ++ if (size < 8) ++ return FALSE; + + trakrd->mdia_file_offset = ftell (moovrf->file) - 8; + trakrd->mdia_size = size; +@@ -643,6 +713,11 @@ moov_recov_parse_mdia (MoovRecovFile * moovrf, TrakRecovData * trakrd) + return FALSE; + if (!moov_recov_parse_minf (moovrf, trakrd)) + return FALSE; ++ ++ offset = ftell (moovrf->file); ++ if (trakrd->mdia_size < offset - trakrd->mdia_file_offset) ++ return FALSE; ++ + return TRUE; + } + +@@ -665,6 +740,8 @@ moov_recov_parse_trak (MoovRecovFile * moovrf, TrakRecovData * trakrd) + if (fourcc != FOURCC_trak) { + return FALSE; + } ++ if (size < 8) ++ return FALSE; + trakrd->trak_size = size; + + /* now we should have a trak header 'tkhd' */ +@@ -683,6 +760,9 @@ moov_recov_parse_trak (MoovRecovFile * moovrf, TrakRecovData * trakrd) + return FALSE; + + trakrd->extra_atoms_offset = ftell (moovrf->file); ++ if (trakrd->trak_size < trakrd->extra_atoms_offset - offset) ++ return FALSE; ++ + trakrd->extra_atoms_size = size - (trakrd->extra_atoms_offset - offset); + + trakrd->file_offset = offset; diff --git a/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18298.patch b/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18298.patch new file mode 100644 index 0000000..4f6ef35 --- /dev/null +++ b/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18298.patch @@ -0,0 +1,113 @@ +From 1e19d059b0e89225f3afbbb0b34ea37672540e55 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Fri, 19 Jun 2026 13:15:02 +0300 +Subject: [PATCH 1/2] gdkpixbufdec: Drop rank to NONE + +gdk-pixbuf is not mean to be used on untrusted inputs so let's not ask for +problems here. + +For the common image formats we have specialized elements with higher ranks and +for a proper replacement follow this issue: + https://gitlab.freedesktop.org/gstreamer/gst-plugins-rs/-/issues/764 + +Part-of: +--- + docs/gst_plugins_cache.json | 2 +- + ext/gdk_pixbuf/gstgdkpixbufdec.c | 3 +-- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/docs/gst_plugins_cache.json b/docs/gst_plugins_cache.json +index 54633e6..821ec5a 100644 +--- a/docs/gst_plugins_cache.json ++++ b/docs/gst_plugins_cache.json +@@ -7160,7 +7160,7 @@ + "presence": "always" + } + }, +- "rank": "secondary" ++ "rank": "none" + }, + "gdkpixbufoverlay": { + "author": "Tim-Philipp Müller ", +diff --git a/ext/gdk_pixbuf/gstgdkpixbufdec.c b/ext/gdk_pixbuf/gstgdkpixbufdec.c +index de5f054..3279e48 100644 +--- a/ext/gdk_pixbuf/gstgdkpixbufdec.c ++++ b/ext/gdk_pixbuf/gstgdkpixbufdec.c +@@ -76,8 +76,7 @@ static gboolean gst_gdk_pixbuf_dec_sink_event (GstPad * pad, GstObject * parent, + #define gst_gdk_pixbuf_dec_parent_class parent_class + G_DEFINE_TYPE (GstGdkPixbufDec, gst_gdk_pixbuf_dec, GST_TYPE_ELEMENT); + GST_ELEMENT_REGISTER_DEFINE_WITH_CODE (gdkpixbufdec, "gdkpixbufdec", +- GST_RANK_SECONDARY, GST_TYPE_GDK_PIXBUF_DEC, +- gdk_pixbuf_element_init (plugin)); ++ GST_RANK_NONE, GST_TYPE_GDK_PIXBUF_DEC, gdk_pixbuf_element_init (plugin)); + + static gboolean + gst_gdk_pixbuf_dec_sink_setcaps (GstGdkPixbufDec * filter, GstCaps * caps) + +From 36e8cc64db5024eed4490ce0e3752689684450c5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Fri, 19 Jun 2026 13:20:04 +0300 +Subject: [PATCH 2/2] gdkpixbufdec: Handle format and resolution changes + correctly + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5121 + +Part-of: +--- + ext/gdk_pixbuf/gstgdkpixbufdec.c | 31 ++++++++++++++++--------------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +diff --git a/ext/gdk_pixbuf/gstgdkpixbufdec.c b/ext/gdk_pixbuf/gstgdkpixbufdec.c +index 3279e48..103b0bd 100644 +--- a/ext/gdk_pixbuf/gstgdkpixbufdec.c ++++ b/ext/gdk_pixbuf/gstgdkpixbufdec.c +@@ -292,6 +292,7 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter) + gint width, height; + gint n_channels; + GstVideoFrame frame; ++ GstVideoFormat fmt; + + pixbuf = gdk_pixbuf_loader_get_pixbuf (filter->pixbuf_loader); + if (pixbuf == NULL) +@@ -300,26 +301,26 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter) + width = gdk_pixbuf_get_width (pixbuf); + height = gdk_pixbuf_get_height (pixbuf); + +- if (GST_VIDEO_INFO_FORMAT (&filter->info) == GST_VIDEO_FORMAT_UNKNOWN) { ++ n_channels = gdk_pixbuf_get_n_channels (pixbuf); ++ switch (n_channels) { ++ case 3: ++ fmt = GST_VIDEO_FORMAT_RGB; ++ break; ++ case 4: ++ fmt = GST_VIDEO_FORMAT_RGBA; ++ break; ++ default: ++ goto channels_not_supported; ++ } ++ ++ if (GST_VIDEO_INFO_FORMAT (&filter->info) != fmt || ++ GST_VIDEO_INFO_WIDTH (&filter->info) != width || ++ GST_VIDEO_INFO_HEIGHT (&filter->info) != height) { + GstVideoInfo info; +- GstVideoFormat fmt; + GList *l; + + GST_DEBUG ("Set size to %dx%d", width, height); + +- n_channels = gdk_pixbuf_get_n_channels (pixbuf); +- switch (n_channels) { +- case 3: +- fmt = GST_VIDEO_FORMAT_RGB; +- break; +- case 4: +- fmt = GST_VIDEO_FORMAT_RGBA; +- break; +- default: +- goto channels_not_supported; +- } +- +- + gst_video_info_init (&info); + if (!gst_video_info_set_format (&info, fmt, width, height)) + goto format_not_supported; diff --git a/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18299.patch b/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18299.patch new file mode 100644 index 0000000..3f01d37 --- /dev/null +++ b/SOURCES/gstreamer1-plugins-good-1.22.12-CVE-2026-18299.patch @@ -0,0 +1,111 @@ +From 65589b93f6937dca0156c552d453295b54da4ddb Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Fri, 19 Jun 2026 12:50:32 +0300 +Subject: [PATCH 1/3] rtpsbcdepay: Check for available data in the adapter + before getting data + +Consider empty packets with the last flag as bad packets. + +Also reset buffers to NULL after giving away ownership of them to avoid +returning an already freed buffer. + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5119 + +Part-of: +--- + gst/rtp/gstrtpsbcdepay.c | 29 ++++++++++++++++++----------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +diff --git a/gst/rtp/gstrtpsbcdepay.c b/gst/rtp/gstrtpsbcdepay.c +index f5dec8b..e2ff02b 100644 +--- a/gst/rtp/gstrtpsbcdepay.c ++++ b/gst/rtp/gstrtpsbcdepay.c +@@ -327,19 +327,26 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp) + } + + gst_adapter_push (depay->adapter, data); ++ data = NULL; + + if (last) { +- gint framelen, samples; +- guint8 header[4]; +- +- data = gst_adapter_take_buffer (depay->adapter, +- gst_adapter_available (depay->adapter)); +- gst_rtp_drop_non_audio_meta (depay, data); +- +- if (gst_buffer_extract (data, 0, &header, 4) != 4 || +- gst_rtp_sbc_depay_get_params (depay, header, +- payload_len, &framelen, &samples) < 0) { +- gst_buffer_unref (data); ++ if (gst_adapter_available (depay->adapter)) { ++ gint framelen, samples; ++ guint8 header[4]; ++ ++ data = gst_adapter_take_buffer (depay->adapter, ++ gst_adapter_available (depay->adapter)); ++ gst_rtp_drop_non_audio_meta (depay, data); ++ ++ if (gst_buffer_extract (data, 0, &header, 4) != 4 || ++ gst_rtp_sbc_depay_get_params (depay, header, ++ payload_len, &framelen, &samples) < 0) { ++ gst_buffer_unref (data); ++ data = NULL; ++ goto bad_packet; ++ } ++ } else { ++ data = NULL; + goto bad_packet; + } + } else { + +From adef5ce7e5cb144aa6e66e864e7553722277fea9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Fri, 19 Jun 2026 12:55:34 +0300 +Subject: [PATCH 2/3] rtpsbcdepay: Check that enough data is available for the + payload header + +Part-of: +--- + gst/rtp/gstrtpsbcdepay.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/gst/rtp/gstrtpsbcdepay.c b/gst/rtp/gstrtpsbcdepay.c +index e2ff02b..f195b88 100644 +--- a/gst/rtp/gstrtpsbcdepay.c ++++ b/gst/rtp/gstrtpsbcdepay.c +@@ -300,6 +300,8 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp) + + payload = gst_rtp_buffer_get_payload (rtp); + payload_len = gst_rtp_buffer_get_payload_len (rtp); ++ if (payload_len < 1) ++ goto bad_packet; + + fragment = payload[0] & 0x80; + start = payload[0] & 0x40; + +From bf67efd18ca02ca24fb037be8c708ae526457f76 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Fri, 19 Jun 2026 13:00:27 +0300 +Subject: [PATCH 3/3] rtpsbcdepay: Remove wrong variable shadowing + +`samples` is expected to be set in the outer scope at a later time. + +Part-of: +--- + gst/rtp/gstrtpsbcdepay.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gst/rtp/gstrtpsbcdepay.c b/gst/rtp/gstrtpsbcdepay.c +index f195b88..0dc9172 100644 +--- a/gst/rtp/gstrtpsbcdepay.c ++++ b/gst/rtp/gstrtpsbcdepay.c +@@ -333,7 +333,7 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp) + + if (last) { + if (gst_adapter_available (depay->adapter)) { +- gint framelen, samples; ++ gint framelen; + guint8 header[4]; + + data = gst_adapter_take_buffer (depay->adapter, diff --git a/SPECS/gstreamer1-plugins-good.spec b/SPECS/gstreamer1-plugins-good.spec index ec4e314..455c4a4 100644 --- a/SPECS/gstreamer1-plugins-good.spec +++ b/SPECS/gstreamer1-plugins-good.spec @@ -28,7 +28,7 @@ Name: gstreamer1-plugins-good Version: 1.22.12 -Release: 7%{?dist}.4 +Release: 7%{?dist}.8 Summary: GStreamer plugins with good code and licensing License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0 @@ -84,6 +84,14 @@ Patch0031: gstreamer1-plugins-good-1.22.12-CVE-2026-18649.patch Patch0032: gstreamer1-plugins-good-1.22.12-CVE-2026-73433.patch # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231 Patch0033: gstreamer1-plugins-good-1.22.12-CVE-2026-73434.patch +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12041 +Patch0034: gstreamer1-plugins-good-1.22.12-CVE-2026-18296.patch +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043 +Patch0035: gstreamer1-plugins-good-1.22.12-CVE-2026-18298.patch +# CVE-2026-18295 is the same upstream fix as CVE-2026-18296 (Patch0034); +# no separate patch file is needed (Patch0036 intentionally unused). +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042 +Patch0037: gstreamer1-plugins-good-1.22.12-CVE-2026-18299.patch BuildRequires: meson >= 0.48.0 BuildRequires: gcc @@ -276,6 +284,9 @@ to be installed. %patch -P 0031 -p3 %patch -P 0032 -p3 %patch -P 0033 -p1 +%patch -P 0034 -p1 +%patch -P 0035 -p1 +%patch -P 0037 -p1 %build %meson \ @@ -426,6 +437,23 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';' %changelog +* Sat Aug 22 2026 RHEL Packaging Agent - 1.22.12-7.8 +- Fix CVE-2026-18299: Use-After-Free in rtpsbcdepay + Resolves: RHEL-246619 + +* Sat Aug 22 2026 RHEL Packaging Agent - 1.22.12-7.7 +- Fix CVE-2026-18296: size validation in qtmoovrecover MRF parsing + Resolves: RHEL-246558 + +* Sat Aug 22 2026 RHEL Packaging Agent - 1.22.12-7.6 +- Fix CVE-2026-18298 in gdkpixbufdec element + Resolves: RHEL-246572 + +* Sat Aug 22 2026 RHEL Packaging Agent - 1.22.12-7.5 +- Fix CVE-2026-18295: validate box sizes in qtmoovrecover to prevent + heap buffer overflow (same upstream fix as CVE-2026-18296) + Resolves: RHEL-246380 + * Thu Aug 13 2026 RHEL Packaging Agent - 1.22.12-7.4 - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239042