rpms/gstreamer1-plugins-good
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-18298: heap buffer overflow in GdkPixbuf image decoder

Browse Source 
Backport upstream commit cf4f7cbc081cde7769862b424c105f10c083171b
to fix CVE-2026-18298, a heap buffer overflow in the GdkPixbuf
image decoder (gstgdkpixbufdec.c) caused by dimension changes.
The fix moves the n_channels/format determination before the
conditional check and extends the condition to also verify format,
width, and height changes, ensuring the video info is properly
reinitialized when image properties change.

CVE: CVE-2026-18298
Upstream patches:
 - cf4f7cbc08.patch
Resolves: RHEL-246561

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-22 12:55:16 +00:00
parent 5d5dc55480
commit d22715362d
2 changed files with 75 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
gstreamer1-plugins-good-1.16.1-CVE-2026-18298.patch Normal file
View File

@ -0,0 +1,66 @@
From 6f1894e23e665cb538051f301a6318850e601c5a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Fri, 19 Jun 2026 13:20:04 +0300
Subject: [PATCH] gdkpixbufdec: Handle format and resolution changes correctly
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5121
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043>
---
ext/gdk_pixbuf/gstgdkpixbufdec.c | 31 ++++++++++++++++---------------
1 file changed, 16 insertions(+), 15 deletions(-)
diff --git a/ext/gdk_pixbuf/gstgdkpixbufdec.c b/ext/gdk_pixbuf/gstgdkpixbufdec.c
index c0ecb3a..4472e79 100644
--- a/ext/gdk_pixbuf/gstgdkpixbufdec.c
+++ b/ext/gdk_pixbuf/gstgdkpixbufdec.c
@@ -289,6 +289,7 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter)
gint width, height;
gint n_channels;
GstVideoFrame frame;
+ GstVideoFormat fmt;
pixbuf = gdk_pixbuf_loader_get_pixbuf (filter->pixbuf_loader);
if (pixbuf == NULL)
@@ -297,26 +298,26 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter)
width = gdk_pixbuf_get_width (pixbuf);
height = gdk_pixbuf_get_height (pixbuf);
- if (GST_VIDEO_INFO_FORMAT (&filter->info) == GST_VIDEO_FORMAT_UNKNOWN) {
+ n_channels = gdk_pixbuf_get_n_channels (pixbuf);
+ switch (n_channels) {
+ case 3:
+ fmt = GST_VIDEO_FORMAT_RGB;
+ break;
+ case 4:
+ fmt = GST_VIDEO_FORMAT_RGBA;
+ break;
+ default:
+ goto channels_not_supported;
+ }
+
+ if (GST_VIDEO_INFO_FORMAT (&filter->info) != fmt ||
+ GST_VIDEO_INFO_WIDTH (&filter->info) != width ||
+ GST_VIDEO_INFO_HEIGHT (&filter->info) != height) {
GstVideoInfo info;
- GstVideoFormat fmt;
GList *l;
GST_DEBUG ("Set size to %dx%d", width, height);
- n_channels = gdk_pixbuf_get_n_channels (pixbuf);
- switch (n_channels) {
- case 3:
- fmt = GST_VIDEO_FORMAT_RGB;
- break;
- case 4:
- fmt = GST_VIDEO_FORMAT_RGBA;
- break;
- default:
- goto channels_not_supported;
- }
-
-
gst_video_info_init (&info);
if (!gst_video_info_set_format (&info, fmt, width, height))
goto format_not_supported;

10
gstreamer1-plugins-good.spec
View File

@ -15,7 +15,7 @@
Name: gstreamer1-plugins-good
Version: 1.16.1
Release: 7%{?gitcommit:.git%{shortcommit}}%{?dist}.5
Release: 7%{?gitcommit:.git%{shortcommit}}%{?dist}.6
Summary: GStreamer plugins with good code and licensing
License: LGPLv2+
@ -57,6 +57,9 @@ Patch14: gstreamer1-plugins-good-1.16.1-CVE-2026-18296.patch
# https://issues.redhat.com/browse/RHEL-246618
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042
Patch15: gstreamer1-plugins-good-1.16.1-CVE-2026-18299.patch
# https://issues.redhat.com/browse/RHEL-246561
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/cf4f7cbc081cde7769862b424c105f10c083171b
Patch16: gstreamer1-plugins-good-1.16.1-CVE-2026-18298.patch
BuildRequires: gcc
BuildRequires: gcc-c++
@ -206,6 +209,7 @@ to be installed.
%patch13 -p1
%patch14 -p1
%patch15 -p1
%patch16 -p1
%build
%configure --disable-silent-rules --disable-fatal-warnings \
@ -390,6 +394,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
%changelog
* Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.6
- Fix CVE-2026-18298: heap buffer overflow in GdkPixbuf image decoder
Resolves: RHEL-246561
* Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.5
- Fix CVE-2026-18299: Use-After-Free in rtpsbcdepay
Resolves: RHEL-246618