rpms/gstreamer1-plugins-good
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling

Browse Source 
Backport upstream commit 0bcc6564c7d to fix CVE-2026-73434,
an out-of-bounds read in avidemux. The patch corrects the
divisor used when calculating the available number of vprp
field info entries, changing it from `vprp->fields` to
`sizeof(vprp->field_info[0])`.

CVE: CVE-2026-73434
Upstream patches:
 - 0bcc6564c7.patch
Resolves: RHEL-239041

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-17 08:55:27 +00:00 committed by tpelka
parent 53fb8e1fe5
commit d419d7cade
2 changed files with 34 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
gstreamer1-plugins-good-1.26.7-CVE-2026-73434.patch Normal file
View File

@ -0,0 +1,27 @@
From 7cd0c43703af77c9cb7b5c2028c9b86227f857e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 14 Jul 2026 12:35:12 +0300
Subject: [PATCH] avidemux: Use correct divisor for calculating available
number of vprp field infos
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
---
subprojects/gst-plugins-good/gst/avi/gstavidemux.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
index 82d5d4857c..3a85909eb0 100644
--- a/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
+++ b/subprojects/gst-plugins-good/gst/avi/gstavidemux.c
@@ -1808,7 +1808,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element,
/* size checking */
/* calculate fields based on size */
- k = (size - G_STRUCT_OFFSET (gst_riff_vprp, field_info)) / vprp->fields;
+ k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
+ field_info)) / sizeof (vprp->field_info[0]);
if (vprp->fields > k) {
GST_WARNING_OBJECT (element,
"vprp header indicated %d fields, only %d available", vprp->fields, k);

8
gstreamer1-plugins-good.spec
View File

@ -35,7 +35,7 @@
Name: gstreamer1-plugins-good
Version: 1.26.7
Release: 5%{?dist}
Release: 6%{?dist}
Summary: GStreamer plugins with good code and licensing
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
@ -62,6 +62,8 @@ Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-53705.patch
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-18649.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11242
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-5056.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-73434.patch
BuildRequires: meson >= 0.48.0
BuildRequires: gcc
@ -382,6 +384,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
%changelog
* Mon Aug 17 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-6
- Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling
Resolves: RHEL-239041
* Tue Aug 11 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-5
- Fix CVE-2026-5056: bounds checks in qtdemux uncompressed video
Resolves: RHEL-222332