rpms/gstreamer1-plugins-good
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import Oracle_OSS gstreamer1-plugins-good-1.26.7-2.el10_2.2

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-03 12:53:52 -04:00
parent 03715fb10c
commit e898ba14a5
2 changed files with 105 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

97
gstreamer1-plugins-good-1.26.7-CVE-2026-5056.patch Normal file
View File

@ -0,0 +1,97 @@
From e4aeed10953ee9ca359a256036e3f1f6151dbdb0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Fri, 13 Mar 2026 11:56:45 +0200
Subject: [PATCH] qtdemux: Add various integer overflow and bounds checks to
uncompressed video handling
Fixes ZDI-CAN-29392
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4963
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11242>
---
.../gst-plugins-good/gst/isomp4/qtdemux.c | 37 ++++++++++++++++---
1 file changed, 32 insertions(+), 5 deletions(-)
diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
index b5669275f6..92c61787f2 100644
--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
@@ -12121,6 +12121,14 @@ qtdemux_parse_cmpd (GstQTDemux * qtdemux, GstByteReader * reader,
cmpd->component_count = gst_byte_reader_get_uint32_be_unchecked (reader);
+ /* Let's use 16 as a upper bound here for now to avoid overflows and
+ * allocating lots of memory */
+ if (cmpd->component_count > 16) {
+ GST_ERROR_OBJECT (qtdemux, "Unsupported number of cmpd components %u",
+ cmpd->component_count);
+ goto error;
+ }
+
guint32 minimum_size = cmpd->component_count * 2 + 4; // assuming type_uris are not used
if (gst_byte_reader_get_size (reader) < minimum_size) {
GST_ERROR_OBJECT (qtdemux, "cmpd size is too short");
@@ -12179,6 +12187,14 @@ qtdemux_parse_uncC (GstQTDemux * qtdemux, GstByteReader * reader,
goto error;
}
+ /* Let's use 16 as a upper bound here for now to avoid overflows and
+ * allocating lots of memory */
+ if (uncC->component_count > 16) {
+ GST_ERROR_OBJECT (qtdemux, "Unsupported number of uncC components %u",
+ uncC->component_count);
+ goto error;
+ }
+
guint32 expected_size = uncC->component_count * 5 + 36;
if (gst_byte_reader_get_size (reader) != expected_size) {
GST_ERROR_OBJECT (qtdemux, "uncC size is incorrect");
@@ -12432,7 +12448,6 @@ qtdemux_get_format_from_uncv (GstQTDemux * qtdemux,
guint32 num_components = uncC->component_count;
guint16 component_types[4];
-
if (uncC->version == 1) {
// Determine format with profile
// The only permitted profiles for version 1 are `rgb3`, `rgba`, and `abgr`
@@ -12460,6 +12475,11 @@ qtdemux_get_format_from_uncv (GstQTDemux * qtdemux,
goto unsupported_feature;
}
+ if (num_components > 4 || num_components == 0) {
+ GST_WARNING_OBJECT (qtdemux,
+ "Unsupported number of components for uncC: %u", num_components);
+ goto unsupported_feature;
+ }
/* Assert that components are similar */
UncompressedFrameConfigComponent *first_comp = &uncC->components[0];
@@ -12501,6 +12521,11 @@ qtdemux_get_format_from_uncv (GstQTDemux * qtdemux,
// Get Component Types
for (guint32 i = 0; i < num_components; i++) {
guint16 component_index = uncC->components[i].index;
+ if (component_index >= cmpd->component_count) {
+ GST_WARNING_OBJECT (qtdemux,
+ "Invalid component index %u for component %u", component_index, i);
+ goto unsupported_feature;
+ }
component_types[i] = cmpd->types[component_index];
}
@@ -18919,10 +18944,12 @@ qtdemux_video_caps (GstQTDemux * qtdemux, QtDemuxStream * stream,
}
format = qtdemux_get_format_from_uncv (qtdemux, &uncC, &cmpd);
- gst_video_info_set_format (&stream->pre_info, format, entry->width,
- entry->height);
- qtdemux_set_info_from_uncv (qtdemux, entry, &uncC, &stream->pre_info);
- stream->alignment = 32;
+ if (format != GST_VIDEO_FORMAT_UNKNOWN) {
+ gst_video_info_set_format (&stream->pre_info, format, entry->width,
+ entry->height);
+ qtdemux_set_info_from_uncv (qtdemux, entry, &uncC, &stream->pre_info);
+ stream->alignment = 32;
+ }
/* Free Memory */
qtdemux_clear_uncC (&uncC);

9
gstreamer1-plugins-good.spec
View File

@ -35,7 +35,7 @@
Name: gstreamer1-plugins-good
Version: 1.26.7
Release: 2%{?dist}.1
Release: 2%{?dist}.2
Summary: GStreamer plugins with good code and licensing
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
@ -61,6 +61,8 @@ Patch: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
# https://github.com/GStreamer/gstreamer/commit/f2313c0bcc1f68054168e0b6e884d458fba76fbc
# https://github.com/GStreamer/gstreamer/commit/e92726ba1b60c16487d7a0fe11198f41e3bad51c
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-53705.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11242
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-5056.patch
BuildRequires: meson >= 0.48.0
BuildRequires: gcc
@ -381,6 +383,11 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
%changelog
* Fri Jul 31 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-2.2
- Fix integer overflow and bounds check vulnerabilities in uncompressed
video handling (CVE-2026-5056)
Resolves: RHEL-222333
* Fri Jun 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-2.1
- Fix integer overflow vulnerabilities in wavpack decoder (CVE-2026-53705)
Resolves: RHEL-184480