rpms/gstreamer1-plugins-good
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import Oracle_OSS gstreamer1-plugins-good-1.26.7-2.el10_2.3

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-12 04:41:11 -04:00
parent e898ba14a5
commit e94107739d
2 changed files with 343 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

335
gstreamer1-plugins-good-1.26.7-CVE-2026-18649.patch Normal file
View File

@ -0,0 +1,335 @@
From 0c1e0c8b4ba81f611d289287249089943fee8fb1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Wed, 29 Jul 2026 17:39:56 +0300
Subject: [PATCH 1/2] rtph264depay: rtph265depay: Limit the maximum
fragmentation unit size
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5224
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234>
---
.../docs/gst_plugins_cache.json | 28 ++++++++++++
.../gst/rtp/gstrtph264depay.c | 43 ++++++++++++++++++-
.../gst/rtp/gstrtph264depay.h | 1 +
.../gst/rtp/gstrtph265depay.c | 39 +++++++++++++++++
.../gst/rtp/gstrtph265depay.h | 1 +
5 files changed, 111 insertions(+), 1 deletion(-)
diff --git a/subprojects/gst-plugins-good/docs/gst_plugins_cache.json b/subprojects/gst-plugins-good/docs/gst_plugins_cache.json
index af7941496a..f22df3a2be 100644
--- a/subprojects/gst-plugins-good/docs/gst_plugins_cache.json
+++ b/subprojects/gst-plugins-good/docs/gst_plugins_cache.json
@@ -15475,6 +15475,20 @@
}
},
"properties": {
+ "max-fragmentation-unit-size": {
+ "blurb": "Maximum size in bytes for a fragmentation unit (0 = auto)",
+ "conditionally-available": false,
+ "construct": false,
+ "construct-only": false,
+ "controllable": false,
+ "default": "33554432",
+ "max": "-1",
+ "min": "0",
+ "mutable": "null",
+ "readable": true,
+ "type": "guint",
+ "writable": true
+ },
"request-keyframe": {
"blurb": "Request new keyframe when packet loss is detected",
"conditionally-available": false,
@@ -15595,6 +15609,20 @@
}
},
"properties": {
+ "max-fragmentation-unit-size": {
+ "blurb": "Maximum size in bytes for a fragmentation unit (0 = auto)",
+ "conditionally-available": false,
+ "construct": false,
+ "construct-only": false,
+ "controllable": false,
+ "default": "33554432",
+ "max": "-1",
+ "min": "0",
+ "mutable": "null",
+ "readable": true,
+ "type": "guint",
+ "writable": true
+ },
"request-keyframe": {
"blurb": "Request new keyframe when packet loss is detected",
"conditionally-available": false,
diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c
index bf9b1050f9..55b8b02b4c 100644
--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c
+++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c
@@ -41,12 +41,14 @@ GST_DEBUG_CATEGORY_STATIC (rtph264depay_debug);
#define DEFAULT_ACCESS_UNIT FALSE
#define DEFAULT_WAIT_FOR_KEYFRAME FALSE
#define DEFAULT_REQUEST_KEYFRAME FALSE
+#define DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE (32 * 1024 * 1024)
enum
{
PROP_0,
PROP_WAIT_FOR_KEYFRAME,
PROP_REQUEST_KEYFRAME,
+ PROP_MAX_FRAGMENTATION_UNIT_SIZE,
};
@@ -126,6 +128,9 @@ gst_rtp_h264_depay_set_property (GObject * object, guint prop_id,
case PROP_REQUEST_KEYFRAME:
self->request_keyframe = g_value_get_boolean (value);
break;
+ case PROP_MAX_FRAGMENTATION_UNIT_SIZE:
+ self->max_fragmentation_unit_size = g_value_get_uint (value);
+ break;
default:
G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
break;
@@ -145,6 +150,9 @@ gst_rtp_h264_depay_get_property (GObject * object, guint prop_id,
case PROP_REQUEST_KEYFRAME:
g_value_set_boolean (value, self->request_keyframe);
break;
+ case PROP_MAX_FRAGMENTATION_UNIT_SIZE:
+ g_value_set_uint (value, self->max_fragmentation_unit_size);
+ break;
default:
G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
break;
@@ -195,6 +203,24 @@ gst_rtp_h264_depay_class_init (GstRtpH264DepayClass * klass)
DEFAULT_REQUEST_KEYFRAME,
G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
+ /**
+ * GstRtpH264Depay:max-fragmentation-unit-size:
+ *
+ * Maximum size in bytes for a fragmentation unit. Larger units
+ * will be dropped to prevent excessive memory usage.
+ *
+ * Use 0 for automatic.
+ *
+ * Since: 1.28.6
+ */
+ g_object_class_install_property (gobject_class,
+ PROP_MAX_FRAGMENTATION_UNIT_SIZE,
+ g_param_spec_uint ("max-fragmentation-unit-size",
+ "Max Fragmentation Unit Size",
+ "Maximum size in bytes for a fragmentation unit (0 = auto)", 0,
+ G_MAXUINT, DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE,
+ G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
+
gst_element_class_add_static_pad_template (gstelement_class,
&gst_rtp_h264_depay_src_template);
gst_element_class_add_static_pad_template (gstelement_class,
@@ -227,6 +253,8 @@ gst_rtp_h264_depay_init (GstRtpH264Depay * rtph264depay)
(GDestroyNotify) gst_buffer_unref);
rtph264depay->wait_for_keyframe = DEFAULT_WAIT_FOR_KEYFRAME;
rtph264depay->request_keyframe = DEFAULT_REQUEST_KEYFRAME;
+ rtph264depay->max_fragmentation_unit_size =
+ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE;
}
static void
@@ -1465,8 +1493,21 @@ gst_rtp_h264_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
rtph264depay->fu_marker = marker;
/* if NAL unit ends, flush the adapter */
- if (E)
+ if (E) {
gst_rtp_h264_finish_fragmentation_unit (rtph264depay);
+ GST_DEBUG_OBJECT (rtph264depay, "End of Fragmentation Unit");
+ } else {
+ guint limit = rtph264depay->max_fragmentation_unit_size ?
+ rtph264depay->max_fragmentation_unit_size :
+ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE;
+ if (gst_adapter_available (rtph264depay->adapter) > limit) {
+ GST_WARNING_OBJECT (rtph264depay,
+ "Too big (> %u bytes) fragmentation unit, dropping.", limit);
+ gst_rtp_base_depayload_flush (depayload, FALSE);
+ gst_adapter_clear (rtph264depay->adapter);
+ return NULL;
+ }
+ }
break;
}
default:
diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.h b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.h
index ac1f0106f4..27486bf441 100644
--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.h
+++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.h
@@ -76,6 +76,7 @@ struct _GstRtpH264Depay
gboolean request_keyframe;
gboolean waiting_for_keyframe;
gboolean requesting_keyframe;
+ guint max_fragmentation_unit_size;
};
struct _GstRtpH264DepayClass
diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c
index 177a1103e8..50e24a32e7 100644
--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c
+++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c
@@ -41,12 +41,14 @@ GST_DEBUG_CATEGORY_STATIC (rtph265depay_debug);
#define DEFAULT_ACCESS_UNIT FALSE
#define DEFAULT_WAIT_FOR_KEYFRAME FALSE
#define DEFAULT_REQUEST_KEYFRAME FALSE
+#define DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE (32 * 1024 * 1024)
enum
{
PROP_0,
PROP_WAIT_FOR_KEYFRAME,
PROP_REQUEST_KEYFRAME,
+ PROP_MAX_FRAGMENTATION_UNIT_SIZE,
};
@@ -142,6 +144,9 @@ gst_rtp_h265_depay_set_property (GObject * object, guint prop_id,
case PROP_REQUEST_KEYFRAME:
self->request_keyframe = g_value_get_boolean (value);
break;
+ case PROP_MAX_FRAGMENTATION_UNIT_SIZE:
+ self->max_fragmentation_unit_size = g_value_get_uint (value);
+ break;
default:
G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
break;
@@ -161,6 +166,9 @@ gst_rtp_h265_depay_get_property (GObject * object, guint prop_id,
case PROP_REQUEST_KEYFRAME:
g_value_set_boolean (value, self->request_keyframe);
break;
+ case PROP_MAX_FRAGMENTATION_UNIT_SIZE:
+ g_value_set_uint (value, self->max_fragmentation_unit_size);
+ break;
default:
G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
break;
@@ -212,6 +220,24 @@ gst_rtp_h265_depay_class_init (GstRtpH265DepayClass * klass)
DEFAULT_REQUEST_KEYFRAME,
G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
+ /**
+ * GstRtpH265Depay:max-fragmentation-unit-size:
+ *
+ * Maximum size in bytes for a fragmentation unit. Larger units
+ * will be dropped to prevent excessive memory usage.
+ *
+ * Use 0 for automatic.
+ *
+ * Since: 1.28.6
+ */
+ g_object_class_install_property (gobject_class,
+ PROP_MAX_FRAGMENTATION_UNIT_SIZE,
+ g_param_spec_uint ("max-fragmentation-unit-size",
+ "Max Fragmentation Unit Size",
+ "Maximum size in bytes for a fragmentation unit (0 = auto)", 0,
+ G_MAXUINT, DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE,
+ G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
+
gst_element_class_add_static_pad_template (gstelement_class,
&gst_rtp_h265_depay_src_template);
gst_element_class_add_static_pad_template (gstelement_class,
@@ -249,6 +275,8 @@ gst_rtp_h265_depay_init (GstRtpH265Depay * rtph265depay)
(GDestroyNotify) gst_buffer_unref);
rtph265depay->wait_for_keyframe = DEFAULT_WAIT_FOR_KEYFRAME;
rtph265depay->request_keyframe = DEFAULT_REQUEST_KEYFRAME;
+ rtph265depay->max_fragmentation_unit_size =
+ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE;
}
static void
@@ -1703,6 +1731,17 @@ gst_rtp_h265_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
if (E) {
gst_rtp_h265_finish_fragmentation_unit (rtph265depay);
GST_DEBUG_OBJECT (rtph265depay, "End of Fragmentation Unit");
+ } else {
+ guint limit = rtph265depay->max_fragmentation_unit_size ?
+ rtph265depay->max_fragmentation_unit_size :
+ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE;
+ if (gst_adapter_available (rtph265depay->adapter) > limit) {
+ GST_WARNING_OBJECT (rtph265depay,
+ "Too big (> %u bytes) fragmentation unit, dropping.", limit);
+ gst_rtp_base_depayload_flush (depayload, FALSE);
+ gst_adapter_clear (rtph265depay->adapter);
+ return NULL;
+ }
}
break;
}
diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.h b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.h
index fc6248e85c..45d9466f7a 100644
--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.h
+++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.h
@@ -91,6 +91,7 @@ struct _GstRtpH265Depay
gboolean request_keyframe;
gboolean waiting_for_keyframe;
gboolean requesting_keyframe;
+ guint max_fragmentation_unit_size;
};
struct _GstRtpH265DepayClass
From d90443cc1ea8c4bd5a82f143797d559158717a58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 4 Aug 2026 20:05:57 +0300
Subject: [PATCH 2/2] rtph264depay: rtph265depay: Reset missing fields when
resetting during fragmentation unit handling
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234>
---
subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c | 6 ++++++
subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c | 6 ++++++
2 files changed, 12 insertions(+)
diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c
index 55b8b02b4c..44ddc5b0fa 100644
--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c
+++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c
@@ -1467,6 +1467,9 @@ gst_rtp_h264_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
"%u to %u within Fragmentation Unit. Data was lost, dropping "
"stored.", rtph264depay->last_fu_seqnum,
gst_rtp_buffer_get_seq (rtp));
+ rtph264depay->wait_start = TRUE;
+ rtph264depay->current_fu_type = 0;
+ rtph264depay->last_fu_seqnum = 0;
gst_rtp_base_depayload_flush (depayload, FALSE);
gst_adapter_clear (rtph264depay->adapter);
return NULL;
@@ -1503,6 +1506,9 @@ gst_rtp_h264_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
if (gst_adapter_available (rtph264depay->adapter) > limit) {
GST_WARNING_OBJECT (rtph264depay,
"Too big (> %u bytes) fragmentation unit, dropping.", limit);
+ rtph264depay->wait_start = TRUE;
+ rtph264depay->current_fu_type = 0;
+ rtph264depay->last_fu_seqnum = 0;
gst_rtp_base_depayload_flush (depayload, FALSE);
gst_adapter_clear (rtph264depay->adapter);
return NULL;
diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c
index 50e24a32e7..5748f51f69 100644
--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c
+++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c
@@ -1699,6 +1699,9 @@ gst_rtp_h265_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
"%u to %u within Fragmentation Unit. Data was lost, dropping "
"stored.", rtph265depay->last_fu_seqnum,
gst_rtp_buffer_get_seq (rtp));
+ rtph265depay->wait_start = TRUE;
+ rtph265depay->current_fu_type = 0;
+ rtph265depay->last_fu_seqnum = 0;
gst_rtp_base_depayload_flush (depayload, FALSE);
gst_adapter_clear (rtph265depay->adapter);
return NULL;
@@ -1738,6 +1741,9 @@ gst_rtp_h265_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
if (gst_adapter_available (rtph265depay->adapter) > limit) {
GST_WARNING_OBJECT (rtph265depay,
"Too big (> %u bytes) fragmentation unit, dropping.", limit);
+ rtph265depay->wait_start = TRUE;
+ rtph265depay->current_fu_type = 0;
+ rtph265depay->last_fu_seqnum = 0;
gst_rtp_base_depayload_flush (depayload, FALSE);
gst_adapter_clear (rtph265depay->adapter);
return NULL;

9
gstreamer1-plugins-good.spec
View File

@ -35,7 +35,7 @@
Name: gstreamer1-plugins-good
Version: 1.26.7
Release: 2%{?dist}.2
Release: 2%{?dist}.3
Summary: GStreamer plugins with good code and licensing
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
@ -63,6 +63,8 @@ Patch: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-53705.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11242
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-5056.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-18649.patch
BuildRequires: meson >= 0.48.0
BuildRequires: gcc
@ -383,6 +385,11 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
%changelog
* Fri Aug 07 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-2.3
- Fix excessive memory allocation from malicious RTP fragmentation unit
packets in rtph264depay/rtph265depay (CVE-2026-18649)
Resolves: RHEL-224158
* Fri Jul 31 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-2.2
- Fix integer overflow and bounds check vulnerabilities in uncompressed
video handling (CVE-2026-5056)