From e94107739db175ee4cf381b1d93db84f8ecb8fef Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Wed, 12 Aug 2026 04:41:11 -0400 Subject: [PATCH] import Oracle_OSS gstreamer1-plugins-good-1.26.7-2.el10_2.3 --- ...1-plugins-good-1.26.7-CVE-2026-18649.patch | 335 ++++++++++++++++++ gstreamer1-plugins-good.spec | 9 +- 2 files changed, 343 insertions(+), 1 deletion(-) create mode 100644 gstreamer1-plugins-good-1.26.7-CVE-2026-18649.patch diff --git a/gstreamer1-plugins-good-1.26.7-CVE-2026-18649.patch b/gstreamer1-plugins-good-1.26.7-CVE-2026-18649.patch new file mode 100644 index 0000000..39f5c25 --- /dev/null +++ b/gstreamer1-plugins-good-1.26.7-CVE-2026-18649.patch @@ -0,0 +1,335 @@ +From 0c1e0c8b4ba81f611d289287249089943fee8fb1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Wed, 29 Jul 2026 17:39:56 +0300 +Subject: [PATCH 1/2] rtph264depay: rtph265depay: Limit the maximum + fragmentation unit size + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5224 + +Part-of: +--- + .../docs/gst_plugins_cache.json | 28 ++++++++++++ + .../gst/rtp/gstrtph264depay.c | 43 ++++++++++++++++++- + .../gst/rtp/gstrtph264depay.h | 1 + + .../gst/rtp/gstrtph265depay.c | 39 +++++++++++++++++ + .../gst/rtp/gstrtph265depay.h | 1 + + 5 files changed, 111 insertions(+), 1 deletion(-) + +diff --git a/subprojects/gst-plugins-good/docs/gst_plugins_cache.json b/subprojects/gst-plugins-good/docs/gst_plugins_cache.json +index af7941496a..f22df3a2be 100644 +--- a/subprojects/gst-plugins-good/docs/gst_plugins_cache.json ++++ b/subprojects/gst-plugins-good/docs/gst_plugins_cache.json +@@ -15475,6 +15475,20 @@ + } + }, + "properties": { ++ "max-fragmentation-unit-size": { ++ "blurb": "Maximum size in bytes for a fragmentation unit (0 = auto)", ++ "conditionally-available": false, ++ "construct": false, ++ "construct-only": false, ++ "controllable": false, ++ "default": "33554432", ++ "max": "-1", ++ "min": "0", ++ "mutable": "null", ++ "readable": true, ++ "type": "guint", ++ "writable": true ++ }, + "request-keyframe": { + "blurb": "Request new keyframe when packet loss is detected", + "conditionally-available": false, +@@ -15595,6 +15609,20 @@ + } + }, + "properties": { ++ "max-fragmentation-unit-size": { ++ "blurb": "Maximum size in bytes for a fragmentation unit (0 = auto)", ++ "conditionally-available": false, ++ "construct": false, ++ "construct-only": false, ++ "controllable": false, ++ "default": "33554432", ++ "max": "-1", ++ "min": "0", ++ "mutable": "null", ++ "readable": true, ++ "type": "guint", ++ "writable": true ++ }, + "request-keyframe": { + "blurb": "Request new keyframe when packet loss is detected", + "conditionally-available": false, +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c +index bf9b1050f9..55b8b02b4c 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c +@@ -41,12 +41,14 @@ GST_DEBUG_CATEGORY_STATIC (rtph264depay_debug); + #define DEFAULT_ACCESS_UNIT FALSE + #define DEFAULT_WAIT_FOR_KEYFRAME FALSE + #define DEFAULT_REQUEST_KEYFRAME FALSE ++#define DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE (32 * 1024 * 1024) + + enum + { + PROP_0, + PROP_WAIT_FOR_KEYFRAME, + PROP_REQUEST_KEYFRAME, ++ PROP_MAX_FRAGMENTATION_UNIT_SIZE, + }; + + +@@ -126,6 +128,9 @@ gst_rtp_h264_depay_set_property (GObject * object, guint prop_id, + case PROP_REQUEST_KEYFRAME: + self->request_keyframe = g_value_get_boolean (value); + break; ++ case PROP_MAX_FRAGMENTATION_UNIT_SIZE: ++ self->max_fragmentation_unit_size = g_value_get_uint (value); ++ break; + default: + G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); + break; +@@ -145,6 +150,9 @@ gst_rtp_h264_depay_get_property (GObject * object, guint prop_id, + case PROP_REQUEST_KEYFRAME: + g_value_set_boolean (value, self->request_keyframe); + break; ++ case PROP_MAX_FRAGMENTATION_UNIT_SIZE: ++ g_value_set_uint (value, self->max_fragmentation_unit_size); ++ break; + default: + G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); + break; +@@ -195,6 +203,24 @@ gst_rtp_h264_depay_class_init (GstRtpH264DepayClass * klass) + DEFAULT_REQUEST_KEYFRAME, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS)); + ++ /** ++ * GstRtpH264Depay:max-fragmentation-unit-size: ++ * ++ * Maximum size in bytes for a fragmentation unit. Larger units ++ * will be dropped to prevent excessive memory usage. ++ * ++ * Use 0 for automatic. ++ * ++ * Since: 1.28.6 ++ */ ++ g_object_class_install_property (gobject_class, ++ PROP_MAX_FRAGMENTATION_UNIT_SIZE, ++ g_param_spec_uint ("max-fragmentation-unit-size", ++ "Max Fragmentation Unit Size", ++ "Maximum size in bytes for a fragmentation unit (0 = auto)", 0, ++ G_MAXUINT, DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE, ++ G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS)); ++ + gst_element_class_add_static_pad_template (gstelement_class, + &gst_rtp_h264_depay_src_template); + gst_element_class_add_static_pad_template (gstelement_class, +@@ -227,6 +253,8 @@ gst_rtp_h264_depay_init (GstRtpH264Depay * rtph264depay) + (GDestroyNotify) gst_buffer_unref); + rtph264depay->wait_for_keyframe = DEFAULT_WAIT_FOR_KEYFRAME; + rtph264depay->request_keyframe = DEFAULT_REQUEST_KEYFRAME; ++ rtph264depay->max_fragmentation_unit_size = ++ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE; + } + + static void +@@ -1465,8 +1493,21 @@ gst_rtp_h264_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + rtph264depay->fu_marker = marker; + + /* if NAL unit ends, flush the adapter */ +- if (E) ++ if (E) { + gst_rtp_h264_finish_fragmentation_unit (rtph264depay); ++ GST_DEBUG_OBJECT (rtph264depay, "End of Fragmentation Unit"); ++ } else { ++ guint limit = rtph264depay->max_fragmentation_unit_size ? ++ rtph264depay->max_fragmentation_unit_size : ++ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE; ++ if (gst_adapter_available (rtph264depay->adapter) > limit) { ++ GST_WARNING_OBJECT (rtph264depay, ++ "Too big (> %u bytes) fragmentation unit, dropping.", limit); ++ gst_rtp_base_depayload_flush (depayload, FALSE); ++ gst_adapter_clear (rtph264depay->adapter); ++ return NULL; ++ } ++ } + break; + } + default: +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.h b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.h +index ac1f0106f4..27486bf441 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.h ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.h +@@ -76,6 +76,7 @@ struct _GstRtpH264Depay + gboolean request_keyframe; + gboolean waiting_for_keyframe; + gboolean requesting_keyframe; ++ guint max_fragmentation_unit_size; + }; + + struct _GstRtpH264DepayClass +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c +index 177a1103e8..50e24a32e7 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c +@@ -41,12 +41,14 @@ GST_DEBUG_CATEGORY_STATIC (rtph265depay_debug); + #define DEFAULT_ACCESS_UNIT FALSE + #define DEFAULT_WAIT_FOR_KEYFRAME FALSE + #define DEFAULT_REQUEST_KEYFRAME FALSE ++#define DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE (32 * 1024 * 1024) + + enum + { + PROP_0, + PROP_WAIT_FOR_KEYFRAME, + PROP_REQUEST_KEYFRAME, ++ PROP_MAX_FRAGMENTATION_UNIT_SIZE, + }; + + +@@ -142,6 +144,9 @@ gst_rtp_h265_depay_set_property (GObject * object, guint prop_id, + case PROP_REQUEST_KEYFRAME: + self->request_keyframe = g_value_get_boolean (value); + break; ++ case PROP_MAX_FRAGMENTATION_UNIT_SIZE: ++ self->max_fragmentation_unit_size = g_value_get_uint (value); ++ break; + default: + G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); + break; +@@ -161,6 +166,9 @@ gst_rtp_h265_depay_get_property (GObject * object, guint prop_id, + case PROP_REQUEST_KEYFRAME: + g_value_set_boolean (value, self->request_keyframe); + break; ++ case PROP_MAX_FRAGMENTATION_UNIT_SIZE: ++ g_value_set_uint (value, self->max_fragmentation_unit_size); ++ break; + default: + G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); + break; +@@ -212,6 +220,24 @@ gst_rtp_h265_depay_class_init (GstRtpH265DepayClass * klass) + DEFAULT_REQUEST_KEYFRAME, + G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS)); + ++ /** ++ * GstRtpH265Depay:max-fragmentation-unit-size: ++ * ++ * Maximum size in bytes for a fragmentation unit. Larger units ++ * will be dropped to prevent excessive memory usage. ++ * ++ * Use 0 for automatic. ++ * ++ * Since: 1.28.6 ++ */ ++ g_object_class_install_property (gobject_class, ++ PROP_MAX_FRAGMENTATION_UNIT_SIZE, ++ g_param_spec_uint ("max-fragmentation-unit-size", ++ "Max Fragmentation Unit Size", ++ "Maximum size in bytes for a fragmentation unit (0 = auto)", 0, ++ G_MAXUINT, DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE, ++ G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS)); ++ + gst_element_class_add_static_pad_template (gstelement_class, + &gst_rtp_h265_depay_src_template); + gst_element_class_add_static_pad_template (gstelement_class, +@@ -249,6 +275,8 @@ gst_rtp_h265_depay_init (GstRtpH265Depay * rtph265depay) + (GDestroyNotify) gst_buffer_unref); + rtph265depay->wait_for_keyframe = DEFAULT_WAIT_FOR_KEYFRAME; + rtph265depay->request_keyframe = DEFAULT_REQUEST_KEYFRAME; ++ rtph265depay->max_fragmentation_unit_size = ++ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE; + } + + static void +@@ -1703,6 +1731,17 @@ gst_rtp_h265_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + if (E) { + gst_rtp_h265_finish_fragmentation_unit (rtph265depay); + GST_DEBUG_OBJECT (rtph265depay, "End of Fragmentation Unit"); ++ } else { ++ guint limit = rtph265depay->max_fragmentation_unit_size ? ++ rtph265depay->max_fragmentation_unit_size : ++ DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE; ++ if (gst_adapter_available (rtph265depay->adapter) > limit) { ++ GST_WARNING_OBJECT (rtph265depay, ++ "Too big (> %u bytes) fragmentation unit, dropping.", limit); ++ gst_rtp_base_depayload_flush (depayload, FALSE); ++ gst_adapter_clear (rtph265depay->adapter); ++ return NULL; ++ } + } + break; + } +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.h b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.h +index fc6248e85c..45d9466f7a 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.h ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.h +@@ -91,6 +91,7 @@ struct _GstRtpH265Depay + gboolean request_keyframe; + gboolean waiting_for_keyframe; + gboolean requesting_keyframe; ++ guint max_fragmentation_unit_size; + }; + + struct _GstRtpH265DepayClass + +From d90443cc1ea8c4bd5a82f143797d559158717a58 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Tue, 4 Aug 2026 20:05:57 +0300 +Subject: [PATCH 2/2] rtph264depay: rtph265depay: Reset missing fields when + resetting during fragmentation unit handling + +Part-of: +--- + subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c | 6 ++++++ + subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c | 6 ++++++ + 2 files changed, 12 insertions(+) + +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c +index 55b8b02b4c..44ddc5b0fa 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph264depay.c +@@ -1467,6 +1467,9 @@ gst_rtp_h264_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + "%u to %u within Fragmentation Unit. Data was lost, dropping " + "stored.", rtph264depay->last_fu_seqnum, + gst_rtp_buffer_get_seq (rtp)); ++ rtph264depay->wait_start = TRUE; ++ rtph264depay->current_fu_type = 0; ++ rtph264depay->last_fu_seqnum = 0; + gst_rtp_base_depayload_flush (depayload, FALSE); + gst_adapter_clear (rtph264depay->adapter); + return NULL; +@@ -1503,6 +1506,9 @@ gst_rtp_h264_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + if (gst_adapter_available (rtph264depay->adapter) > limit) { + GST_WARNING_OBJECT (rtph264depay, + "Too big (> %u bytes) fragmentation unit, dropping.", limit); ++ rtph264depay->wait_start = TRUE; ++ rtph264depay->current_fu_type = 0; ++ rtph264depay->last_fu_seqnum = 0; + gst_rtp_base_depayload_flush (depayload, FALSE); + gst_adapter_clear (rtph264depay->adapter); + return NULL; +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c +index 50e24a32e7..5748f51f69 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtph265depay.c +@@ -1699,6 +1699,9 @@ gst_rtp_h265_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + "%u to %u within Fragmentation Unit. Data was lost, dropping " + "stored.", rtph265depay->last_fu_seqnum, + gst_rtp_buffer_get_seq (rtp)); ++ rtph265depay->wait_start = TRUE; ++ rtph265depay->current_fu_type = 0; ++ rtph265depay->last_fu_seqnum = 0; + gst_rtp_base_depayload_flush (depayload, FALSE); + gst_adapter_clear (rtph265depay->adapter); + return NULL; +@@ -1738,6 +1741,9 @@ gst_rtp_h265_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + if (gst_adapter_available (rtph265depay->adapter) > limit) { + GST_WARNING_OBJECT (rtph265depay, + "Too big (> %u bytes) fragmentation unit, dropping.", limit); ++ rtph265depay->wait_start = TRUE; ++ rtph265depay->current_fu_type = 0; ++ rtph265depay->last_fu_seqnum = 0; + gst_rtp_base_depayload_flush (depayload, FALSE); + gst_adapter_clear (rtph265depay->adapter); + return NULL; diff --git a/gstreamer1-plugins-good.spec b/gstreamer1-plugins-good.spec index f82cd44..9e7a93e 100644 --- a/gstreamer1-plugins-good.spec +++ b/gstreamer1-plugins-good.spec @@ -35,7 +35,7 @@ Name: gstreamer1-plugins-good Version: 1.26.7 -Release: 2%{?dist}.2 +Release: 2%{?dist}.3 Summary: GStreamer plugins with good code and licensing License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0 @@ -63,6 +63,8 @@ Patch: 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-53705.patch # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11242 Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-5056.patch +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12234 +Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-18649.patch BuildRequires: meson >= 0.48.0 BuildRequires: gcc @@ -383,6 +385,11 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';' %changelog +* Fri Aug 07 2026 RHEL Packaging Agent - 1.26.7-2.3 +- Fix excessive memory allocation from malicious RTP fragmentation unit + packets in rtph264depay/rtph265depay (CVE-2026-18649) + Resolves: RHEL-224158 + * Fri Jul 31 2026 RHEL Packaging Agent - 1.26.7-2.2 - Fix integer overflow and bounds check vulnerabilities in uncompressed video handling (CVE-2026-5056)