Fix CVE-2026-18299: Use-After-Free in rtpsbcdepay
Backport upstream MR 12042 to fix CVE-2026-18299 in the rtpsbcdepay element. The patch includes three commits that fix a use-after-free by resetting buffer pointers after ownership transfer, add a payload length bounds check for the payload header, and correct variable shadowing introduced by the first fix. CVE: CVE-2026-18299 Upstream patches: - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042.patch Resolves: RHEL-246615 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
parent
c6cc3a250e
commit
ef64522103
111
gstreamer1-plugins-good-1.26.7-CVE-2026-18299.patch
Normal file
111
gstreamer1-plugins-good-1.26.7-CVE-2026-18299.patch
Normal file
@ -0,0 +1,111 @@
|
||||
From 347b200894a273d3a08ff15035ac03a6f9056463 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 19 Jun 2026 12:50:32 +0300
|
||||
Subject: [PATCH 1/3] rtpsbcdepay: Check for available data in the adapter
|
||||
before getting data
|
||||
|
||||
Consider empty packets with the last flag as bad packets.
|
||||
|
||||
Also reset buffers to NULL after giving away ownership of them to avoid
|
||||
returning an already freed buffer.
|
||||
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5119
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042>
|
||||
---
|
||||
.../gst-plugins-good/gst/rtp/gstrtpsbcdepay.c | 29 ++++++++++++-------
|
||||
1 file changed, 18 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c
|
||||
index 1de5a8bce5..ffba32de50 100644
|
||||
--- a/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c
|
||||
+++ b/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c
|
||||
@@ -331,19 +331,26 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp)
|
||||
}
|
||||
|
||||
gst_adapter_push (depay->adapter, data);
|
||||
+ data = NULL;
|
||||
|
||||
if (last) {
|
||||
- gint framelen, samples;
|
||||
- guint8 header[4];
|
||||
-
|
||||
- data = gst_adapter_take_buffer (depay->adapter,
|
||||
- gst_adapter_available (depay->adapter));
|
||||
- gst_rtp_drop_non_audio_meta (depay, data);
|
||||
-
|
||||
- if (gst_buffer_extract (data, 0, &header, 4) != 4 ||
|
||||
- gst_rtp_sbc_depay_get_params (depay, header,
|
||||
- payload_len, &framelen, &samples) < 0) {
|
||||
- gst_buffer_unref (data);
|
||||
+ if (gst_adapter_available (depay->adapter)) {
|
||||
+ gint framelen, samples;
|
||||
+ guint8 header[4];
|
||||
+
|
||||
+ data = gst_adapter_take_buffer (depay->adapter,
|
||||
+ gst_adapter_available (depay->adapter));
|
||||
+ gst_rtp_drop_non_audio_meta (depay, data);
|
||||
+
|
||||
+ if (gst_buffer_extract (data, 0, &header, 4) != 4 ||
|
||||
+ gst_rtp_sbc_depay_get_params (depay, header,
|
||||
+ payload_len, &framelen, &samples) < 0) {
|
||||
+ gst_buffer_unref (data);
|
||||
+ data = NULL;
|
||||
+ goto bad_packet;
|
||||
+ }
|
||||
+ } else {
|
||||
+ data = NULL;
|
||||
goto bad_packet;
|
||||
}
|
||||
} else {
|
||||
|
||||
From 3d1ff1679406eba939cc3099449d9a07b1762d3f Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 19 Jun 2026 12:55:34 +0300
|
||||
Subject: [PATCH 2/3] rtpsbcdepay: Check that enough data is available for the
|
||||
payload header
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042>
|
||||
---
|
||||
subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c
|
||||
index ffba32de50..690151777b 100644
|
||||
--- a/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c
|
||||
+++ b/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c
|
||||
@@ -303,6 +303,8 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp)
|
||||
|
||||
payload = gst_rtp_buffer_get_payload (rtp);
|
||||
payload_len = gst_rtp_buffer_get_payload_len (rtp);
|
||||
+ if (payload_len < 1)
|
||||
+ goto bad_packet;
|
||||
|
||||
fragment = payload[0] & 0x80;
|
||||
start = payload[0] & 0x40;
|
||||
|
||||
From 15fc8d9190bebbf1e96919f55ac531eba81935d2 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Fri, 19 Jun 2026 13:00:27 +0300
|
||||
Subject: [PATCH 3/3] rtpsbcdepay: Remove wrong variable shadowing
|
||||
|
||||
`samples` is expected to be set in the outer scope at a later time.
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042>
|
||||
---
|
||||
subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c
|
||||
index 690151777b..3efe115cd4 100644
|
||||
--- a/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c
|
||||
+++ b/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c
|
||||
@@ -337,7 +337,7 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp)
|
||||
|
||||
if (last) {
|
||||
if (gst_adapter_available (depay->adapter)) {
|
||||
- gint framelen, samples;
|
||||
+ gint framelen;
|
||||
guint8 header[4];
|
||||
|
||||
data = gst_adapter_take_buffer (depay->adapter,
|
||||
@ -35,7 +35,7 @@
|
||||
|
||||
Name: gstreamer1-plugins-good
|
||||
Version: 1.26.7
|
||||
Release: 9%{?dist}
|
||||
Release: 10%{?dist}
|
||||
Summary: GStreamer plugins with good code and licensing
|
||||
|
||||
License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0
|
||||
@ -70,6 +70,8 @@ Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-73433.patch
|
||||
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-18296.patch
|
||||
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043
|
||||
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-18298.patch
|
||||
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042
|
||||
Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-18299.patch
|
||||
|
||||
BuildRequires: meson >= 0.48.0
|
||||
BuildRequires: gcc
|
||||
@ -390,6 +392,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
|
||||
|
||||
|
||||
%changelog
|
||||
* Tue Aug 25 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-10
|
||||
- Fix CVE-2026-18299: use-after-free and missing checks in rtpsbcdepay
|
||||
Resolves: RHEL-246615
|
||||
|
||||
* Mon Aug 24 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.26.7-9
|
||||
- Fix CVE-2026-18298 in gdkpixbufdec element
|
||||
Resolves: RHEL-246555
|
||||
|
||||
Loading…
Reference in New Issue
Block a user