diff --git a/gstreamer1-plugins-good-1.26.7-CVE-2026-18299.patch b/gstreamer1-plugins-good-1.26.7-CVE-2026-18299.patch new file mode 100644 index 0000000..b27636e --- /dev/null +++ b/gstreamer1-plugins-good-1.26.7-CVE-2026-18299.patch @@ -0,0 +1,111 @@ +From 347b200894a273d3a08ff15035ac03a6f9056463 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Fri, 19 Jun 2026 12:50:32 +0300 +Subject: [PATCH 1/3] rtpsbcdepay: Check for available data in the adapter + before getting data + +Consider empty packets with the last flag as bad packets. + +Also reset buffers to NULL after giving away ownership of them to avoid +returning an already freed buffer. + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5119 + +Part-of: +--- + .../gst-plugins-good/gst/rtp/gstrtpsbcdepay.c | 29 ++++++++++++------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c +index 1de5a8bce5..ffba32de50 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c +@@ -331,19 +331,26 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp) + } + + gst_adapter_push (depay->adapter, data); ++ data = NULL; + + if (last) { +- gint framelen, samples; +- guint8 header[4]; +- +- data = gst_adapter_take_buffer (depay->adapter, +- gst_adapter_available (depay->adapter)); +- gst_rtp_drop_non_audio_meta (depay, data); +- +- if (gst_buffer_extract (data, 0, &header, 4) != 4 || +- gst_rtp_sbc_depay_get_params (depay, header, +- payload_len, &framelen, &samples) < 0) { +- gst_buffer_unref (data); ++ if (gst_adapter_available (depay->adapter)) { ++ gint framelen, samples; ++ guint8 header[4]; ++ ++ data = gst_adapter_take_buffer (depay->adapter, ++ gst_adapter_available (depay->adapter)); ++ gst_rtp_drop_non_audio_meta (depay, data); ++ ++ if (gst_buffer_extract (data, 0, &header, 4) != 4 || ++ gst_rtp_sbc_depay_get_params (depay, header, ++ payload_len, &framelen, &samples) < 0) { ++ gst_buffer_unref (data); ++ data = NULL; ++ goto bad_packet; ++ } ++ } else { ++ data = NULL; + goto bad_packet; + } + } else { + +From 3d1ff1679406eba939cc3099449d9a07b1762d3f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Fri, 19 Jun 2026 12:55:34 +0300 +Subject: [PATCH 2/3] rtpsbcdepay: Check that enough data is available for the + payload header + +Part-of: +--- + subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c +index ffba32de50..690151777b 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c +@@ -303,6 +303,8 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp) + + payload = gst_rtp_buffer_get_payload (rtp); + payload_len = gst_rtp_buffer_get_payload_len (rtp); ++ if (payload_len < 1) ++ goto bad_packet; + + fragment = payload[0] & 0x80; + start = payload[0] & 0x40; + +From 15fc8d9190bebbf1e96919f55ac531eba81935d2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Fri, 19 Jun 2026 13:00:27 +0300 +Subject: [PATCH 3/3] rtpsbcdepay: Remove wrong variable shadowing + +`samples` is expected to be set in the outer scope at a later time. + +Part-of: +--- + subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c b/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c +index 690151777b..3efe115cd4 100644 +--- a/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c ++++ b/subprojects/gst-plugins-good/gst/rtp/gstrtpsbcdepay.c +@@ -337,7 +337,7 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp) + + if (last) { + if (gst_adapter_available (depay->adapter)) { +- gint framelen, samples; ++ gint framelen; + guint8 header[4]; + + data = gst_adapter_take_buffer (depay->adapter, diff --git a/gstreamer1-plugins-good.spec b/gstreamer1-plugins-good.spec index d50cf31..71dbfc6 100644 --- a/gstreamer1-plugins-good.spec +++ b/gstreamer1-plugins-good.spec @@ -35,7 +35,7 @@ Name: gstreamer1-plugins-good Version: 1.26.7 -Release: 9%{?dist} +Release: 10%{?dist} Summary: GStreamer plugins with good code and licensing License: CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0 @@ -70,6 +70,8 @@ Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-73433.patch Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-18296.patch # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043 Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-18298.patch +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042 +Patch: gstreamer1-plugins-good-1.26.7-CVE-2026-18299.patch BuildRequires: meson >= 0.48.0 BuildRequires: gcc @@ -390,6 +392,10 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';' %changelog +* Tue Aug 25 2026 RHEL Packaging Agent - 1.26.7-10 +- Fix CVE-2026-18299: use-after-free and missing checks in rtpsbcdepay + Resolves: RHEL-246615 + * Mon Aug 24 2026 RHEL Packaging Agent - 1.26.7-9 - Fix CVE-2026-18298 in gdkpixbufdec element Resolves: RHEL-246555