.gitignore

@@ -1 +1,83 @@
-SOURCES/gst-plugins-good-1.16.1.tar.xz
+/gst-plugins-good-0.11.93.tar.xz
+/gst-plugins-good-0.11.94.tar.xz
+/gst-plugins-good-0.11.99.tar.xz
+/gst-plugins-good-1.0.0.tar.xz
+/gst-plugins-good-1.0.1.tar.xz
+/gst-plugins-good-1.0.2.tar.xz
+/gst-plugins-good-1.0.3.tar.xz
+/gst-plugins-good-1.0.4.tar.xz
+/gst-plugins-good-1.0.5.tar.xz
+/gst-plugins-good-1.0.6.tar.xz
+/gst-plugins-good-1.0.7.tar.xz
+/gst-plugins-good-1.1.2.tar.xz
+/gst-plugins-good-1.1.3.tar.xz
+/gst-plugins-good-1.1.4.tar.xz
+/gst-plugins-good-1.1.90.tar.xz
+/gst-plugins-good-1.2.0.tar.xz
+/gst-plugins-good-1.2.1.tar.xz
+/gst-plugins-good-1.2.2.tar.xz
+/gst-plugins-good-1.2.3.tar.xz
+/gst-plugins-good-1.2.4.tar.xz
+/gst-plugins-good-1.3.91.tar.xz
+/gst-plugins-good-1.4.0.tar.xz
+/gst-plugins-good-1.4.1.tar.xz
+/gst-plugins-good-1.4.2.tar.xz
+/gst-plugins-good-1.4.4.tar.xz
+/gst-plugins-good-1.4.5.tar.xz
+/gst-plugins-good-1.5.1.tar.xz
+/gst-plugins-good-1.5.2.tar.xz
+/gst-plugins-good-1.5.90.tar.xz
+/gst-plugins-good-1.5.91.tar.xz
+/gst-plugins-good-1.6.0.tar.xz
+/gst-plugins-good-1.6.1.tar.xz
+/gst-plugins-good-1.6.2.tar.xz
+/gst-plugins-good-1.7.1.tar.xz
+/gst-plugins-good-1.7.2.tar.xz
+/gst-plugins-good-1.7.90.tar.xz
+/gst-plugins-good-1.7.91.tar.xz
+/gst-plugins-good-1.8.0.tar.xz
+/gst-plugins-good-1.8.1.tar.xz
+/gst-plugins-good-1.8.2.tar.xz
+/gst-plugins-good-1.9.1.tar.xz
+/gst-plugins-good-1.9.2.tar.xz
+/gst-plugins-good-1.9.90.tar.xz
+/gst-plugins-good-1.10.0.tar.xz
+/gst-plugins-good-1.10.1.tar.xz
+/gst-plugins-good-1.10.2.tar.xz
+/gst-plugins-good-1.11.1.tar.xz
+/gst-plugins-good-1.11.2.tar.xz
+/gst-plugins-good-1.11.90.tar.xz
+/gst-plugins-good-1.11.91.tar.xz
+/gst-plugins-good-1.12.0.tar.xz
+/gst-plugins-good-1.12.1.tar.xz
+/gst-plugins-good-1.12.2.tar.xz
+/gst-plugins-good-1.12.3.tar.xz
+/gst-plugins-good-1.12.4.tar.xz
+/gst-plugins-good-1.13.1.tar.xz
+/gst-plugins-good-1.13.90.tar.xz
+/gst-plugins-good-1.13.91.tar.xz
+/gst-plugins-good-1.14.0.tar.xz
+/gst-plugins-good-1.14.1.tar.xz
+/gst-plugins-good-1.14.2.tar.xz
+/gst-plugins-good-1.14.3.tar.xz
+/gst-plugins-good-1.14.4.tar.xz
+/gst-plugins-good-1.15.1.tar.xz
+/gst-plugins-good-1.15.2.tar.xz
+/gst-plugins-good-1.16.0.tar.xz
+/gst-plugins-good-1.16.1.tar.xz
+/gst-plugins-good-1.16.2.tar.xz
+/gst-plugins-good-1.17.1.tar.xz
+/gst-plugins-good-1.17.2.tar.xz
+/gst-plugins-good-1.17.90.tar.xz
+/gst-plugins-good-1.18.0.tar.xz
+/gst-plugins-good-1.18.1.tar.xz
+/gst-plugins-good-1.18.2.tar.xz
+/gst-plugins-good-1.18.4.tar.xz
+/gst-plugins-good-1.22.1.tar.xz
+/gst-plugins-good-1.22.2.tar.xz
+/gst-plugins-good-1.22.3.tar.xz
+/gst-plugins-good-1.22.5.tar.xz
+/gst-plugins-good-1.22.7.tar.xz
+/gst-plugins-good-1.22.8.tar.xz
+/gst-plugins-good-1.22.9.tar.xz
+/gst-plugins-good-1.22.12.tar.xz

.gstreamer1-plugins-good.metadata

@@ -1 +0,0 @@
-2b88a2d36bc53bed1b06c359ed676ec8b8675d5c SOURCES/gst-plugins-good-1.16.1.tar.xz

0001-qtdemux-Avoid-integer-overflow-when-parsing-Theora-e.patch

@@ -0,0 +1,41 @@
+From c6f4528710213d4887cbd2bf60eddfe97f1e7529 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Thu, 26 Sep 2024 22:16:06 +0300
+Subject: [PATCH 01/28] qtdemux: Avoid integer overflow when parsing Theora
+ extension
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-166
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3851
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8094>
+---
+ subprojects/gst-plugins-good/gst/isomp4/qtdemux.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+index a53d61e649..fcc818c7d7 100644
+--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
++++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+@@ -8258,7 +8258,7 @@ qtdemux_parse_theora_extension (GstQTDemux * qtdemux, QtDemuxStream * stream,
+   end -= 8;
+ 
+   while (buf < end) {
+-    gint size;
++    guint32 size;
+     guint32 type;
+ 
+     size = QT_UINT32 (buf);
+@@ -8266,7 +8266,7 @@ qtdemux_parse_theora_extension (GstQTDemux * qtdemux, QtDemuxStream * stream,
+ 
+     GST_LOG_OBJECT (qtdemux, "%p %p", buf, end);
+ 
+-    if (buf + size > end || size <= 0)
++    if (end - buf < size || size < 8)
+       break;
+ 
+     buf += 8;
+-- 
+2.47.0
+

0002-avisubtitle-Fix-size-checks-and-avoid-overflows-when.patch

@@ -0,0 +1,42 @@
+From c6e708e7875a359b2f7347064048b83425e5252f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 4 Oct 2024 14:04:03 +0300
+Subject: [PATCH 02/28] avisubtitle: Fix size checks and avoid overflows when
+ checking sizes
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-262
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3890
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8105>
+---
+ subprojects/gst-plugins-good/gst/avi/gstavisubtitle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/avi/gstavisubtitle.c b/subprojects/gst-plugins-good/gst/avi/gstavisubtitle.c
+index efc5f04051..c816934da6 100644
+--- a/subprojects/gst-plugins-good/gst/avi/gstavisubtitle.c
++++ b/subprojects/gst-plugins-good/gst/avi/gstavisubtitle.c
+@@ -196,7 +196,7 @@ gst_avi_subtitle_parse_gab2_chunk (GstAviSubtitle * sub, GstBuffer * buf)
+   /* read 'name' of subtitle */
+   name_length = GST_READ_UINT32_LE (map.data + 5 + 2);
+   GST_LOG_OBJECT (sub, "length of name: %u", name_length);
+-  if (map.size <= 17 + name_length)
++  if (G_MAXUINT32 - 17 < name_length || map.size < 17 + name_length)
+     goto wrong_name_length;
+ 
+   name_utf8 =
+@@ -216,7 +216,8 @@ gst_avi_subtitle_parse_gab2_chunk (GstAviSubtitle * sub, GstBuffer * buf)
+   file_length = GST_READ_UINT32_LE (map.data + 13 + name_length);
+   GST_LOG_OBJECT (sub, "length srt/ssa file: %u", file_length);
+ 
+-  if (map.size < (17 + name_length + file_length))
++  if (G_MAXUINT32 - 17 - name_length < file_length
++      || map.size < 17 + name_length + file_length)
+     goto wrong_total_length;
+ 
+   /* store this, so we can send it again after a seek; note that we shouldn't
+-- 
+2.47.0
+

0003-gdkpixbufdec-Check-if-initializing-the-video-info-ac.patch

@@ -1,7 +1,7 @@
-From 8d4c79e61a62245dc6a499b0a439317bb37d0508 Mon Sep 17 00:00:00 2001
+From d08f9f1de1782d30cb902df7fd3aab50134d1792 Mon Sep 17 00:00:00 2001
-From: Wim Taymans <wtaymans@redhat.com>
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Mon, 16 Dec 2024 11:47:09 +0100
+Date: Wed, 2 Oct 2024 14:44:21 +0300
-Subject: [PATCH 5/9] gdkpixbufdec: Check if initializing the video info
+Subject: [PATCH 03/28] gdkpixbufdec: Check if initializing the video info
  actually succeeded
 
 Otherwise a 0-byte buffer would be allocated, which gives NULL memory when
@@ -14,14 +14,14 @@ Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3876
 
 Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8103>
 ---
- ext/gdk_pixbuf/gstgdkpixbufdec.c | 9 ++++++++-
+ .../gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c    | 9 ++++++++-
  1 file changed, 8 insertions(+), 1 deletion(-)
 
-diff --git a/ext/gdk_pixbuf/gstgdkpixbufdec.c b/ext/gdk_pixbuf/gstgdkpixbufdec.c
+diff --git a/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c b/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c
-index c119236a8..c0ecb3a08 100644
+index 5482998c0d..de5f054964 100644
---- a/ext/gdk_pixbuf/gstgdkpixbufdec.c
+--- a/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c
-+++ b/ext/gdk_pixbuf/gstgdkpixbufdec.c
++++ b/subprojects/gst-plugins-good/ext/gdk_pixbuf/gstgdkpixbufdec.c
-@@ -318,7 +318,8 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter)
+@@ -322,7 +322,8 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter)
  
  
      gst_video_info_init (&info);
@@ -31,7 +31,7 @@ index c119236a8..c0ecb3a08 100644
      info.fps_n = filter->in_fps_n;
      info.fps_d = filter->in_fps_d;
      caps = gst_video_info_to_caps (&info);
-@@ -379,6 +380,12 @@ channels_not_supported:
+@@ -384,6 +385,12 @@ channels_not_supported:
          ("%d channels not supported", n_channels));
      return GST_FLOW_ERROR;
    }

0004-wavparse-Check-for-short-reads-when-parsing-headers-.patch

@@ -0,0 +1,167 @@
+From 63ad1dd611318760c0bf6fc53d7e69759039f9d6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 4 Oct 2024 13:00:57 +0300
+Subject: [PATCH 04/28] wavparse: Check for short reads when parsing headers in
+ pull mode
+
+And also return the actual flow return to the caller instead of always returning
+GST_FLOW_ERROR.
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-258, GHSL-2024-260
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3886
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3888
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8104>
+---
+ .../gst/wavparse/gstwavparse.c                | 63 ++++++++++++++-----
+ 1 file changed, 46 insertions(+), 17 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+index b47324364c..1129dc7473 100644
+--- a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
++++ b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+@@ -1096,6 +1096,24 @@ parse_ds64 (GstWavParse * wav, GstBuffer * buf)
+   return TRUE;
+ }
+ 
++static GstFlowReturn
++gst_wavparse_pull_range_exact (GstWavParse * wav, guint64 offset, guint size,
++    GstBuffer ** buffer)
++{
++  GstFlowReturn res;
++
++  res = gst_pad_pull_range (wav->sinkpad, offset, size, buffer);
++  if (res != GST_FLOW_OK)
++    return res;
++
++  if (gst_buffer_get_size (*buffer) < size) {
++    gst_clear_buffer (buffer);
++    return GST_FLOW_EOS;
++  }
++
++  return res;
++}
++
+ static GstFlowReturn
+ gst_wavparse_stream_headers (GstWavParse * wav)
+ {
+@@ -1291,9 +1309,9 @@ gst_wavparse_stream_headers (GstWavParse * wav)
+ 
+       buf = NULL;
+       if ((res =
+-              gst_pad_pull_range (wav->sinkpad, wav->offset, 8,
++              gst_wavparse_pull_range_exact (wav, wav->offset, 8,
+                   &buf)) != GST_FLOW_OK)
+-        goto header_read_error;
++        goto header_pull_error;
+       gst_buffer_map (buf, &map, GST_MAP_READ);
+       tag = GST_READ_UINT32_LE (map.data);
+       size = GST_READ_UINT32_LE (map.data + 4);
+@@ -1396,9 +1414,9 @@ gst_wavparse_stream_headers (GstWavParse * wav)
+             gst_buffer_unref (buf);
+             buf = NULL;
+             if ((res =
+-                    gst_pad_pull_range (wav->sinkpad, wav->offset + 8,
++                    gst_wavparse_pull_range_exact (wav, wav->offset + 8,
+                         data_size, &buf)) != GST_FLOW_OK)
+-              goto header_read_error;
++              goto header_pull_error;
+             gst_buffer_extract (buf, 0, &wav->fact, 4);
+             wav->fact = GUINT32_FROM_LE (wav->fact);
+             gst_buffer_unref (buf);
+@@ -1443,9 +1461,9 @@ gst_wavparse_stream_headers (GstWavParse * wav)
+           gst_buffer_unref (buf);
+           buf = NULL;
+           if ((res =
+-                  gst_pad_pull_range (wav->sinkpad, wav->offset + 8,
+-                      size, &buf)) != GST_FLOW_OK)
+-            goto header_read_error;
++                  gst_wavparse_pull_range_exact (wav, wav->offset + 8, size,
++                      &buf)) != GST_FLOW_OK)
++            goto header_pull_error;
+           gst_buffer_map (buf, &map, GST_MAP_READ);
+           acid = (const gst_riff_acid *) map.data;
+           tempo = acid->tempo;
+@@ -1483,9 +1501,9 @@ gst_wavparse_stream_headers (GstWavParse * wav)
+           gst_buffer_unref (buf);
+           buf = NULL;
+           if ((res =
+-                  gst_pad_pull_range (wav->sinkpad, wav->offset, 12,
++                  gst_wavparse_pull_range_exact (wav, wav->offset, 12,
+                       &buf)) != GST_FLOW_OK)
+-            goto header_read_error;
++            goto header_pull_error;
+           gst_buffer_extract (buf, 8, &ltag, 4);
+           ltag = GUINT32_FROM_LE (ltag);
+         }
+@@ -1512,9 +1530,9 @@ gst_wavparse_stream_headers (GstWavParse * wav)
+               buf = NULL;
+               if (data_size > 0) {
+                 if ((res =
+-                        gst_pad_pull_range (wav->sinkpad, wav->offset,
++                        gst_wavparse_pull_range_exact (wav, wav->offset,
+                             data_size, &buf)) != GST_FLOW_OK)
+-                  goto header_read_error;
++                  goto header_pull_error;
+               }
+             }
+             if (data_size > 0) {
+@@ -1552,9 +1570,9 @@ gst_wavparse_stream_headers (GstWavParse * wav)
+               buf = NULL;
+               wav->offset += 12;
+               if ((res =
+-                      gst_pad_pull_range (wav->sinkpad, wav->offset,
++                      gst_wavparse_pull_range_exact (wav, wav->offset,
+                           data_size, &buf)) != GST_FLOW_OK)
+-                goto header_read_error;
++                goto header_pull_error;
+               gst_buffer_map (buf, &map, GST_MAP_READ);
+               gst_wavparse_adtl_chunk (wav, (const guint8 *) map.data,
+                   data_size);
+@@ -1598,9 +1616,9 @@ gst_wavparse_stream_headers (GstWavParse * wav)
+           gst_buffer_unref (buf);
+           buf = NULL;
+           if ((res =
+-                  gst_pad_pull_range (wav->sinkpad, wav->offset,
++                  gst_wavparse_pull_range_exact (wav, wav->offset,
+                       data_size, &buf)) != GST_FLOW_OK)
+-            goto header_read_error;
++            goto header_pull_error;
+           gst_buffer_map (buf, &map, GST_MAP_READ);
+           if (!gst_wavparse_cue_chunk (wav, (const guint8 *) map.data,
+                   data_size)) {
+@@ -1642,9 +1660,9 @@ gst_wavparse_stream_headers (GstWavParse * wav)
+           gst_buffer_unref (buf);
+           buf = NULL;
+           if ((res =
+-                  gst_pad_pull_range (wav->sinkpad, wav->offset,
++                  gst_wavparse_pull_range_exact (wav, wav->offset,
+                       data_size, &buf)) != GST_FLOW_OK)
+-            goto header_read_error;
++            goto header_pull_error;
+           gst_buffer_map (buf, &map, GST_MAP_READ);
+           if (!gst_wavparse_smpl_chunk (wav, (const guint8 *) map.data,
+                   data_size)) {
+@@ -1796,6 +1814,17 @@ header_read_error:
+         ("Couldn't read in header %d (%s)", res, gst_flow_get_name (res)));
+     goto fail;
+   }
++header_pull_error:
++  {
++    if (res == GST_FLOW_EOS) {
++      GST_WARNING_OBJECT (wav, "Couldn't pull header %d (%s)", res,
++          gst_flow_get_name (res));
++    } else {
++      GST_ELEMENT_ERROR (wav, STREAM, DEMUX, (NULL),
++          ("Couldn't pull header %d (%s)", res, gst_flow_get_name (res)));
++    }
++    goto exit;
++  }
+ }
+ 
+ /*
+-- 
+2.47.0
+

0005-wavparse-Make-sure-enough-data-for-the-tag-list-tag-.patch

@@ -0,0 +1,34 @@
+From b5aa789466601fe777f7a2deb4763645ecdbd8b9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 4 Oct 2024 13:09:43 +0300
+Subject: [PATCH 05/28] wavparse: Make sure enough data for the tag list tag is
+ available before parsing
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-258
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3886
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042>
+---
+ subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+index 1129dc7473..1498249384 100644
+--- a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
++++ b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+@@ -1488,6 +1488,10 @@ gst_wavparse_stream_headers (GstWavParse * wav)
+       case GST_RIFF_TAG_LIST:{
+         guint32 ltag;
+ 
++        /* Need at least the ltag */
++        if (size < 4)
++          goto exit;
++
+         if (wav->streaming) {
+           const guint8 *data = NULL;
+ 
+-- 
+2.47.0
+

0006-wavparse-Fix-parsing-of-acid-chunk.patch

@@ -0,0 +1,58 @@
+From fd072dd84339c6943d147681e9557472267c79f1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 4 Oct 2024 13:15:27 +0300
+Subject: [PATCH 06/28] wavparse: Fix parsing of acid chunk
+
+Simply casting the bytes to a struct can lead to crashes because of unaligned
+reads, and is also missing the endianness swapping that is necessary on big
+endian architectures.
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042>
+---
+ .../gst-plugins-good/gst/wavparse/gstwavparse.c      | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+index 1498249384..5ccf7cd1e1 100644
+--- a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
++++ b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+@@ -1433,8 +1433,7 @@ gst_wavparse_stream_headers (GstWavParse * wav)
+         break;
+       }
+       case GST_RIFF_TAG_acid:{
+-        const gst_riff_acid *acid = NULL;
+-        const guint data_size = sizeof (gst_riff_acid);
++        const guint data_size = 24;
+         gfloat tempo;
+ 
+         GST_INFO_OBJECT (wav, "Have acid chunk");
+@@ -1448,13 +1447,13 @@ gst_wavparse_stream_headers (GstWavParse * wav)
+           break;
+         }
+         if (wav->streaming) {
++          const guint8 *data;
+           if (!gst_wavparse_peek_chunk (wav, &tag, &size)) {
+             goto exit;
+           }
+           gst_adapter_flush (wav->adapter, 8);
+-          acid = (const gst_riff_acid *) gst_adapter_map (wav->adapter,
+-              data_size);
+-          tempo = acid->tempo;
++          data = gst_adapter_map (wav->adapter, data_size);
++          tempo = GST_READ_FLOAT_LE (data + 20);
+           gst_adapter_unmap (wav->adapter);
+         } else {
+           GstMapInfo map;
+@@ -1465,8 +1464,7 @@ gst_wavparse_stream_headers (GstWavParse * wav)
+                       &buf)) != GST_FLOW_OK)
+             goto header_pull_error;
+           gst_buffer_map (buf, &map, GST_MAP_READ);
+-          acid = (const gst_riff_acid *) map.data;
+-          tempo = acid->tempo;
++          tempo = GST_READ_FLOAT_LE (map.data + 20);
+           gst_buffer_unmap (buf, &map);
+         }
+         /* send data as tags */
+-- 
+2.47.0
+

0007-wavparse-Check-that-at-least-4-bytes-are-available-b.patch

@@ -0,0 +1,30 @@
+From 5a9abc018ebe1ffa5412bf3f7ad9fde414ef8b68 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 4 Oct 2024 13:21:44 +0300
+Subject: [PATCH 07/28] wavparse: Check that at least 4 bytes are available
+ before parsing cue chunks
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042>
+---
+ subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+index 5ccf7cd1e1..c36920501e 100644
+--- a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
++++ b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+@@ -789,6 +789,11 @@ gst_wavparse_cue_chunk (GstWavParse * wav, const guint8 * data, guint32 size)
+     return TRUE;
+   }
+ 
++  if (size < 4) {
++    GST_WARNING_OBJECT (wav, "broken file %d", size);
++    return FALSE;
++  }
++
+   ncues = GST_READ_UINT32_LE (data);
+ 
+   if (size < 4 + ncues * 24) {
+-- 
+2.47.0
+

0008-wavparse-Check-that-at-least-32-bytes-are-available-.patch

@@ -0,0 +1,33 @@
+From ae4fb8fa16cbef636e90afe1d321e06bae2ff6df Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 4 Oct 2024 13:22:02 +0300
+Subject: [PATCH 08/28] wavparse: Check that at least 32 bytes are available
+ before parsing smpl chunks
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-259
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3887
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042>
+---
+ subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+index c36920501e..e42bb24b9b 100644
+--- a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
++++ b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+@@ -893,6 +893,9 @@ gst_wavparse_smpl_chunk (GstWavParse * wav, const guint8 * data, guint32 size)
+ {
+   guint32 note_number;
+ 
++  if (size < 32)
++    return FALSE;
++
+   /*
+      manufacturer_id = GST_READ_UINT32_LE (data);
+      product_id = GST_READ_UINT32_LE (data + 4);
+-- 
+2.47.0
+

0009-wavparse-Fix-clipping-of-size-to-the-file-size.patch

@@ -0,0 +1,40 @@
+From 93f50e27e5a9b893d6131c75a6e476272795f8be Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 4 Oct 2024 13:27:27 +0300
+Subject: [PATCH 09/28] wavparse: Fix clipping of size to the file size
+
+The size does not include the 8 bytes tag and length, so an additional 8 bytes
+must be removed here. 8 bytes are always available at this point because
+otherwise the parsing of the tag and length right above would've failed.
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-260
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3888
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042>
+---
+ subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+index e42bb24b9b..2499416a76 100644
+--- a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
++++ b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+@@ -1337,10 +1337,11 @@ gst_wavparse_stream_headers (GstWavParse * wav)
+     }
+ 
+     /* Clip to upstream size if known */
+-    if (upstream_size > 0 && size + wav->offset > upstream_size) {
++    if (upstream_size > 0 && size + 8 + wav->offset > upstream_size) {
+       GST_WARNING_OBJECT (wav, "Clipping chunk size to file size");
+       g_assert (upstream_size >= wav->offset);
+-      size = upstream_size - wav->offset;
++      g_assert (upstream_size - wav->offset >= 8);
++      size = upstream_size - wav->offset - 8;
+     }
+ 
+     /* wav is a st00pid format, we don't know for sure where data starts.
+-- 
+2.47.0
+

0010-wavparse-Check-size-before-reading-ds64-chunk.patch

@@ -0,0 +1,34 @@
+From ad5393302d9d28b25b10f93375ca43e37661779a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 4 Oct 2024 13:51:00 +0300
+Subject: [PATCH 10/28] wavparse: Check size before reading ds64 chunk
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-261
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3889
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042>
+---
+ subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+index 2499416a76..f2fa1e45c5 100644
+--- a/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
++++ b/subprojects/gst-plugins-good/gst/wavparse/gstwavparse.c
+@@ -1087,6 +1087,11 @@ parse_ds64 (GstWavParse * wav, GstBuffer * buf)
+   guint32 sampleCountLow, sampleCountHigh;
+ 
+   gst_buffer_map (buf, &map, GST_MAP_READ);
++  if (map.size < 6 * 4) {
++    GST_WARNING_OBJECT (wav, "Too small ds64 chunk (%" G_GSIZE_FORMAT ")",
++        map.size);
++    return FALSE;
++  }
+   dataSizeLow = GST_READ_UINT32_LE (map.data + 2 * 4);
+   dataSizeHigh = GST_READ_UINT32_LE (map.data + 3 * 4);
+   sampleCountLow = GST_READ_UINT32_LE (map.data + 4 * 4);
+-- 
+2.47.0
+

0011-matroskademux-Only-unmap-GstMapInfo-in-WavPack-heade.patch

@@ -1,7 +1,7 @@
-From c7f995f1030efb3281faa72a1a8827969f3591bc Mon Sep 17 00:00:00 2001
+From b2c6a508100835cc5c737be1c4ef1a5650979238 Mon Sep 17 00:00:00 2001
-From: Wim Taymans <wtaymans@redhat.com>
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Mon, 16 Dec 2024 11:48:03 +0100
+Date: Mon, 30 Sep 2024 16:32:48 +0300
-Subject: [PATCH 6/9] matroskademux: Only unmap GstMapInfo in WavPack header
+Subject: [PATCH 11/28] matroskademux: Only unmap GstMapInfo in WavPack header
  extraction error paths if previously mapped
 
 Thanks to Antonio Morales for finding and reporting the issue.
@@ -11,14 +11,14 @@ Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3863
 
 Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057>
 ---
- gst/matroska/matroska-demux.c | 4 ++--
+ subprojects/gst-plugins-good/gst/matroska/matroska-demux.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
 
-diff --git a/gst/matroska/matroska-demux.c b/gst/matroska/matroska-demux.c
+diff --git a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
-index f890ae611..2db68bc1f 100644
+index 9b3cf83adb..35e60b7147 100644
---- a/gst/matroska/matroska-demux.c
+--- a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
-+++ b/gst/matroska/matroska-demux.c
++++ b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
-@@ -3687,7 +3687,6 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
+@@ -3885,7 +3885,6 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
    GstMatroskaTrackAudioContext *audiocontext =
        (GstMatroskaTrackAudioContext *) stream;
    GstBuffer *newbuf = NULL;
@@ -26,7 +26,7 @@ index f890ae611..2db68bc1f 100644
    guint8 *buf_data, *data;
    Wavpack4Header wvh;
  
-@@ -3704,11 +3703,11 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
+@@ -3902,11 +3901,11 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
  
    if (audiocontext->channels <= 2) {
      guint32 block_samples, tmp;
@@ -39,14 +39,14 @@ index f890ae611..2db68bc1f 100644
        return GST_FLOW_ERROR;
      }
  
-@@ -3746,6 +3745,7 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
+@@ -3944,6 +3943,7 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
      *buf = newbuf;
      audiocontext->wvpk_block_index += block_samples;
    } else {
 +    GstMapInfo map, outmap;
      guint8 *outdata = NULL;
      gsize buf_size, size;
-     guint32 block_samples, flags, crc, blocksize;
+     guint32 block_samples, flags, crc;
 -- 
 2.47.0
 

0012-matroskademux-Fix-off-by-one-when-parsing-multi-chan.patch

@@ -0,0 +1,27 @@
+From 5a6a422e4c942c40abbeba607118820b0a6976fb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Mon, 30 Sep 2024 16:33:39 +0300
+Subject: [PATCH 12/28] matroskademux: Fix off-by-one when parsing
+ multi-channel WavPack
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057>
+---
+ subprojects/gst-plugins-good/gst/matroska/matroska-demux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
+index 35e60b7147..583fbbe6e6 100644
+--- a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
++++ b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
+@@ -3970,7 +3970,7 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
+     data += 4;
+     size -= 4;
+ 
+-    while (size > 12) {
++    while (size >= 12) {
+       flags = GST_READ_UINT32_LE (data);
+       data += 4;
+       size -= 4;
+-- 
+2.47.0
+

0013-matroskademux-Check-for-big-enough-WavPack-codec-pri.patch

@@ -0,0 +1,35 @@
+From c4c78d37e63731c5c778fc0a9d567c16b3abcc00 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Mon, 30 Sep 2024 18:25:53 +0300
+Subject: [PATCH 13/28] matroskademux: Check for big enough WavPack codec
+ private data before accessing it
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-250
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3866
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057>
+---
+ subprojects/gst-plugins-good/gst/matroska/matroska-demux.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
+index 583fbbe6e6..91e66fefc3 100644
+--- a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
++++ b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
+@@ -3888,6 +3888,11 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
+   guint8 *buf_data, *data;
+   Wavpack4Header wvh;
+ 
++  if (!stream->codec_priv || stream->codec_priv_size < 2) {
++    GST_ERROR_OBJECT (element, "No or too small wavpack codec private data");
++    return GST_FLOW_ERROR;
++  }
++
+   wvh.ck_id[0] = 'w';
+   wvh.ck_id[1] = 'v';
+   wvh.ck_id[2] = 'p';
+-- 
+2.47.0
+

0014-matroskademux-Don-t-take-data-out-of-an-empty-adapte.patch

@@ -0,0 +1,43 @@
+From 566705a7e54aa5eff984eef5da0a2676ec466e13 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Mon, 30 Sep 2024 19:04:51 +0300
+Subject: [PATCH 14/28] matroskademux: Don't take data out of an empty adapter
+ when processing WavPack frames
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-249
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3865
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057>
+---
+ .../gst-plugins-good/gst/matroska/matroska-demux.c    | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
+index 91e66fefc3..98ed51e86a 100644
+--- a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
++++ b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
+@@ -4036,11 +4036,16 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
+     }
+     gst_buffer_unmap (*buf, &map);
+ 
+-    newbuf = gst_adapter_take_buffer (adapter, gst_adapter_available (adapter));
++    size = gst_adapter_available (adapter);
++    if (size > 0) {
++      newbuf = gst_adapter_take_buffer (adapter, size);
++      gst_buffer_copy_into (newbuf, *buf,
++          GST_BUFFER_COPY_TIMESTAMPS | GST_BUFFER_COPY_FLAGS, 0, -1);
++    } else {
++      newbuf = NULL;
++    }
+     g_object_unref (adapter);
+ 
+-    gst_buffer_copy_into (newbuf, *buf,
+-        GST_BUFFER_COPY_TIMESTAMPS | GST_BUFFER_COPY_FLAGS, 0, -1);
+     gst_buffer_unref (*buf);
+     *buf = newbuf;
+ 
+-- 
+2.47.0
+

0015-matroskademux-Skip-over-laces-directly-when-postproc.patch

@@ -0,0 +1,44 @@
+From 8d97fde57e9ff1344624c34076fe08d8b845dcb9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Mon, 30 Sep 2024 19:06:03 +0300
+Subject: [PATCH 15/28] matroskademux: Skip over laces directly when
+ postprocessing the frame fails
+
+Otherwise NULL buffers might be handled afterwards.
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-249
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3865
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057>
+---
+ .../gst-plugins-good/gst/matroska/matroska-demux.c   | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
+index 98ed51e86a..e0a4405dce 100644
+--- a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
++++ b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
+@@ -4982,6 +4982,18 @@ gst_matroska_demux_parse_blockgroup_or_simpleblock (GstMatroskaDemux * demux,
+       if (stream->postprocess_frame) {
+         GST_LOG_OBJECT (demux, "running post process");
+         ret = stream->postprocess_frame (GST_ELEMENT (demux), stream, &sub);
++        if (ret != GST_FLOW_OK) {
++          gst_clear_buffer (&sub);
++          goto next_lace;
++        }
++
++        if (sub == NULL) {
++          GST_WARNING_OBJECT (demux,
++              "Postprocessing buffer with timestamp %" GST_TIME_FORMAT
++              " for stream %d failed", GST_TIME_ARGS (buffer_timestamp),
++              stream_num);
++          goto next_lace;
++        }
+       }
+ 
+       /* At this point, we have a sub-buffer pointing at data within a larger
+-- 
+2.47.0
+

0016-matroskademux-Skip-over-zero-sized-Xiph-stream-heade.patch

@@ -0,0 +1,35 @@
+From b00c5d91c629e1b6fbc35e14f658dc38d49e1306 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Mon, 30 Sep 2024 19:19:42 +0300
+Subject: [PATCH 16/28] matroskademux: Skip over zero-sized Xiph stream headers
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-251
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3867
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057>
+---
+ subprojects/gst-plugins-good/gst/matroska/matroska-ids.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/matroska/matroska-ids.c b/subprojects/gst-plugins-good/gst/matroska/matroska-ids.c
+index f11b7c2ce3..ba645f7306 100644
+--- a/subprojects/gst-plugins-good/gst/matroska/matroska-ids.c
++++ b/subprojects/gst-plugins-good/gst/matroska/matroska-ids.c
+@@ -189,8 +189,10 @@ gst_matroska_parse_xiph_stream_headers (gpointer codec_data,
+     if (offset + length[i] > codec_data_size)
+       goto error;
+ 
+-    hdr = gst_buffer_new_memdup (p + offset, length[i]);
+-    gst_buffer_list_add (list, hdr);
++    if (length[i] > 0) {
++      hdr = gst_buffer_new_memdup (p + offset, length[i]);
++      gst_buffer_list_add (list, hdr);
++    }
+ 
+     offset += length[i];
+   }
+-- 
+2.47.0
+

0017-matroskademux-Put-a-copy-of-the-codec-data-into-the-.patch

@@ -0,0 +1,36 @@
+From e678f30f826850640908ae4d0388c93e0b055cc8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Wed, 9 Oct 2024 11:52:52 -0400
+Subject: [PATCH 17/28] matroskademux: Put a copy of the codec data into the
+ A_MS/ACM caps
+
+The original codec data buffer is owned by matroskademux and does not
+necessarily live as long as the caps.
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-280
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3894
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057>
+---
+ subprojects/gst-plugins-good/gst/matroska/matroska-demux.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
+index e0a4405dce..80da306731 100644
+--- a/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
++++ b/subprojects/gst-plugins-good/gst/matroska/matroska-demux.c
+@@ -7165,8 +7165,7 @@ gst_matroska_demux_audio_caps (GstMatroskaTrackAudioContext *
+ 
+       /* 18 is the waveformatex size */
+       if (size > 18) {
+-        codec_data = gst_buffer_new_wrapped_full (GST_MEMORY_FLAG_READONLY,
+-            data + 18, size - 18, 0, size - 18, NULL, NULL);
++        codec_data = gst_buffer_new_memdup (data + 18, size - 18);
+       }
+ 
+       if (riff_audio_fmt)
+-- 
+2.47.0
+

0018-qtdemux-Fix-integer-overflow-when-allocating-the-sam.patch

@@ -1,8 +1,8 @@
-From f3358d7e6fb9540e45f1cde0378e94482846f216 Mon Sep 17 00:00:00 2001
+From f4cca76f59c6babf3a122f5485f611ab373dfde3 Mon Sep 17 00:00:00 2001
-From: Wim Taymans <wtaymans@redhat.com>
+From: Antonio Morales <antonio-morales@github.com>
-Date: Mon, 16 Dec 2024 11:49:37 +0100
+Date: Thu, 26 Sep 2024 18:39:37 +0300
-Subject: [PATCH 8/9] qtdemux: Fix integer overflow when allocating the samples
+Subject: [PATCH 18/28] qtdemux: Fix integer overflow when allocating the
- table for fragmented MP4
+ samples table for fragmented MP4
 
 This can lead to out of bounds writes and NULL pointer dereferences.
 
@@ -11,14 +11,14 @@ Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3839
 
 Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059>
 ---
- gst/isomp4/qtdemux.c | 12 ++++++------
+ subprojects/gst-plugins-good/gst/isomp4/qtdemux.c | 12 ++++++------
  1 file changed, 6 insertions(+), 6 deletions(-)
 
-diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
+diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
-index 229edb3e5..a37c92933 100644
+index fcc818c7d7..2406098062 100644
---- a/gst/isomp4/qtdemux.c
+--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
-+++ b/gst/isomp4/qtdemux.c
++++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
-@@ -3327,6 +3327,7 @@ qtdemux_parse_trun (GstQTDemux * qtdemux, GstByteReader * trun,
+@@ -3342,6 +3342,7 @@ qtdemux_parse_trun (GstQTDemux * qtdemux, GstByteReader * trun,
    gint i;
    guint8 *data;
    guint entry_size, dur_offset, size_offset, flags_offset = 0, ct_offset = 0;
@@ -26,7 +26,7 @@ index 229edb3e5..a37c92933 100644
    QtDemuxSample *sample;
    gboolean ismv = FALSE;
    gint64 initial_offset;
-@@ -3426,14 +3427,13 @@ qtdemux_parse_trun (GstQTDemux * qtdemux, GstByteReader * trun,
+@@ -3442,14 +3443,13 @@ qtdemux_parse_trun (GstQTDemux * qtdemux, GstByteReader * trun,
      goto fail;
    data = (guint8 *) gst_byte_reader_peek_data_unchecked (trun);
  
@@ -45,7 +45,7 @@ index 229edb3e5..a37c92933 100644
  
    /* create a new array of samples if it's the first sample parsed */
    if (stream->n_samples == 0) {
-@@ -3442,7 +3442,7 @@ qtdemux_parse_trun (GstQTDemux * qtdemux, GstByteReader * trun,
+@@ -3458,7 +3458,7 @@ qtdemux_parse_trun (GstQTDemux * qtdemux, GstByteReader * trun,
      /* or try to reallocate it with space enough to insert the new samples */
    } else
      stream->samples = g_try_renew (QtDemuxSample, stream->samples,

0019-qtdemux-Check-sizes-of-stsc-stco-stts-before-trying-.patch

@@ -0,0 +1,59 @@
+From 721a573ff7819c5f15688c4226d87e1d60379508 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 27 Sep 2024 15:50:54 +0300
+Subject: [PATCH 19/28] qtdemux: Check sizes of stsc/stco/stts before trying to
+ merge entries
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-246
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3854
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059>
+---
+ .../gst-plugins-good/gst/isomp4/qtdemux.c     | 22 +++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+index 2406098062..0b86cfd86c 100644
+--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
++++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+@@ -9475,6 +9475,21 @@ qtdemux_merge_sample_table (GstQTDemux * qtdemux, QtDemuxStream * stream)
+     return;
+   }
+ 
++  if (gst_byte_reader_get_remaining (&stream->stts) < 8) {
++    GST_DEBUG_OBJECT (qtdemux, "Too small stts");
++    return;
++  }
++
++  if (stream->stco.size < 8) {
++    GST_DEBUG_OBJECT (qtdemux, "Too small stco");
++    return;
++  }
++
++  if (stream->n_samples_per_chunk == 0) {
++    GST_DEBUG_OBJECT (qtdemux, "No samples per chunk");
++    return;
++  }
++
+   /* Parse the stts to get the sample duration and number of samples */
+   gst_byte_reader_skip_unchecked (&stream->stts, 4);
+   stts_duration = gst_byte_reader_get_uint32_be_unchecked (&stream->stts);
+@@ -9486,6 +9501,13 @@ qtdemux_merge_sample_table (GstQTDemux * qtdemux, QtDemuxStream * stream)
+   GST_DEBUG_OBJECT (qtdemux, "sample_duration %d, num_chunks %u", stts_duration,
+       num_chunks);
+ 
++  if (gst_byte_reader_get_remaining (&stream->stsc) <
++      stream->n_samples_per_chunk * 3 * 4 +
++      (stream->n_samples_per_chunk - 1) * 4) {
++    GST_DEBUG_OBJECT (qtdemux, "Too small stsc");
++    return;
++  }
++
+   /* Now parse stsc, convert chunks into single samples and generate a
+    * new stsc, stts and stsz from this information */
+   gst_byte_writer_init (&stsc);
+-- 
+2.47.0
+

0020-qtdemux-Make-sure-only-an-even-number-of-bytes-is-pr.patch

@@ -1,7 +1,7 @@
-From 6b751c71eb130f2c69eeacf5f47e0d6de639dc78 Mon Sep 17 00:00:00 2001
+From ef0cc9b583388720a9db5321b8476061b6a1184f Mon Sep 17 00:00:00 2001
-From: Wim Taymans <wtaymans@redhat.com>
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Mon, 16 Dec 2024 11:52:04 +0100
+Date: Thu, 26 Sep 2024 09:20:28 +0300
-Subject: [PATCH 9/9] qtdemux: Make sure only an even number of bytes is
+Subject: [PATCH 20/28] qtdemux: Make sure only an even number of bytes is
  processed when handling CEA608 data
 
 An odd number of bytes would lead to out of bound reads and writes, and doesn't
@@ -16,14 +16,14 @@ Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3841
 
 Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059>
 ---
- gst/isomp4/qtdemux.c | 5 +++++
+ subprojects/gst-plugins-good/gst/isomp4/qtdemux.c | 5 +++++
  1 file changed, 5 insertions(+)
 
-diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
+diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
-index a37c92933..8336ff302 100644
+index 0b86cfd86c..1e95f5b5f2 100644
---- a/gst/isomp4/qtdemux.c
+--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
-+++ b/gst/isomp4/qtdemux.c
++++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
-@@ -5612,6 +5612,11 @@ convert_to_s334_1a (const guint8 * ccpair, guint8 ccpair_size, guint field,
+@@ -5783,6 +5783,11 @@ convert_to_s334_1a (const guint8 * ccpair, guint8 ccpair_size, guint field,
    guint8 *storage;
    gsize i;
  

0021-qtdemux-Make-sure-enough-data-is-available-before-re.patch

@@ -0,0 +1,116 @@
+From 834425d90b25933356fc3ad05135989162a0f356 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Thu, 26 Sep 2024 14:17:02 +0300
+Subject: [PATCH 21/28] qtdemux: Make sure enough data is available before
+ reading wave header node
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-236
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3843
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059>
+---
+ .../gst-plugins-good/gst/isomp4/qtdemux.c     | 84 ++++++++++---------
+ 1 file changed, 45 insertions(+), 39 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+index 1e95f5b5f2..f8fbc6395c 100644
+--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
++++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+@@ -13120,47 +13120,53 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+         } else {
+           guint32 datalen = QT_UINT32 (stsd_entry_data + offset + 16);
+           const guint8 *data = stsd_entry_data + offset + 16;
+-          GNode *wavenode;
+-          GNode *waveheadernode;
+-
+-          wavenode = g_node_new ((guint8 *) data);
+-          if (qtdemux_parse_node (qtdemux, wavenode, data, datalen)) {
+-            const guint8 *waveheader;
+-            guint32 headerlen;
+-
+-            waveheadernode = qtdemux_tree_get_child_by_type (wavenode, fourcc);
+-            if (waveheadernode) {
+-              waveheader = (const guint8 *) waveheadernode->data;
+-              headerlen = QT_UINT32 (waveheader);
+-
+-              if (headerlen > 8) {
+-                gst_riff_strf_auds *header = NULL;
+-                GstBuffer *headerbuf;
+-                GstBuffer *extra;
+-
+-                waveheader += 8;
+-                headerlen -= 8;
+-
+-                headerbuf = gst_buffer_new_and_alloc (headerlen);
+-                gst_buffer_fill (headerbuf, 0, waveheader, headerlen);
+-
+-                if (gst_riff_parse_strf_auds (GST_ELEMENT_CAST (qtdemux),
+-                        headerbuf, &header, &extra)) {
+-                  gst_caps_unref (entry->caps);
+-                  /* FIXME: Need to do something with the channel reorder map */
+-                  entry->caps =
+-                      gst_riff_create_audio_caps (header->format, NULL, header,
+-                      extra, NULL, NULL, NULL);
+-
+-                  if (extra)
+-                    gst_buffer_unref (extra);
+-                  g_free (header);
++
++          if (len < datalen || len - datalen < offset + 16) {
++            GST_WARNING_OBJECT (qtdemux, "Not enough data for waveheadernode");
++          } else {
++            GNode *wavenode;
++            GNode *waveheadernode;
++
++            wavenode = g_node_new ((guint8 *) data);
++            if (qtdemux_parse_node (qtdemux, wavenode, data, datalen)) {
++              const guint8 *waveheader;
++              guint32 headerlen;
++
++              waveheadernode =
++                  qtdemux_tree_get_child_by_type (wavenode, fourcc);
++              if (waveheadernode) {
++                waveheader = (const guint8 *) waveheadernode->data;
++                headerlen = QT_UINT32 (waveheader);
++
++                if (headerlen > 8) {
++                  gst_riff_strf_auds *header = NULL;
++                  GstBuffer *headerbuf;
++                  GstBuffer *extra;
++
++                  waveheader += 8;
++                  headerlen -= 8;
++
++                  headerbuf = gst_buffer_new_and_alloc (headerlen);
++                  gst_buffer_fill (headerbuf, 0, waveheader, headerlen);
++
++                  if (gst_riff_parse_strf_auds (GST_ELEMENT_CAST (qtdemux),
++                          headerbuf, &header, &extra)) {
++                    gst_caps_unref (entry->caps);
++                    /* FIXME: Need to do something with the channel reorder map */
++                    entry->caps =
++                        gst_riff_create_audio_caps (header->format, NULL,
++                        header, extra, NULL, NULL, NULL);
++
++                    if (extra)
++                      gst_buffer_unref (extra);
++                    g_free (header);
++                  }
+                 }
+-              }
+-            } else
+-              GST_DEBUG ("Didn't find waveheadernode for this codec");
++              } else
++                GST_DEBUG ("Didn't find waveheadernode for this codec");
++            }
++            g_node_destroy (wavenode);
+           }
+-          g_node_destroy (wavenode);
+         }
+       } else if (esds) {
+         gst_qtdemux_handle_esds (qtdemux, stream, entry, esds,
+-- 
+2.47.0
+

0022-qtdemux-Fix-length-checks-and-offsets-in-stsd-entry-.patch

@@ -0,0 +1,421 @@
+From 6ae0c0f683710dcda1310d6f4b9883e9b859e7b0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 27 Sep 2024 00:12:57 +0300
+Subject: [PATCH 22/28] qtdemux: Fix length checks and offsets in stsd entry
+ parsing
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-242
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3845
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059>
+---
+ .../gst-plugins-good/gst/isomp4/qtdemux.c     | 188 +++++++-----------
+ 1 file changed, 73 insertions(+), 115 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+index f8fbc6395c..ee2131aa18 100644
+--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
++++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+@@ -11678,40 +11678,35 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+           case FOURCC_avc1:
+           case FOURCC_avc3:
+           {
+-            guint len = QT_UINT32 (stsd_entry_data);
++            guint32 len = QT_UINT32 (stsd_entry_data);
+             len = len <= 0x56 ? 0 : len - 0x56;
+             const guint8 *avc_data = stsd_entry_data + 0x56;
+ 
+             /* find avcC */
+-            while (len >= 0x8) {
+-              guint size;
+-
+-              if (QT_UINT32 (avc_data) <= 0x8)
+-                size = 0;
+-              else if (QT_UINT32 (avc_data) <= len)
+-                size = QT_UINT32 (avc_data) - 0x8;
+-              else
+-                size = len - 0x8;
++            while (len >= 8) {
++              guint32 size = QT_UINT32 (avc_data);
+ 
+-              if (size < 1)
+-                /* No real data, so break out */
++              if (size < 8 || size > len)
+                 break;
+ 
+-              switch (QT_FOURCC (avc_data + 0x4)) {
++              switch (QT_FOURCC (avc_data + 4)) {
+                 case FOURCC_avcC:
+                 {
+                   /* parse, if found */
+                   GstBuffer *buf;
+ 
++                  if (size < 8 + 1)
++                    break;
++
+                   GST_DEBUG_OBJECT (qtdemux, "found avcC codec_data in stsd");
+ 
+                   /* First 4 bytes are the length of the atom, the next 4 bytes
+                    * are the fourcc, the next 1 byte is the version, and the
+                    * subsequent bytes are profile_tier_level structure like data. */
+                   gst_codec_utils_h264_caps_set_level_and_profile (entry->caps,
+-                      avc_data + 8 + 1, size - 1);
+-                  buf = gst_buffer_new_and_alloc (size);
+-                  gst_buffer_fill (buf, 0, avc_data + 0x8, size);
++                      avc_data + 8 + 1, size - 8 - 1);
++                  buf = gst_buffer_new_and_alloc (size - 8);
++                  gst_buffer_fill (buf, 0, avc_data + 8, size - 8);
+                   gst_caps_set_simple (entry->caps,
+                       "codec_data", GST_TYPE_BUFFER, buf, NULL);
+                   gst_buffer_unref (buf);
+@@ -11722,6 +11717,9 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+                 {
+                   GstBuffer *buf;
+ 
++                  if (size < 8 + 40 + 1)
++                    break;
++
+                   GST_DEBUG_OBJECT (qtdemux, "found strf codec_data in stsd");
+ 
+                   /* First 4 bytes are the length of the atom, the next 4 bytes
+@@ -11729,17 +11727,14 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+                    * next 1 byte is the version, and the
+                    * subsequent bytes are sequence parameter set like data. */
+ 
+-                  size -= 40;   /* we'll be skipping BITMAPINFOHEADER */
+-                  if (size > 1) {
+-                    gst_codec_utils_h264_caps_set_level_and_profile
+-                        (entry->caps, avc_data + 8 + 40 + 1, size - 1);
++                  gst_codec_utils_h264_caps_set_level_and_profile
++                      (entry->caps, avc_data + 8 + 40 + 1, size - 8 - 40 - 1);
+ 
+-                    buf = gst_buffer_new_and_alloc (size);
+-                    gst_buffer_fill (buf, 0, avc_data + 8 + 40, size);
+-                    gst_caps_set_simple (entry->caps,
+-                        "codec_data", GST_TYPE_BUFFER, buf, NULL);
+-                    gst_buffer_unref (buf);
+-                  }
++                  buf = gst_buffer_new_and_alloc (size - 8 - 40);
++                  gst_buffer_fill (buf, 0, avc_data + 8 + 40, size - 8 - 40);
++                  gst_caps_set_simple (entry->caps,
++                      "codec_data", GST_TYPE_BUFFER, buf, NULL);
++                  gst_buffer_unref (buf);
+                   break;
+                 }
+                 case FOURCC_btrt:
+@@ -11747,11 +11742,11 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+                   guint avg_bitrate, max_bitrate;
+ 
+                   /* bufferSizeDB, maxBitrate and avgBitrate - 4 bytes each */
+-                  if (size < 12)
++                  if (size < 8 + 12)
+                     break;
+ 
+-                  max_bitrate = QT_UINT32 (avc_data + 0xc);
+-                  avg_bitrate = QT_UINT32 (avc_data + 0x10);
++                  max_bitrate = QT_UINT32 (avc_data + 8 + 4);
++                  avg_bitrate = QT_UINT32 (avc_data + 8 + 8);
+ 
+                   if (!max_bitrate && !avg_bitrate)
+                     break;
+@@ -11783,8 +11778,8 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+                   break;
+               }
+ 
+-              len -= size + 8;
+-              avc_data += size + 8;
++              len -= size;
++              avc_data += size;
+             }
+ 
+             break;
+@@ -11795,41 +11790,36 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+           case FOURCC_dvh1:
+           case FOURCC_dvhe:
+           {
+-            guint len = QT_UINT32 (stsd_entry_data);
++            guint32 len = QT_UINT32 (stsd_entry_data);
+             len = len <= 0x56 ? 0 : len - 0x56;
+             const guint8 *hevc_data = stsd_entry_data + 0x56;
+ 
+             /* find hevc */
+-            while (len >= 0x8) {
+-              guint size;
+-
+-              if (QT_UINT32 (hevc_data) <= 0x8)
+-                size = 0;
+-              else if (QT_UINT32 (hevc_data) <= len)
+-                size = QT_UINT32 (hevc_data) - 0x8;
+-              else
+-                size = len - 0x8;
++            while (len >= 8) {
++              guint32 size = QT_UINT32 (hevc_data);
+ 
+-              if (size < 1)
+-                /* No real data, so break out */
++              if (size < 8 || size > len)
+                 break;
+ 
+-              switch (QT_FOURCC (hevc_data + 0x4)) {
++              switch (QT_FOURCC (hevc_data + 4)) {
+                 case FOURCC_hvcC:
+                 {
+                   /* parse, if found */
+                   GstBuffer *buf;
+ 
++                  if (size < 8 + 1)
++                    break;
++
+                   GST_DEBUG_OBJECT (qtdemux, "found hvcC codec_data in stsd");
+ 
+                   /* First 4 bytes are the length of the atom, the next 4 bytes
+                    * are the fourcc, the next 1 byte is the version, and the
+                    * subsequent bytes are sequence parameter set like data. */
+                   gst_codec_utils_h265_caps_set_level_tier_and_profile
+-                      (entry->caps, hevc_data + 8 + 1, size - 1);
++                      (entry->caps, hevc_data + 8 + 1, size - 8 - 1);
+ 
+-                  buf = gst_buffer_new_and_alloc (size);
+-                  gst_buffer_fill (buf, 0, hevc_data + 0x8, size);
++                  buf = gst_buffer_new_and_alloc (size - 8);
++                  gst_buffer_fill (buf, 0, hevc_data + 8, size - 8);
+                   gst_caps_set_simple (entry->caps,
+                       "codec_data", GST_TYPE_BUFFER, buf, NULL);
+                   gst_buffer_unref (buf);
+@@ -11838,8 +11828,8 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+                 default:
+                   break;
+               }
+-              len -= size + 8;
+-              hevc_data += size + 8;
++              len -= size;
++              hevc_data += size;
+             }
+             break;
+           }
+@@ -12219,33 +12209,25 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+           }
+           case FOURCC_vc_1:
+           {
+-            guint len = QT_UINT32 (stsd_entry_data);
++            guint32 len = QT_UINT32 (stsd_entry_data);
+             len = len <= 0x56 ? 0 : len - 0x56;
+             const guint8 *vc1_data = stsd_entry_data + 0x56;
+ 
+             /* find dvc1 */
+             while (len >= 8) {
+-              guint size;
++              guint32 size = QT_UINT32 (vc1_data);
+ 
+-              if (QT_UINT32 (vc1_data) <= 8)
+-                size = 0;
+-              else if (QT_UINT32 (vc1_data) <= len)
+-                size = QT_UINT32 (vc1_data) - 8;
+-              else
+-                size = len - 8;
+-
+-              if (size < 1)
+-                /* No real data, so break out */
++              if (size < 8 || size > len)
+                 break;
+ 
+-              switch (QT_FOURCC (vc1_data + 0x4)) {
++              switch (QT_FOURCC (vc1_data + 4)) {
+                 case GST_MAKE_FOURCC ('d', 'v', 'c', '1'):
+                 {
+                   GstBuffer *buf;
+ 
+                   GST_DEBUG_OBJECT (qtdemux, "found dvc1 codec_data in stsd");
+-                  buf = gst_buffer_new_and_alloc (size);
+-                  gst_buffer_fill (buf, 0, vc1_data + 8, size);
++                  buf = gst_buffer_new_and_alloc (size - 8);
++                  gst_buffer_fill (buf, 0, vc1_data + 8, size - 8);
+                   gst_caps_set_simple (entry->caps,
+                       "codec_data", GST_TYPE_BUFFER, buf, NULL);
+                   gst_buffer_unref (buf);
+@@ -12254,33 +12236,25 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+                 default:
+                   break;
+               }
+-              len -= size + 8;
+-              vc1_data += size + 8;
++              len -= size;
++              vc1_data += size;
+             }
+             break;
+           }
+           case FOURCC_av01:
+           {
+-            guint len = QT_UINT32 (stsd_entry_data);
++            guint32 len = QT_UINT32 (stsd_entry_data);
+             len = len <= 0x56 ? 0 : len - 0x56;
+             const guint8 *av1_data = stsd_entry_data + 0x56;
+ 
+             /* find av1C */
+-            while (len >= 0x8) {
+-              guint size;
+-
+-              if (QT_UINT32 (av1_data) <= 0x8)
+-                size = 0;
+-              else if (QT_UINT32 (av1_data) <= len)
+-                size = QT_UINT32 (av1_data) - 0x8;
+-              else
+-                size = len - 0x8;
++            while (len >= 8) {
++              guint32 size = QT_UINT32 (av1_data);
+ 
+-              if (size < 1)
+-                /* No real data, so break out */
++              if (size < 8 || size > len)
+                 break;
+ 
+-              switch (QT_FOURCC (av1_data + 0x4)) {
++              switch (QT_FOURCC (av1_data + 4)) {
+                 case FOURCC_av1C:
+                 {
+                   /* parse, if found */
+@@ -12290,7 +12264,7 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+                       "found av1C codec_data in stsd of size %d", size);
+ 
+                   /* not enough data, just ignore and hope for the best */
+-                  if (size < 4)
++                  if (size < 8 + 4)
+                     break;
+ 
+                   /* Content is:
+@@ -12339,9 +12313,9 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+                             (gint) (pres_delay_field & 0x0F) + 1, NULL);
+                       }
+ 
+-                      buf = gst_buffer_new_and_alloc (size);
++                      buf = gst_buffer_new_and_alloc (size - 8);
+                       GST_BUFFER_FLAG_SET (buf, GST_BUFFER_FLAG_HEADER);
+-                      gst_buffer_fill (buf, 0, av1_data + 8, size);
++                      gst_buffer_fill (buf, 0, av1_data + 8, size - 8);
+                       gst_caps_set_simple (entry->caps,
+                           "codec_data", GST_TYPE_BUFFER, buf, NULL);
+                       gst_buffer_unref (buf);
+@@ -12359,8 +12333,8 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+                   break;
+               }
+ 
+-              len -= size + 8;
+-              av1_data += size + 8;
++              len -= size;
++              av1_data += size;
+             }
+ 
+             break;
+@@ -12371,26 +12345,18 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+              * vp08, vp09, and vp10 fourcc. */
+           case FOURCC_vp09:
+           {
+-            guint len = QT_UINT32 (stsd_entry_data);
++            guint32 len = QT_UINT32 (stsd_entry_data);
+             len = len <= 0x56 ? 0 : len - 0x56;
+             const guint8 *vpcc_data = stsd_entry_data + 0x56;
+ 
+             /* find vpcC */
+-            while (len >= 0x8) {
+-              guint size;
+-
+-              if (QT_UINT32 (vpcc_data) <= 0x8)
+-                size = 0;
+-              else if (QT_UINT32 (vpcc_data) <= len)
+-                size = QT_UINT32 (vpcc_data) - 0x8;
+-              else
+-                size = len - 0x8;
++            while (len >= 8) {
++              guint32 size = QT_UINT32 (vpcc_data);
+ 
+-              if (size < 1)
+-                /* No real data, so break out */
++              if (size < 8 || size > len)
+                 break;
+ 
+-              switch (QT_FOURCC (vpcc_data + 0x4)) {
++              switch (QT_FOURCC (vpcc_data + 4)) {
+                 case FOURCC_vpcC:
+                 {
+                   const gchar *profile_str = NULL;
+@@ -12406,7 +12372,7 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+ 
+                   /* the meaning of "size" is length of the atom body, excluding
+                    * atom length and fourcc fields */
+-                  if (size < 12)
++                  if (size < 8 + 12)
+                     break;
+ 
+                   /* Content is:
+@@ -12512,8 +12478,8 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+                   break;
+               }
+ 
+-              len -= size + 8;
+-              vpcc_data += size + 8;
++              len -= size;
++              vpcc_data += size;
+             }
+ 
+             break;
+@@ -12854,7 +12820,7 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+         }
+         case FOURCC_wma_:
+         {
+-          guint len = QT_UINT32 (stsd_entry_data);
++          guint32 len = QT_UINT32 (stsd_entry_data);
+           len = len <= offset ? 0 : len - offset;
+           const guint8 *wfex_data = stsd_entry_data + offset;
+           const gchar *codec_name = NULL;
+@@ -12879,17 +12845,9 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+ 
+           /* find wfex */
+           while (len >= 8) {
+-            guint size;
+-
+-            if (QT_UINT32 (wfex_data) <= 0x8)
+-              size = 0;
+-            else if (QT_UINT32 (wfex_data) <= len)
+-              size = QT_UINT32 (wfex_data) - 8;
+-            else
+-              size = len - 8;
++            guint32 size = QT_UINT32 (wfex_data);
+ 
+-            if (size < 1)
+-              /* No real data, so break out */
++            if (size < 8 || size > len)
+               break;
+ 
+             switch (QT_FOURCC (wfex_data + 4)) {
+@@ -12935,12 +12893,12 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+                     "width", G_TYPE_INT, wfex.wBitsPerSample,
+                     "depth", G_TYPE_INT, wfex.wBitsPerSample, NULL);
+ 
+-                if (size > wfex.cbSize) {
++                if (size > 8 + wfex.cbSize) {
+                   GstBuffer *buf;
+ 
+-                  buf = gst_buffer_new_and_alloc (size - wfex.cbSize);
++                  buf = gst_buffer_new_and_alloc (size - 8 - wfex.cbSize);
+                   gst_buffer_fill (buf, 0, wfex_data + 8 + wfex.cbSize,
+-                      size - wfex.cbSize);
++                      size - 8 - wfex.cbSize);
+                   gst_caps_set_simple (entry->caps,
+                       "codec_data", GST_TYPE_BUFFER, buf, NULL);
+                   gst_buffer_unref (buf);
+@@ -12957,8 +12915,8 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+               default:
+                 break;
+             }
+-            len -= size + 8;
+-            wfex_data += size + 8;
++            len -= size;
++            wfex_data += size;
+           }
+           break;
+         }
+-- 
+2.47.0
+

0023-qtdemux-Fix-error-handling-when-parsing-cenc-sample-.patch

@@ -0,0 +1,60 @@
+From da31d60c131207ddc3514ff2201dbc6bc8cdb8a0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 27 Sep 2024 09:47:50 +0300
+Subject: [PATCH 23/28] qtdemux: Fix error handling when parsing cenc sample
+ groups fails
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-238, GHSL-2024-239, GHSL-2024-240
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3846
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8060>
+---
+ subprojects/gst-plugins-good/gst/isomp4/qtdemux.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+index ee2131aa18..e50af4ff52 100644
+--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
++++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+@@ -11399,12 +11399,15 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+       if (stream->subtype != FOURCC_soun) {
+         GST_ERROR_OBJECT (qtdemux,
+             "Unexpeced stsd type 'aavd' outside 'soun' track");
++        goto corrupt_file;
+       } else {
+         /* encrypted audio with sound sample description v0 */
+         GNode *enc = qtdemux_tree_get_child_by_type (stsd, fourcc);
+         stream->protected = TRUE;
+-        if (!qtdemux_parse_protection_aavd (qtdemux, stream, enc, &fourcc))
++        if (!qtdemux_parse_protection_aavd (qtdemux, stream, enc, &fourcc)) {
+           GST_ERROR_OBJECT (qtdemux, "Failed to parse protection scheme info");
++          goto corrupt_file;
++        }
+       }
+     }
+ 
+@@ -11413,8 +11416,10 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+        * with the same type */
+       GNode *enc = qtdemux_tree_get_child_by_type (stsd, fourcc);
+       stream->protected = TRUE;
+-      if (!qtdemux_parse_protection_scheme_info (qtdemux, stream, enc, &fourcc))
++      if (!qtdemux_parse_protection_scheme_info (qtdemux, stream, enc, &fourcc)) {
+         GST_ERROR_OBJECT (qtdemux, "Failed to parse protection scheme info");
++        goto corrupt_file;
++      }
+     }
+ 
+     if (stream->subtype == FOURCC_vide) {
+@@ -13503,7 +13508,6 @@ qtdemux_parse_trak (GstQTDemux * qtdemux, GNode * trak)
+ 
+     stsd_entry_data += len;
+     remaining_stsd_len -= len;
+-
+   }
+ 
+   /* collect sample information */
+-- 
+2.47.0
+

0024-qtdemux-Make-sure-there-are-enough-offsets-to-read-w.patch

@@ -0,0 +1,45 @@
+From 1be56c1bdd89fccd6cd31a9c2f5ea6e8d8a08216 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 27 Sep 2024 10:38:50 +0300
+Subject: [PATCH 24/28] qtdemux: Make sure there are enough offsets to read
+ when parsing samples
+
+While this specific case is also caught when initializing co_chunk, the error
+is ignored in various places and calling into the function would lead to out of
+bounds reads if the error message doesn't cause the pipeline to be shut down
+fast enough.
+
+To avoid this, no matter what, make sure enough offsets are available when
+parsing them. While this is potentially slower, the same is already done in the
+non-chunks_are_samples case.
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-245
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3847
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8060>
+---
+ subprojects/gst-plugins-good/gst/isomp4/qtdemux.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+index e50af4ff52..ffd53fbb38 100644
+--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
++++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+@@ -10065,9 +10065,9 @@ qtdemux_parse_samples (GstQTDemux * qtdemux, QtDemuxStream * stream, guint32 n)
+           goto done;
+         }
+ 
+-        cur->offset =
+-            qt_atom_parser_get_offset_unchecked (&stream->co_chunk,
+-            stream->co_size);
++        if (!qt_atom_parser_get_offset (&stream->co_chunk,
++                stream->co_size, &cur->offset))
++          goto corrupt_file;
+ 
+         GST_LOG_OBJECT (qtdemux, "Created entry %d with offset "
+             "%" G_GUINT64_FORMAT, j, cur->offset);
+-- 
+2.47.0
+

0025-qtdemux-Actually-handle-errors-returns-from-various-.patch

@@ -0,0 +1,93 @@
+From c78648f7ac1cb153448b15adfa215b984c99782a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 27 Sep 2024 10:39:30 +0300
+Subject: [PATCH 25/28] qtdemux: Actually handle errors returns from various
+ functions instead of ignoring them
+
+Ignoring them might cause the element to continue as if all is fine despite the
+internal state being inconsistent. This can lead to all kinds of follow-up
+issues, including memory safety issues.
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-245
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3847
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8060>
+---
+ .../gst-plugins-good/gst/isomp4/qtdemux.c     | 29 +++++++++++++++----
+ 1 file changed, 23 insertions(+), 6 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+index ffd53fbb38..af66740aa9 100644
+--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
++++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+@@ -4852,10 +4852,15 @@ gst_qtdemux_loop_state_header (GstQTDemux * qtdemux)
+ beach:
+   if (ret == GST_FLOW_EOS && (qtdemux->got_moov || qtdemux->media_caps)) {
+     /* digested all data, show what we have */
+-    qtdemux_prepare_streams (qtdemux);
++    ret = qtdemux_prepare_streams (qtdemux);
++    if (ret != GST_FLOW_OK)
++      return ret;
++
+     QTDEMUX_EXPOSE_LOCK (qtdemux);
+     ret = qtdemux_expose_streams (qtdemux);
+     QTDEMUX_EXPOSE_UNLOCK (qtdemux);
++    if (ret != GST_FLOW_OK)
++      return ret;
+ 
+     qtdemux->state = QTDEMUX_STATE_MOVIE;
+     GST_DEBUG_OBJECT (qtdemux, "switching state to STATE_MOVIE (%d)",
+@@ -7547,13 +7552,21 @@ gst_qtdemux_process_adapter (GstQTDemux * demux, gboolean force)
+             gst_qtdemux_stream_concat (demux,
+                 demux->old_streams, demux->active_streams);
+ 
+-            qtdemux_parse_moov (demux, data, demux->neededbytes);
++            if (!qtdemux_parse_moov (demux, data, demux->neededbytes)) {
++              ret = GST_FLOW_ERROR;
++              break;
++            }
+             qtdemux_node_dump (demux, demux->moov_node);
+             qtdemux_parse_tree (demux);
+-            qtdemux_prepare_streams (demux);
++            ret = qtdemux_prepare_streams (demux);
++            if (ret != GST_FLOW_OK)
++              break;
++
+             QTDEMUX_EXPOSE_LOCK (demux);
+-            qtdemux_expose_streams (demux);
++            ret = qtdemux_expose_streams (demux);
+             QTDEMUX_EXPOSE_UNLOCK (demux);
++            if (ret != GST_FLOW_OK)
++              break;
+ 
+             demux->got_moov = TRUE;
+ 
+@@ -7644,8 +7657,10 @@ gst_qtdemux_process_adapter (GstQTDemux * demux, gboolean force)
+             /* in MSS we need to expose the pads after the first moof as we won't get a moov */
+             if (demux->variant == VARIANT_MSS_FRAGMENTED && !demux->exposed) {
+               QTDEMUX_EXPOSE_LOCK (demux);
+-              qtdemux_expose_streams (demux);
++              ret = qtdemux_expose_streams (demux);
+               QTDEMUX_EXPOSE_UNLOCK (demux);
++              if (ret != GST_FLOW_OK)
++                goto done;
+             }
+ 
+             gst_qtdemux_check_send_pending_segment (demux);
+@@ -13758,8 +13773,10 @@ qtdemux_prepare_streams (GstQTDemux * qtdemux)
+ 
+     /* parse the initial sample for use in setting the frame rate cap */
+     while (sample_num == 0 && sample_num < stream->n_samples) {
+-      if (!qtdemux_parse_samples (qtdemux, stream, sample_num))
++      if (!qtdemux_parse_samples (qtdemux, stream, sample_num)) {
++        ret = GST_FLOW_ERROR;
+         break;
++      }
+       ++sample_num;
+     }
+   }
+-- 
+2.47.0
+

0026-qtdemux-Check-for-invalid-atom-length-when-extractin.patch

@@ -0,0 +1,32 @@
+From 717743ce279dae4c22bee32be0743553e6f9be5f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Thu, 26 Sep 2024 19:16:19 +0300
+Subject: [PATCH 26/28] qtdemux: Check for invalid atom length when extracting
+ Closed Caption data
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-243
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3849
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8060>
+---
+ subprojects/gst-plugins-good/gst/isomp4/qtdemux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+index af66740aa9..72a41ab343 100644
+--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
++++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+@@ -5826,7 +5826,7 @@ extract_cc_from_data (QtDemuxStream * stream, const guint8 * data, gsize size,
+     goto invalid_cdat;
+   atom_length = QT_UINT32 (data);
+   fourcc = QT_FOURCC (data + 4);
+-  if (G_UNLIKELY (atom_length > size || atom_length == 8))
++  if (G_UNLIKELY (atom_length > size || atom_length <= 8))
+     goto invalid_cdat;
+ 
+   GST_DEBUG_OBJECT (stream->pad, "here");
+-- 
+2.47.0
+

0027-qtdemux-Add-size-check-for-parsing-SMI-SEQH-atom.patch

@@ -0,0 +1,33 @@
+From 8ade3891c488c40a2b6c17ba59255bcc9bc610d0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Fri, 27 Sep 2024 00:31:36 +0300
+Subject: [PATCH 27/28] qtdemux: Add size check for parsing SMI / SEQH atom
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-244
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3853
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8060>
+---
+ subprojects/gst-plugins-good/gst/isomp4/qtdemux.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+index 72a41ab343..819dee5183 100644
+--- a/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
++++ b/subprojects/gst-plugins-good/gst/isomp4/qtdemux.c
+@@ -10628,8 +10628,9 @@ qtdemux_parse_svq3_stsd_data (GstQTDemux * qtdemux,
+                 GST_WARNING_OBJECT (qtdemux, "Unexpected second SEQH SMI atom "
+                     " found, ignoring");
+               } else {
++                /* Note: The size does *not* include the fourcc and the size field itself */
+                 seqh_size = QT_UINT32 (data + 4);
+-                if (seqh_size > 0) {
++                if (seqh_size > 0 && seqh_size <= size - 8) {
+                   _seqh = gst_buffer_new_and_alloc (seqh_size);
+                   gst_buffer_fill (_seqh, 0, data + 8, seqh_size);
+                 }
+-- 
+2.47.0
+

0028-jpegdec-Directly-error-out-on-negotiation-failures.patch

@@ -0,0 +1,95 @@
+From 51a811cf18db7aa70704a1b4c0a6fac9512d94ae Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Mon, 30 Sep 2024 16:22:19 +0300
+Subject: [PATCH 28/28] jpegdec: Directly error out on negotiation failures
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-247
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3862
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8102>
+---
+ .../gst-plugins-good/ext/jpeg/gstjpegdec.c    | 22 ++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/subprojects/gst-plugins-good/ext/jpeg/gstjpegdec.c b/subprojects/gst-plugins-good/ext/jpeg/gstjpegdec.c
+index 452747d157..4e41248e52 100644
+--- a/subprojects/gst-plugins-good/ext/jpeg/gstjpegdec.c
++++ b/subprojects/gst-plugins-good/ext/jpeg/gstjpegdec.c
+@@ -1068,13 +1068,14 @@ gst_jpeg_turbo_parse_ext_fmt_convert (GstJpegDec * dec, gint * clrspc)
+ }
+ #endif
+ 
+-static void
++static gboolean
+ gst_jpeg_dec_negotiate (GstJpegDec * dec, gint width, gint height, gint clrspc,
+     gboolean interlaced)
+ {
+   GstVideoCodecState *outstate;
+   GstVideoInfo *info;
+   GstVideoFormat format;
++  gboolean res;
+ 
+ #ifdef JCS_EXTENSIONS
+   if (dec->format_convert) {
+@@ -1104,7 +1105,7 @@ gst_jpeg_dec_negotiate (GstJpegDec * dec, gint width, gint height, gint clrspc,
+         height == GST_VIDEO_INFO_HEIGHT (info) &&
+         format == GST_VIDEO_INFO_FORMAT (info)) {
+       gst_video_codec_state_unref (outstate);
+-      return;
++      return TRUE;
+     }
+     gst_video_codec_state_unref (outstate);
+   }
+@@ -1118,6 +1119,8 @@ gst_jpeg_dec_negotiate (GstJpegDec * dec, gint width, gint height, gint clrspc,
+   outstate =
+       gst_video_decoder_set_output_state (GST_VIDEO_DECODER (dec), format,
+       width, height, dec->input_state);
++  if (!outstate)
++    return FALSE;
+ 
+   switch (clrspc) {
+     case JCS_RGB:
+@@ -1142,10 +1145,12 @@ gst_jpeg_dec_negotiate (GstJpegDec * dec, gint width, gint height, gint clrspc,
+ 
+   gst_video_codec_state_unref (outstate);
+ 
+-  gst_video_decoder_negotiate (GST_VIDEO_DECODER (dec));
++  res = gst_video_decoder_negotiate (GST_VIDEO_DECODER (dec));
+ 
+   GST_DEBUG_OBJECT (dec, "max_v_samp_factor=%d", dec->cinfo.max_v_samp_factor);
+   GST_DEBUG_OBJECT (dec, "max_h_samp_factor=%d", dec->cinfo.max_h_samp_factor);
++
++  return res;
+ }
+ 
+ static GstFlowReturn
+@@ -1425,8 +1430,9 @@ gst_jpeg_dec_handle_frame (GstVideoDecoder * bdec, GstVideoCodecFrame * frame)
+     num_fields = 1;
+   }
+ 
+-  gst_jpeg_dec_negotiate (dec, width, output_height,
+-      dec->cinfo.jpeg_color_space, num_fields == 2);
++  if (!gst_jpeg_dec_negotiate (dec, width, output_height,
++          dec->cinfo.jpeg_color_space, num_fields == 2))
++    goto negotiation_failed;
+ 
+   state = gst_video_decoder_get_output_state (bdec);
+   ret = gst_video_decoder_allocate_output_frame (bdec, frame);
+@@ -1558,6 +1564,12 @@ map_failed:
+     ret = GST_FLOW_ERROR;
+     goto exit;
+   }
++negotiation_failed:
++  {
++    GST_ELEMENT_ERROR (dec, CORE, NEGOTIATION, (NULL), ("failed to negotiate"));
++    ret = GST_FLOW_NOT_NEGOTIATED;
++    goto exit;
++  }
+ decode_error:
+   {
+     gchar err_msg[JMSG_LENGTH_MAX];
+-- 
+2.47.0
+

SOURCES/0001-matroskademux-Fix-extraction-of-multichannel-WavPack.patch

@@ -1,201 +0,0 @@
-From fff62c8b65cd18e2673944a2a9c95520e7b5ddf3 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Thu, 4 Mar 2021 13:05:19 +0200
-Subject: [PATCH 1/9] matroskademux: Fix extraction of multichannel WavPack
-
-The old code had a couple of issues that all lead to potential memory
-safety bugs.
-
-  - Use a constant for the Wavpack4Header size instead of using sizeof.
-    It's written out into the data and not from the struct and who knows
-    what special alignment/padding requirements some C compilers have.
-  - gst_buffer_set_size() does not realloc the buffer when setting a
-    bigger size than allocated, it only allows growing up to the maximum
-    allocated size. Instead use a GstAdapter to collect all the blocks
-    and take out everything at once in the end.
-  - Check that enough data is actually available in the input and
-    otherwise handle it an error in all cases instead of silently
-    ignoring it.
-
-Among other things this fixes out of bounds writes because the code
-assumed gst_buffer_set_size() can grow the buffer and simply wrote after
-the end of the buffer.
-
-Thanks to Natalie Silvanovich for reporting.
-
-Fixes https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/issues/859
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/merge_requests/904>
----
- gst/matroska/matroska-demux.c | 99 +++++++++++++++++++----------------
- gst/matroska/matroska-ids.h   |  2 +
- 2 files changed, 55 insertions(+), 46 deletions(-)
-
-diff --git a/gst/matroska/matroska-demux.c b/gst/matroska/matroska-demux.c
-index b2cd9b5d4..5e724c8e0 100644
---- a/gst/matroska/matroska-demux.c
-+++ b/gst/matroska/matroska-demux.c
-@@ -3704,6 +3704,12 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
-     guint32 block_samples, tmp;
-     gsize size = gst_buffer_get_size (*buf);
- 
-+    if (size < 4) {
-+      GST_ERROR_OBJECT (element, "Too small wavpack buffer");
-+      gst_buffer_unmap (*buf, &map);
-+      return GST_FLOW_ERROR;
-+    }
-+
-     gst_buffer_extract (*buf, 0, &tmp, sizeof (guint32));
-     block_samples = GUINT32_FROM_LE (tmp);
-     /* we need to reconstruct the header of the wavpack block */
-@@ -3711,10 +3717,10 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
-     /* -20 because ck_size is the size of the wavpack block -8
-      * and lace_size is the size of the wavpack block + 12
-      * (the three guint32 of the header that already are in the buffer) */
--    wvh.ck_size = size + sizeof (Wavpack4Header) - 20;
-+    wvh.ck_size = size + WAVPACK4_HEADER_SIZE - 20;
- 
-     /* block_samples, flags and crc are already in the buffer */
--    newbuf = gst_buffer_new_allocate (NULL, sizeof (Wavpack4Header) - 12, NULL);
-+    newbuf = gst_buffer_new_allocate (NULL, WAVPACK4_HEADER_SIZE - 12, NULL);
- 
-     gst_buffer_map (newbuf, &outmap, GST_MAP_WRITE);
-     data = outmap.data;
-@@ -3739,9 +3745,11 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
-     audiocontext->wvpk_block_index += block_samples;
-   } else {
-     guint8 *outdata = NULL;
--    guint outpos = 0;
--    gsize buf_size, size, out_size = 0;
-+    gsize buf_size, size;
-     guint32 block_samples, flags, crc, blocksize;
-+    GstAdapter *adapter;
-+
-+    adapter = gst_adapter_new ();
- 
-     gst_buffer_map (*buf, &map, GST_MAP_READ);
-     buf_data = map.data;
-@@ -3750,6 +3758,7 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
-     if (buf_size < 4) {
-       GST_ERROR_OBJECT (element, "Too small wavpack buffer");
-       gst_buffer_unmap (*buf, &map);
-+      g_object_unref (adapter);
-       return GST_FLOW_ERROR;
-     }
- 
-@@ -3771,59 +3780,57 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
-       data += 4;
-       size -= 4;
- 
--      if (blocksize == 0 || size < blocksize)
--        break;
--
--      g_assert ((newbuf == NULL) == (outdata == NULL));
-+      if (blocksize == 0 || size < blocksize) {
-+        GST_ERROR_OBJECT (element, "Too small wavpack buffer");
-+        gst_buffer_unmap (*buf, &map);
-+        g_object_unref (adapter);
-+        return GST_FLOW_ERROR;
-+      }
- 
--      if (newbuf == NULL) {
--        out_size = sizeof (Wavpack4Header) + blocksize;
--        newbuf = gst_buffer_new_allocate (NULL, out_size, NULL);
-+      g_assert (newbuf == NULL);
- 
--        gst_buffer_copy_into (newbuf, *buf,
--            GST_BUFFER_COPY_TIMESTAMPS | GST_BUFFER_COPY_FLAGS, 0, -1);
-+      newbuf =
-+          gst_buffer_new_allocate (NULL, WAVPACK4_HEADER_SIZE + blocksize,
-+          NULL);
-+      gst_buffer_map (newbuf, &outmap, GST_MAP_WRITE);
-+      outdata = outmap.data;
-+
-+      outdata[0] = 'w';
-+      outdata[1] = 'v';
-+      outdata[2] = 'p';
-+      outdata[3] = 'k';
-+      outdata += 4;
-+
-+      GST_WRITE_UINT32_LE (outdata, blocksize + WAVPACK4_HEADER_SIZE - 8);
-+      GST_WRITE_UINT16_LE (outdata + 4, wvh.version);
-+      GST_WRITE_UINT8 (outdata + 6, wvh.track_no);
-+      GST_WRITE_UINT8 (outdata + 7, wvh.index_no);
-+      GST_WRITE_UINT32_LE (outdata + 8, wvh.total_samples);
-+      GST_WRITE_UINT32_LE (outdata + 12, wvh.block_index);
-+      GST_WRITE_UINT32_LE (outdata + 16, block_samples);
-+      GST_WRITE_UINT32_LE (outdata + 20, flags);
-+      GST_WRITE_UINT32_LE (outdata + 24, crc);
-+      outdata += 28;
-+
-+      memcpy (outdata, data, blocksize);
- 
--        outpos = 0;
--        gst_buffer_map (newbuf, &outmap, GST_MAP_WRITE);
--        outdata = outmap.data;
--      } else {
--        gst_buffer_unmap (newbuf, &outmap);
--        out_size += sizeof (Wavpack4Header) + blocksize;
--        gst_buffer_set_size (newbuf, out_size);
--        gst_buffer_map (newbuf, &outmap, GST_MAP_WRITE);
--        outdata = outmap.data;
--      }
-+      gst_buffer_unmap (newbuf, &outmap);
-+      gst_adapter_push (adapter, newbuf);
-+      newbuf = NULL;
- 
--      outdata[outpos] = 'w';
--      outdata[outpos + 1] = 'v';
--      outdata[outpos + 2] = 'p';
--      outdata[outpos + 3] = 'k';
--      outpos += 4;
--
--      GST_WRITE_UINT32_LE (outdata + outpos,
--          blocksize + sizeof (Wavpack4Header) - 8);
--      GST_WRITE_UINT16_LE (outdata + outpos + 4, wvh.version);
--      GST_WRITE_UINT8 (outdata + outpos + 6, wvh.track_no);
--      GST_WRITE_UINT8 (outdata + outpos + 7, wvh.index_no);
--      GST_WRITE_UINT32_LE (outdata + outpos + 8, wvh.total_samples);
--      GST_WRITE_UINT32_LE (outdata + outpos + 12, wvh.block_index);
--      GST_WRITE_UINT32_LE (outdata + outpos + 16, block_samples);
--      GST_WRITE_UINT32_LE (outdata + outpos + 20, flags);
--      GST_WRITE_UINT32_LE (outdata + outpos + 24, crc);
--      outpos += 28;
--
--      memmove (outdata + outpos, data, blocksize);
--      outpos += blocksize;
-       data += blocksize;
-       size -= blocksize;
-     }
-     gst_buffer_unmap (*buf, &map);
--    gst_buffer_unref (*buf);
- 
--    if (newbuf)
--      gst_buffer_unmap (newbuf, &outmap);
-+    newbuf = gst_adapter_take_buffer (adapter, gst_adapter_available (adapter));
-+    g_object_unref (adapter);
- 
-+    gst_buffer_copy_into (newbuf, *buf,
-+        GST_BUFFER_COPY_TIMESTAMPS | GST_BUFFER_COPY_FLAGS, 0, -1);
-+    gst_buffer_unref (*buf);
-     *buf = newbuf;
-+
-     audiocontext->wvpk_block_index += block_samples;
-   }
- 
-diff --git a/gst/matroska/matroska-ids.h b/gst/matroska/matroska-ids.h
-index 9b263d8a1..a0d68343f 100644
---- a/gst/matroska/matroska-ids.h
-+++ b/gst/matroska/matroska-ids.h
-@@ -667,6 +667,8 @@ typedef struct _Wavpack4Header {
-   guint32 crc;           /* crc for actual decoded data                    */
- } Wavpack4Header;
- 
-+#define WAVPACK4_HEADER_SIZE (32)
-+
- typedef enum {
-   GST_MATROSKA_TRACK_ENCODING_SCOPE_FRAME = (1<<0),
-   GST_MATROSKA_TRACK_ENCODING_SCOPE_CODEC_DATA = (1<<1),
--- 
-2.47.0
-

SOURCES/0002-matroskademux-Initialize-track-context-out-parameter.patch

@@ -1,38 +0,0 @@
-From a88489c4bc2a807912a12398c04c0fc8579037df Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Wed, 3 Mar 2021 11:31:52 +0200
-Subject: [PATCH 2/9] matroskademux: Initialize track context out parameter to
- NULL before parsing
-
-Various error return paths don't set it to NULL and callers are only
-checking if the pointer is NULL. As it's allocated on the stack this
-usually contains random stack memory, and more often than not the memory
-of a previously parsed track.
-
-This then causes all kinds of memory corruptions further down the line.
-
-Thanks to Natalie Silvanovich for reporting.
-
-Fixes https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/issues/858
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/merge_requests/904>
----
- gst/matroska/matroska-demux.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/gst/matroska/matroska-demux.c b/gst/matroska/matroska-demux.c
-index 5e724c8e0..f890ae611 100644
---- a/gst/matroska/matroska-demux.c
-+++ b/gst/matroska/matroska-demux.c
-@@ -660,6 +660,8 @@ gst_matroska_demux_parse_stream (GstMatroskaDemux * demux, GstEbmlRead * ebml,
- 
-   DEBUG_ELEMENT_START (demux, ebml, "TrackEntry");
- 
-+  *dest_context = NULL;
-+
-   /* start with the master */
-   if ((ret = gst_ebml_read_master (ebml, &id)) != GST_FLOW_OK) {
-     DEBUG_ELEMENT_STOP (demux, ebml, "TrackEntry", ret);
--- 
-2.47.0
-

SOURCES/0003-flacparse-Avoid-integer-overflow-in-available-data-c.patch

@@ -1,55 +0,0 @@
-From 2150d2ade8bd5949fa18fcc75b78016e3becc92b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Tue, 13 Jun 2023 13:20:16 +0300
-Subject: [PATCH 3/9] flacparse: Avoid integer overflow in available data check
- for image tags
-
-If the image length as stored in the file is some bogus integer then
-adding it to the current byte readers position can overflow and wrongly
-have the check for enough available data succeed.
-
-This then later can cause NULL pointer dereferences or out of bounds
-reads/writes when actually reading the image data.
-
-Fixes ZDI-CAN-20775
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2661
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/4894>
----
- gst/audioparsers/gstflacparse.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/gst/audioparsers/gstflacparse.c b/gst/audioparsers/gstflacparse.c
-index 2758d4cfc..cd5a48bee 100644
---- a/gst/audioparsers/gstflacparse.c
-+++ b/gst/audioparsers/gstflacparse.c
-@@ -1109,6 +1109,7 @@ gst_flac_parse_handle_picture (GstFlacParse * flacparse, GstBuffer * buffer)
-   GstMapInfo map;
-   guint32 img_len = 0, img_type = 0;
-   guint32 img_mimetype_len = 0, img_description_len = 0;
-+  const guint8 *img_data;
- 
-   gst_buffer_map (buffer, &map, GST_MAP_READ);
-   gst_byte_reader_init (&reader, map.data, map.size);
-@@ -1135,7 +1136,7 @@ gst_flac_parse_handle_picture (GstFlacParse * flacparse, GstBuffer * buffer)
-   if (!gst_byte_reader_get_uint32_be (&reader, &img_len))
-     goto error;
- 
--  if (gst_byte_reader_get_pos (&reader) + img_len > map.size)
-+  if (!gst_byte_reader_get_data (&reader, img_len, &img_data))
-     goto error;
- 
-   GST_INFO_OBJECT (flacparse, "Got image of %d bytes", img_len);
-@@ -1144,8 +1145,7 @@ gst_flac_parse_handle_picture (GstFlacParse * flacparse, GstBuffer * buffer)
-     if (flacparse->tags == NULL)
-       flacparse->tags = gst_tag_list_new_empty ();
- 
--    gst_tag_list_add_id3_image (flacparse->tags,
--        map.data + gst_byte_reader_get_pos (&reader), img_len, img_type);
-+    gst_tag_list_add_id3_image (flacparse->tags, img_data, img_len, img_type);
-   }
- 
-   gst_buffer_unmap (buffer, &map);
--- 
-2.47.0
-

SOURCES/0004-qtdemux-Avoid-integer-overflow-when-parsing-Theora-e.patch

@@ -1,41 +0,0 @@
-From f0007ee8579f97999d69bbc6d7f9ac166a06fddb Mon Sep 17 00:00:00 2001
-From: Wim Taymans <wtaymans@redhat.com>
-Date: Mon, 16 Dec 2024 11:45:27 +0100
-Subject: [PATCH 4/9] qtdemux: Avoid integer overflow when parsing Theora
- extension
-
-Thanks to Antonio Morales for finding and reporting the issue.
-
-Fixes GHSL-2024-166
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3851
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8094>
----
- gst/isomp4/qtdemux.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
-index ad07c1e36..229edb3e5 100644
---- a/gst/isomp4/qtdemux.c
-+++ b/gst/isomp4/qtdemux.c
-@@ -7816,7 +7816,7 @@ qtdemux_parse_theora_extension (GstQTDemux * qtdemux, QtDemuxStream * stream,
-   end -= 8;
- 
-   while (buf < end) {
--    gint size;
-+    guint32 size;
-     guint32 type;
- 
-     size = QT_UINT32 (buf);
-@@ -7824,7 +7824,7 @@ qtdemux_parse_theora_extension (GstQTDemux * qtdemux, QtDemuxStream * stream,
- 
-     GST_LOG_OBJECT (qtdemux, "%p %p", buf, end);
- 
--    if (buf + size > end || size <= 0)
-+    if (end - buf < size || size < 8)
-       break;
- 
-     buf += 8;
--- 
-2.47.0
-

SOURCES/0007-matroskademux-Fix-off-by-one-when-parsing-multi-chan.patch

@@ -1,27 +0,0 @@
-From 5d1ac58fa39a4e8e1cb0545c44aae69f71099f27 Mon Sep 17 00:00:00 2001
-From: Wim Taymans <wtaymans@redhat.com>
-Date: Mon, 16 Dec 2024 11:49:04 +0100
-Subject: [PATCH 7/9] matroskademux: Fix off-by-one when parsing multi-channel
- WavPack
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057>
----
- gst/matroska/matroska-demux.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/gst/matroska/matroska-demux.c b/gst/matroska/matroska-demux.c
-index 2db68bc1f..0466c9a6b 100644
---- a/gst/matroska/matroska-demux.c
-+++ b/gst/matroska/matroska-demux.c
-@@ -3771,7 +3771,7 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
-     data += 4;
-     size -= 4;
- 
--    while (size > 12) {
-+    while (size >= 12) {
-       flags = GST_READ_UINT32_LE (data);
-       data += 4;
-       size -= 4;
--- 
-2.47.0
-

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - rhel-9
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: desktop-qe.desktop-ci.tier1-gating.functional}

gstreamer-good.appdata.xml

@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- Copyright 2013 Richard Hughes <richard@hughsie.com> -->
+<component type="codec">
+  <id>gstreamer-good</id>
+  <metadata_license>CC0-1.0</metadata_license>
+  <name>GStreamer Multimedia Codecs</name>
+  <summary>Multimedia playback for APE, AVI, DV, FLAC, FLX, Flash, MKV, MP4, Speex, VP8, VP9 and WAV</summary>
+  <description>
+    <p>
+      This addon includes several good quality codecs that are well tested.
+      These codecs can be used to encode and decode media files where the
+      format is not patent encumbered.
+    </p>
+    <p>
+      A codec decodes audio and video for for playback or editing and is also
+      used for transmission or storage.
+      Different codecs are used in video-conferencing, streaming media and
+      video editing applications.
+    </p>
+  </description>
+  <keywords>
+    <keyword>APE</keyword>
+    <keyword>AVI</keyword>
+    <keyword>DV</keyword>
+    <keyword>FLAC</keyword>
+    <keyword>FLX</keyword>
+    <keyword>Flash</keyword>
+    <keyword>MKV</keyword>
+    <keyword>MP4</keyword>
+    <keyword>Speex</keyword>
+    <keyword>VP8</keyword>
+    <keyword>VP9</keyword>
+    <keyword>WAV</keyword>
+  </keywords>
+  <url type="homepage">http://gstreamer.freedesktop.org/</url>
+  <url type="bugtracker">https://bugzilla.gnome.org/enter_bug.cgi?product=GStreamer</url>
+  <url type="donation">http://www.gnome.org/friends/</url>
+  <url type="help">http://gstreamer.freedesktop.org/documentation/</url>
+  <update_contact><!-- upstream-contact_at_email.com --></update_contact>
+</component>

gstreamer1-plugins-good.spec

@@ -1,12 +1,25 @@
 %global         majorminor      1.0
 
-# Only build extras on Fedora
+# Only build extras on fedora
 %if 0%{?fedora}
 %bcond_without extras
-%bcond_without qt
+%bcond_without nasm
 %else
 %bcond_with extras
-%bcond_with qt
+%bcond_with nasm
+%endif
+
+# RHEL 10 will provide Qt 6 and drop Qt 5
+%if 0%{?rhel} >= 10
+%bcond_with qt5
+%else
+%bcond_without qt5
+%endif
+
+%if 0%{?rhel} && 0%{?rhel} < 10
+%bcond_with qt6
+%else
+%bcond_without qt6
 %endif
 
 #global gitrel     140
@@ -14,11 +27,11 @@
 #global shortcommit %(c=%{gitcommit}; echo ${c:0:5})
 
 Name:           gstreamer1-plugins-good
-Version:        1.16.1
+Version:        1.22.12
-Release:        5%{?gitcommit:.git%{shortcommit}}%{?dist}
+Release:        4%{?dist}
 Summary:        GStreamer plugins with good code and licensing
 
-License:        LGPLv2+
+License:        CC0-1.0 AND GPL-2.0-only AND LGPL-2.0-only AND LGPL-2.0-or-later AND LGPL-2.1-only AND LGPL-2.1-or-later AND xlock AND MIT AND BSD-3-Clause AND CC-BY-3.0 
 URL:            http://gstreamer.freedesktop.org/
 
 %if 0%{?gitrel}
@@ -29,16 +42,42 @@ Source0:        gst-plugins-good-%{version}.tar.xz
 Source0:        http://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-%{version}.tar.xz
 %endif
 
-Patch0:		0001-matroskademux-Fix-extraction-of-multichannel-WavPack.patch
+# Register as an AppStream component to be visible in the software center
-Patch1:		0002-matroskademux-Initialize-track-context-out-parameter.patch
+# NOTE: It would be *awesome* if this file was maintained by the upstream
-Patch2:		0003-flacparse-Avoid-integer-overflow-in-available-data-c.patch
+# project, translated and installed into the right place during `make install`.
-Patch3:		0004-qtdemux-Avoid-integer-overflow-when-parsing-Theora-e.patch
+# See http://www.freedesktop.org/software/appstream/docs/ for more details.
-Patch4:		0005-gdkpixbufdec-Check-if-initializing-the-video-info-ac.patch
+Source1:        gstreamer-good.appdata.xml
-Patch5:		0006-matroskademux-Only-unmap-GstMapInfo-in-WavPack-heade.patch
-Patch6:		0007-matroskademux-Fix-off-by-one-when-parsing-multi-chan.patch
-Patch7:		0008-qtdemux-Fix-integer-overflow-when-allocating-the-sam.patch
-Patch8:		0009-qtdemux-Make-sure-only-an-even-number-of-bytes-is-pr.patch
 
+Patch0001:	0001-qtdemux-Avoid-integer-overflow-when-parsing-Theora-e.patch
+Patch0002:	0002-avisubtitle-Fix-size-checks-and-avoid-overflows-when.patch
+Patch0003:	0003-gdkpixbufdec-Check-if-initializing-the-video-info-ac.patch
+Patch0004:	0004-wavparse-Check-for-short-reads-when-parsing-headers-.patch
+Patch0005:	0005-wavparse-Make-sure-enough-data-for-the-tag-list-tag-.patch
+Patch0006:	0006-wavparse-Fix-parsing-of-acid-chunk.patch
+Patch0007:	0007-wavparse-Check-that-at-least-4-bytes-are-available-b.patch
+Patch0008:	0008-wavparse-Check-that-at-least-32-bytes-are-available-.patch
+Patch0009:	0009-wavparse-Fix-clipping-of-size-to-the-file-size.patch
+Patch0010:	0010-wavparse-Check-size-before-reading-ds64-chunk.patch
+Patch0011:	0011-matroskademux-Only-unmap-GstMapInfo-in-WavPack-heade.patch
+Patch0012:	0012-matroskademux-Fix-off-by-one-when-parsing-multi-chan.patch
+Patch0013:	0013-matroskademux-Check-for-big-enough-WavPack-codec-pri.patch
+Patch0014:	0014-matroskademux-Don-t-take-data-out-of-an-empty-adapte.patch
+Patch0015:	0015-matroskademux-Skip-over-laces-directly-when-postproc.patch
+Patch0016:	0016-matroskademux-Skip-over-zero-sized-Xiph-stream-heade.patch
+Patch0017:	0017-matroskademux-Put-a-copy-of-the-codec-data-into-the-.patch
+Patch0018:	0018-qtdemux-Fix-integer-overflow-when-allocating-the-sam.patch
+Patch0019:	0019-qtdemux-Check-sizes-of-stsc-stco-stts-before-trying-.patch
+Patch0020:	0020-qtdemux-Make-sure-only-an-even-number-of-bytes-is-pr.patch
+Patch0021:	0021-qtdemux-Make-sure-enough-data-is-available-before-re.patch
+Patch0022:	0022-qtdemux-Fix-length-checks-and-offsets-in-stsd-entry-.patch
+Patch0023:	0023-qtdemux-Fix-error-handling-when-parsing-cenc-sample-.patch
+Patch0024:	0024-qtdemux-Make-sure-there-are-enough-offsets-to-read-w.patch
+Patch0025:	0025-qtdemux-Actually-handle-errors-returns-from-various-.patch
+Patch0026:	0026-qtdemux-Check-for-invalid-atom-length-when-extractin.patch
+Patch0027:	0027-qtdemux-Add-size-check-for-parsing-SMI-SEQH-atom.patch
+Patch0028:	0028-jpegdec-Directly-error-out-on-negotiation-failures.patch
+
+BuildRequires:  meson >= 0.48.0
 BuildRequires:  gcc
 BuildRequires:  gcc-c++
 BuildRequires:  gstreamer1-devel >= %{version}
@@ -71,32 +110,31 @@ BuildRequires:  mesa-libEGL-devel
 BuildRequires:  lame-devel
 BuildRequires:  mpg123-devel
 BuildRequires:  twolame-devel
+#BuildRequires:  qt6-qtshadertools
+%if %{with nasm}
+BuildRequires:  nasm
+%endif
+BuildRequires:  libgudev-devel
 
+# extras
+%if %{with extras}
+BuildRequires:  pipewire-jack-audio-connection-kit-devel
 %ifnarch s390 s390x
 BuildRequires:  libavc1394-devel
 BuildRequires:  libdv-devel
 BuildRequires:  libiec61883-devel
 BuildRequires:  libraw1394-devel
 %endif
-
-# extras
-%if %{with extras}
-BuildRequires:  jack-audio-connection-kit-devel
 %endif
 
-# documentation
+# The soup elements dynamically load either version of libsoup at runtime,
-%if ! 0%{?flatpak}
+# defaulting to libsoup3 if libsoup2 is not already loaded in the process
-BuildRequires:  gtk-doc
+Recommends:     libsoup3%{?_isa}
-%endif
-BuildRequires:  python3-devel
 
 # Obsoletes/Provides moved from plugins-bad-free
 Obsoletes:      gstreamer1-plugin-mpg123 < 1.13.1
 Provides:       gstreamer1-plugin-mpg123 = %{version}-%{release}
 
-# mpg123, lame, twolame were moved -> conflict old package version
-Conflicts:      gstreamer1-plugins-ugly-free < 1.13.1
-
 %description
 GStreamer is a streaming media framework, based on graphs of filters which
 operate on media data. Applications using this library can do anything
@@ -126,7 +164,7 @@ good quality and under the LGPL license.
 
 This package (%{name}-gtk) contains the gtksink output plugin.
 
-%if %{with qt}
+%if %{with qt5}
 %package qt
 Summary:         GStreamer "good" plugins qt qml plugin
 Requires:        %{name}%{?_isa} = %{version}-%{release}
@@ -136,6 +174,8 @@ BuildRequires: pkgconfig(Qt5Qml)
 BuildRequires: pkgconfig(Qt5Quick)
 BuildRequires: pkgconfig(Qt5X11Extras)
 BuildRequires: pkgconfig(Qt5WaylandClient)
+BuildRequires: qt5-qtbase-private-devel
+BuildRequires: qt5-linguist
 
 Supplements: (gstreamer1-plugins-good and qt5-qtdeclarative)
 
@@ -149,6 +189,30 @@ good quality and under the LGPL license.
 This package (%{name}-qt) contains the qtsink output plugin.
 %endif
 
+%if %{with qt6}
+%package qt6
+Summary:         GStreamer "good" plugins qt6 qml plugin
+Requires:        %{name}%{?_isa} = %{version}-%{release}
+
+BuildRequires: pkgconfig(Qt6Gui)
+BuildRequires: pkgconfig(Qt6Qml)
+BuildRequires: pkgconfig(Qt6Quick)
+BuildRequires: pkgconfig(Qt6WaylandClient)
+BuildRequires: pkgconfig(Qt6Linguist)
+BuildRequires: qt6-qtbase-private-devel
+BuildRequires: qt6-linguist
+
+Supplements: (gstreamer1-plugins-good and qt6-qtdeclarative)
+
+%description qt6
+GStreamer is a streaming media framework, based on graphs of elements which
+operate on media data.
+
+GStreamer Good Plugins is a collection of well-supported plugins of
+good quality and under the LGPL license.
+
+This package (%{name}-qt6) contains the qml6sink output plugin.
+%endif
 
 %if %{with extras}
 %package extras
@@ -171,101 +235,79 @@ to be installed.
 
 %prep
 %setup -q -n gst-plugins-good-%{version}
-%patch0 -p1
+%patch -P 0001 -p3
-%patch1 -p1
+%patch -P 0002 -p3
-%patch2 -p1
+%patch -P 0003 -p3
-%patch3 -p1
+%patch -P 0004 -p3
-%patch4 -p1
+%patch -P 0005 -p3
-%patch5 -p1
+%patch -P 0006 -p3
-%patch6 -p1
+%patch -P 0007 -p3
-%patch7 -p1
+%patch -P 0008 -p3
-%patch8 -p1
+%patch -P 0009 -p3
+%patch -P 0010 -p3
+%patch -P 0011 -p3
+%patch -P 0012 -p3
+%patch -P 0013 -p3
+%patch -P 0014 -p3
+%patch -P 0015 -p3
+%patch -P 0016 -p3
+%patch -P 0017 -p3
+%patch -P 0018 -p3
+%patch -P 0019 -p3
+%patch -P 0020 -p3
+%patch -P 0021 -p3
+%patch -P 0022 -p3
+%patch -P 0023 -p3
+%patch -P 0024 -p3
+%patch -P 0025 -p3
+%patch -P 0026 -p3
+%patch -P 0027 -p3
+%patch -P 0028 -p3
 
 %build
-%configure --disable-silent-rules --disable-fatal-warnings \
+%meson \
-  --with-package-name='Fedora GStreamer-plugins-good package' \
+  -D package-name='Fedora GStreamer-plugins-good package' \
-  --with-package-origin='http://download.fedoraproject.org' \
+  -D package-origin='http://download.fedoraproject.org' \
-  --enable-experimental \
+  -D doc=disabled \
-%if ! 0%{?flatpak}
+  -D asm=%{?with_nasm:enabled}%{!?with_nasm:disabled} \
-  --enable-gtk-doc \
+  -D doc=disabled \
-%endif
+  -D orc=enabled \
-  --enable-orc \
+  -D monoscope=disabled \
-  --disable-monoscope \
+  -D aalib=disabled \
-  --disable-aalib \
+  -D libcaca=disabled \
-  --disable-libcaca \
+  -D rpicamsrc=disabled \
-%if %{with extras}
+  -D jack=%{?with_extras:enabled}%{!?with_extras:disabled} \
-  --enable-jack \
+%ifarch s390 s390x
+  -D dv=disabled -D dv1394=disabled \
 %else
-  --disable-jack \
+  -D dv=%{?with_extras:enabled}%{!?with_extras:disabled} \
+  -D dv1394=%{?with_extras:enabled}%{!?with_extras:disabled} \
 %endif
-  --with-default-visualizer=autoaudiosink
+%if 0%{?flatpak_runtime}
-make %{?_smp_mflags} V=1
+  -D v4l2-gudev=disabled \
+%endif
+  -D qt-egl=disabled \
+  -D qt5=%{?with_qt5:enabled}%{!?with_qt5:disabled} \
+  -D qt6=%{?with_qt6:enabled}%{!?with_qt6:disabled}
 
+%meson_build
 
 %install
-make install DESTDIR=$RPM_BUILD_ROOT
+%meson_install
 
-# Register as an AppStream component to be visible in the software center
+install -p -D %{SOURCE1} %{buildroot}%{_metainfodir}/gstreamer-good.appdata.xml
-#
+
-# NOTE: It would be *awesome* if this file was maintained by the upstream
+find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
-# project, translated and installed into the right place during `make install`.
-#
-# See http://www.freedesktop.org/software/appstream/docs/ for more details.
-#
-mkdir -p $RPM_BUILD_ROOT%{_datadir}/appdata
-cat > $RPM_BUILD_ROOT%{_datadir}/appdata/gstreamer-good.appdata.xml <<EOF
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- Copyright 2013 Richard Hughes <richard@hughsie.com> -->
-<component type="codec">
-  <id>gstreamer-good</id>
-  <metadata_license>CC0-1.0</metadata_license>
-  <name>GStreamer Multimedia Codecs</name>
-  <summary>Multimedia playback for APE, AVI, DV, FLAC, FLX, Flash, MKV, MP4, Speex, VP8, VP9 and WAV</summary>
-  <description>
-    <p>
-      This addon includes several good quality codecs that are well tested.
-      These codecs can be used to encode and decode media files where the
-      format is not patent encumbered.
-    </p>
-    <p>
-      A codec decodes audio and video for for playback or editing and is also
-      used for transmission or storage.
-      Different codecs are used in video-conferencing, streaming media and
-      video editing applications.
-    </p>
-  </description>
-  <keywords>
-    <keyword>APE</keyword>
-    <keyword>AVI</keyword>
-    <keyword>DV</keyword>
-    <keyword>FLAC</keyword>
-    <keyword>FLX</keyword>
-    <keyword>Flash</keyword>
-    <keyword>MKV</keyword>
-    <keyword>MP4</keyword>
-    <keyword>Speex</keyword>
-    <keyword>VP8</keyword>
-    <keyword>VP9</keyword>
-    <keyword>WAV</keyword>
-  </keywords>
-  <url type="homepage">http://gstreamer.freedesktop.org/</url>
-  <url type="bugtracker">https://bugzilla.gnome.org/enter_bug.cgi?product=GStreamer</url>
-  <url type="donation">http://www.gnome.org/friends/</url>
-  <url type="help">http://gstreamer.freedesktop.org/documentation/</url>
-  <update_contact><!-- upstream-contact_at_email.com --></update_contact>
-</component>
-EOF
 
 %find_lang gst-plugins-good-%{majorminor}
 
-find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
-
-
 %files -f gst-plugins-good-%{majorminor}.lang
 %license COPYING
-%doc AUTHORS README REQUIREMENTS
+%doc AUTHORS NEWS README.md README.static-linking RELEASE REQUIREMENTS
-%{_datadir}/appdata/*.appdata.xml
+%{_metainfodir}/gstreamer-good.appdata.xml
+%if 0
 %doc %{_datadir}/gtk-doc/html/gst-plugins-good-plugins-%{majorminor}
+%endif
 
 # presets
 %dir %{_datadir}/gstreamer-%{majorminor}/presets/
@@ -275,6 +317,7 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 %{_datadir}/gstreamer-%{majorminor}/presets/GstQTMux.prs
 
 # non-core plugins without external dependencies
+%{_libdir}/gstreamer-%{majorminor}/libgstadaptivedemux2.so
 %{_libdir}/gstreamer-%{majorminor}/libgstalaw.so
 %{_libdir}/gstreamer-%{majorminor}/libgstalphacolor.so
 %{_libdir}/gstreamer-%{majorminor}/libgstalpha.so
@@ -320,6 +363,7 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 %{_libdir}/gstreamer-%{majorminor}/libgstwavenc.so
 %{_libdir}/gstreamer-%{majorminor}/libgstwavparse.so
 %{_libdir}/gstreamer-%{majorminor}/libgstximagesrc.so
+%{_libdir}/gstreamer-%{majorminor}/libgstxingmux.so
 %{_libdir}/gstreamer-%{majorminor}/libgsty4menc.so
 
 # gstreamer-plugins with external dependencies but in the main package
@@ -342,60 +386,277 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 %{_libdir}/gstreamer-%{majorminor}/libgstmpg123.so
 %{_libdir}/gstreamer-%{majorminor}/libgsttwolame.so
 
-%ifnarch s390 s390x
-%{_libdir}/gstreamer-%{majorminor}/libgstdv.so
-%{_libdir}/gstreamer-%{majorminor}/libgst1394.so
-%endif
 
 %files gtk
 # Plugins with external dependencies
 %{_libdir}/gstreamer-%{majorminor}/libgstgtk.so
 
-%if %{with qt}
+%if %{with qt5}
 %files qt
 %{_libdir}/gstreamer-%{majorminor}/libgstqmlgl.so
 %endif
 
+%if %{with qt6}
+%files qt6
+%{_libdir}/gstreamer-%{majorminor}/libgstqml6.so
+%endif
+
 %if %{with extras}
 %files extras
 # Plugins with external dependencies
 %{_libdir}/gstreamer-%{majorminor}/libgstjack.so
+%ifnarch s390 s390x
+%{_libdir}/gstreamer-%{majorminor}/libgstdv.so
+%{_libdir}/gstreamer-%{majorminor}/libgst1394.so
+%endif
 %endif
 
 
 %changelog
-* Mon Dec 16 2024 Wim Taymans <wtaymans@redhat.com> - 1.16.1-5
+* Fri Dec 13 2024 Wim Taymans <wtaymans@redhat.com> - 1.22.12-4
-- CVE-2024-47537, CVE-2024-47539, CVE-2024-47540, CVE-2024-47606,
+- Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540
-  CVE-2024-47613
+  CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546,
-  Resolves: RHEL-70949, RHEL-70962, RHEL-70936, RHEL-71022
+  CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599,
-  Resolves: RHEL-70998
+  CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-2024-47606,
+  CVE-2024-47613, CVE-2024-47774, CVE-2024-47775, CVE-2024-47776,
+  CVE-2024-47777, CVE-2024-47778, CVE-2024-47834
+- Resolves: RHEL-70958, RHEL-70971, RHEL-71033, RHEL-71195
+- Resolves: RHEL-71210, RHEL-71202, RHEL-71171, RHEL-71200
+- Resolves: RHEL-71206, RHEL-71173, RHEL-71198, RHEL-71204
+- Resolves: RHEL-71208, RHEL-71031, RHEL-71007, RHEL-71039
+- Resolves: RHEL-71169, RHEL-71192, RHEL-71161, RHEL-71167
+- Resolves: RHEL-71189
 
-* Wed Jan 17 2024 Wim Taymans <wtaymans@redhat.com> - 1.16.1-4
+* Sat Nov 09 2024 Wim Taymans <wtaymans@redhat.com> - 1.22.12-3
-- CVE-2023-37327: integer overflow leading to heap overwrite in
+- Rebuild
-  FLAC image tag handling
+- Resolves: RHEL-38511, RHEL-41157
-- Resolves: RHEL-19469
 
-* Thu Jul 14 2022 Wim Taymans <wtaymans@redhat.com> - 1.16.1-3
+* Fri Nov 08 2024 Wim Taymans <wtaymans@redhat.com> - 1.22.12-2
-- Add patches for matroskademux. CVE-2021-3497
+- Rebuild
-- Resolves: rhbz#1948942
+- Resolves: RHEL-38511, RHEL-41157
 
-* Wed Dec 9 2020 Wim Taymans <wtaymans@redhat.com> - 1.16.1-2
+* Tue Apr 30 2024 Gwyn Ciesla <gwync@protonmail.com> - 1.22.12-1
-- Suppress documentation in Flatpak builds
+- 1.22.12
-- Resolves: rhbz#1895938
 
-* Thu Nov 14 2019 Wim Taymans <wtaymans@redhat.com> - 1.16.1-1
+* Fri Apr 26 2024 Gwyn Ciesla <gwync@protonmail.com> - 1.22.11-2
+- Qt6 re-rebuild
+
+* Thu Apr 18 2024 Gwyn Ciesla <gwync@protonmail.com> - 1.22.11-1
+- 1.22.11
+
+* Thu Apr 18 2024 Jan Grulich <jgrulich@redhat.com> - 1.22.9-1
+- Revert back to 1.22.9 (accidentally merged Rawhide to f40)
+
+* Thu Apr 04 2024 Jan Grulich <jgrulich@redhat.com> - 1.24.0-2
+- Rebuild (qt6)
+
+* Tue Mar 05 2024 Wim Taymans <wtaymans@redhat.com> - 1.24.0-1
+- Update to 1.24.0
+
+* Fri Feb 16 2024 Jan Grulich <jgrulich@redhat.com> - 1.22.9-3
+- Rebuild (qt6)
+
+* Tue Feb 13 2024 Pete Walter <pwalter@fedoraproject.org> - 1.22.9-2
+- Rebuild for libvpx 1.14.x
+
+* Thu Jan 25 2024 Gwyn Ciesla <gwync@protonmail.com> - 1.22.9-1
+- 1.22.9
+
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.22.8-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.22.8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Mon Dec 18 2023 Gwyn Ciesla <gwync@protonmail.com> - 1.22.8-1
+- 1.22.8
+
+* Wed Nov 29 2023 Jan Grulich <jgrulich@redhat.com> - 1.22.7-2
+- Rebuild (qt6)
+
+* Tue Nov 14 2023 Gwyn Ciesla <gwync@protonmail.com> - 1.22.7-1
+- 1.22.7
+
+* Fri Oct 13 2023 Jan Grulich <jgrulich@redhat.com> - 1.22.5-3
+- Rebuild (qt6)
+
+* Thu Oct 05 2023 Jan Grulich <jgrulich@redhat.com> - 1.22.5-2
+- Rebuild (qt6)
+
+* Fri Jul 21 2023 Wim Taymans <wtaymans@redhat.com> - 1.22.5-1
+- Update to 1.22.5
+- Disable qt-egl and add some BuildRequires to make things compile.
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.22.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Sun Jun 18 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 1.22.3-2
+- Enable Qt6 plugin, disable Qt5 plugin for RHEL 10
+
+* Thu May 25 2023 Wim Taymans <wtaymans@redhat.com> - 1.22.3-1
+- Update to 1.22.3
+
+* Thu Apr 13 2023 Wim Taymans <wtaymans@redhat.com> - 1.22.2-1
+- Update to 1.22.2
+
+* Mon Mar 13 2023 Wim Taymans <wtaymans@redhat.com> - 1.22.1-1
+- Update to 1.22.1
+
+* Wed Feb 15 2023 Tom Callaway <spot@fedoraproject.org> - 1.22.0-2
+- rebuild for new libvpx
+
+* Tue Jan 24 2023 Wim Taymans <wtaymans@redhat.com> - 1.22.0-1
+- Update to 1.22.0
+
+* Fri Jan 20 2023 Wim Taymans <wtaymans@redhat.com> - 1.21.90-1
+- Update to 1.21.90
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.20.5-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Wed Jan 11 2023 Wim Taymans <wtaymans@redhat.com> - 1.20.5-1
+- Update to 1.20.5
+
+* Thu Oct 13 2022 Wim Taymans <wtaymans@redhat.com> - 1.20.4-1
+- Update to 1.20.4
+
+* Tue Sep 13 2022 Michel Alexandre Salim <salimma@fedoraproject.org> - 1.20.3-3
+- Rebuilt for flac 1.4.0
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.20.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Mon Jul 18 2022 Wim Taymans <wtaymans@redhat.com> - 1.20.3-1
+- Update to 1.20.3
+
+* Fri Feb 4 2022 Wim Taymans <wtaymans@redhat.com> - 1.20.0-1
+- Update to 1.20.0
+
+* Thu Jan 27 2022 Tom Callaway <spot@fedoraproject.org> - 1.19.3-4
+- rebuild for libvpx
+
+* Wed Jan 26 2022 Wim Taymans <wtaymans@redhat.com> - 1.19.3-3
+- Fix build
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.19.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Nov 11 2021 Wim Taymans <wtaymans@redhat.com> - 1.19.3-1
+- Update to 1.19.3
+
+* Thu Sep 23 2021 Wim Taymans <wtaymans@redhat.com> - 1.19.2-1
+- Update to 1.19.2
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.19.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Thu Jun 03 2021 Wim Taymans <wtaymans@redhat.com> - 1.19.1-1
+- Update to 1.19.1
+
+* Fri May 14 2021 Wim Taymans <wtaymans@redhat.com> - 1.18.4-2
+- Move libdv and friends to extras
+
+* Tue Mar 16 2021 Wim Taymans <wtaymans@redhat.com> - 1.18.4-1
+- Update to 1.18.4
+
+* Tue Feb 23 2021 Wim Taymans <wtaymans@redhat.com> - 1.18.2-3
+- use only nasm on fedora
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.18.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Thu Dec 10 2020 Wim Taymans <wtaymans@redhat.com> - 1.18.2-1
+- Update to 1.18.2
+
+* Fri Oct 30 2020 Wim Taymans <wtaymans@redhat.com> - 1.18.1-1
+- Update to 1.18.1
+
+* Wed Oct 28 2020 Jeff Law <law@redhat.com> - 1.18.0-2
+- Fix bogus use of volatile diagnosed by gcc-11
+
+* Tue Sep 8 2020 Wim Taymans <wtaymans@redhat.com> - 1.18.0-1
+- Update to 1.18.0
+
+* Fri Aug 21 2020 Wim Taymans <wtaymans@redhat.com> - 1.17.90-1
+- Update to 1.17.90
+- disable rpicamsrc
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.17.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Jul 6 2020 Wim Taymans <wtaymans@redhat.com> - 1.17.2-1
+- Update to 1.17.2
+
+* Mon Jun 22 2020 Wim Taymans <wtaymans@redhat.com> - 1.17.1-1
+- Update to 1.17.1
+- disable dv and 1394 on s390
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.16.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Thu Jan 2 2020 Wim Taymans <wtaymans@redhat.com> - 1.16.2-1
+- Update to 1.16.2
+
+* Fri Sep 27 2019 Wim Taymans <wtaymans@redhat.com> - 1.16.1-2
+- Enable cairo plugins. (rhbz#1737254)
+
+* Tue Sep 24 2019 Wim Taymans <wtaymans@redhat.com> - 1.16.1-1
 - Update to 1.16.1
-- enable cairo plugins
-- Resolves: rhbz#1756299
 
-* Tue Jul 17 2018 Wim Taymans <wtaymans@redhat.com> - 1.14.0-4
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.16.0-2
-- Only build extras on Fedora
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 
-* Tue Jul 17 2018 Wim Taymans <wtaymans@redhat.com> - 1.14.0-3
+* Tue Apr 23 2019 Wim Taymans <wtaymans@redhat.com> - 1.16.0-1
-- Conflict old package after move of mp3 plugins (#1578420)
+- Update to 1.16.0
 
-* Fri Jun 29 2018 Charalampos Stratakis <cstratak@redhat.com> - 1.14.0-2
+* Thu Mar 07 2019 Rex Dieter <rdieter@fedoraproject.org> - 1.15.2-3
-- Use Python 3 for docs generation
+- -qt: fix Supplements
+
+* Thu Mar 07 2019 Rex Dieter <rdieter@fedoraproject.org> - 1.15.2-2
+- -qt subpkg
+
+* Fri Mar 01 2019 Wim Taymans <wtaymans@redhat.com> - 1.15.2-1
+- Update to 1.15.2
+
+* Tue Feb 05 2019 Björn Esser <besser82@fedoraproject.org> - 1.15.1-3
+- rebuilt (libvpx)
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.15.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Fri Jan 25 2019 Wim Taymans <wtaymans@redhat.com> - 1.15.1-1
+- Update to 1.15.1
+
+* Wed Oct 03 2018 Wim Taymans <wtaymans@redhat.com> - 1.14.4-1
+- Update to 1.14.4
+
+* Tue Sep 18 2018 Wim Taymans <wtaymans@redhat.com> - 1.14.3-1
+- Update to 1.14.3
+
+* Mon Jul 23 2018 Wim Taymans <wtaymans@redhat.com> - 1.14.2-1
+- Update to 1.14.2
+
+* Fri Jul 20 2018 Wim Taymans <wtaymans@redhat.com> - 1.14.1-5
+- Add c++ buildrequires
+- Only build extras on fedora
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.14.1-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Fri May 25 2018 Wim Taymans <wtaymans@redhat.com> - 1.14.1-3
+- Rebuild to correct Provides (#1581325)
+- Remove check line that was added for testing
+
+* Tue May 22 2018 Rex Dieter <rdieter@fedoraproject.org> - 1.14.1-2
+- use %%make_build %%make_install %%_metainfodir
+- %%build: --disable-qt (for now)
+
+* Mon May 21 2018 Wim Taymans <wtaymans@redhat.com> - 1.14.1-1
+- Update to 1.14.1
+
+* Fri Mar 23 2018 Iryna Shcherbina <ishcherb@redhat.com> - 1.14.0-2
+- Update Python 2 dependency declarations to new packaging standards
+  (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
 
 * Tue Mar 20 2018 Wim Taymans <wtaymans@redhat.com> - 1.14.0-1
 - Update to 1.14.0

sources

@@ -0,0 +1 @@
+SHA512 (gst-plugins-good-1.22.12.tar.xz) = 06edbec1981681eef13852f21814666ccd9b664892795109d605015e0fe351d9cc3159af3e0ff92aa0d6bf085af8a749333d128544a2ce8b545067b95b7e09c0