SOURCES/0001-flacparse-Avoid-integer-overflow-in-available-data-c.patch

@@ -1,8 +1,8 @@
 From 2150d2ade8bd5949fa18fcc75b78016e3becc92b Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
 Date: Tue, 13 Jun 2023 13:20:16 +0300
-Subject: [PATCH 3/9] flacparse: Avoid integer overflow in available data check
- for image tags
+Subject: [PATCH] flacparse: Avoid integer overflow in available data check for
+ image tags
 
 If the image length as stored in the file is some bogus integer then
 adding it to the current byte readers position can overflow and wrongly
@@ -51,5 +51,5 @@ index 2758d4cfc..cd5a48bee 100644
  
    gst_buffer_unmap (buffer, &map);
 -- 
-2.47.0
+2.43.0
 

SOURCES/0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch

@@ -1,110 +0,0 @@
-From 63f66492d43c29d8ea70a59567028b21c9c140bb Mon Sep 17 00:00:00 2001
-From: Wim Taymans <wtaymans@redhat.com>
-Date: Tue, 31 Mar 2026 13:17:15 +0200
-Subject: [PATCH] rtpqdm2depay: error out if anyone tries to use this element
-
-Forbid use of this element and comment out all processing code.
-
-There is no plausible reason this code should ever be executed in 2026
-seeing that this was a streaming format produced by Darwin Streaming Server
-ca 2009 which hasn't been in active use for well over a decade.
-
-We simply error out for now as defensive measure and will remove the
-element entirely in the next release cycle.
-
-The processing functions are hairy and rather tedious to fix without
-at least some sample stream at hand.
-
-If anyone actually does have a legitimate need for this element and
-can provide a sample streams, we will happily implement a depayloader
-in Rust.
-
-Fixes ZDI-CAN-28850, ZDI-CAN-28851, ZDI-CAN-28851, ZDI-CAN-28850, GST-SA-2026-0008.
-
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4903
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4890
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/10886>
----
- .../gst-plugins-good/gst/rtp/gstrtpqdmdepay.c | 25 ++++++++++++++++++-
- 1 file changed, 24 insertions(+), 1 deletion(-)
----
- gst/rtp/gstrtpqdmdepay.c | 25 ++++++++++++++++++++++++-
- 1 file changed, 24 insertions(+), 1 deletion(-)
-
-diff --git a/gst/rtp/gstrtpqdmdepay.c b/gst/rtp/gstrtpqdmdepay.c
-index 898663aa7..5dbcc548f 100644
---- a/gst/rtp/gstrtpqdmdepay.c
-+++ b/gst/rtp/gstrtpqdmdepay.c
-@@ -50,11 +50,13 @@ GST_STATIC_PAD_TEMPLATE ("sink",
- G_DEFINE_TYPE (GstRtpQDM2Depay, gst_rtp_qdm2_depay,
-     GST_TYPE_RTP_BASE_DEPAYLOAD);
- 
-+#if 0
- static const guint8 headheader[20] = {
-   0x0, 0x0, 0x0, 0xc, 0x66, 0x72, 0x6d, 0x61,
-   0x51, 0x44, 0x4d, 0x32, 0x0, 0x0, 0x0, 0x24,
-   0x51, 0x44, 0x43, 0x41
- };
-+#endif
- 
- static void gst_rtp_qdm2_depay_finalize (GObject * object);
- 
-@@ -131,6 +133,7 @@ gst_rtp_qdm2_depay_setcaps (GstRTPBaseDepayload * filter, GstCaps * caps)
-   return TRUE;
- }
- 
-+#if 0
- static void
- flush_data (GstRtpQDM2Depay * depay)
- {
-@@ -223,10 +226,26 @@ add_packet (GstRtpQDM2Depay * depay, guint32 pid, guint32 len, guint8 * data)
-   memcpy (packet->data + packet->offs, data, len);
-   packet->offs += len;
- }
-+#endif
- 
- static GstBuffer *
- gst_rtp_qdm2_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
- {
-+  /* There is no plausible reason this code should ever be executed in 2026
-+   * seeing that this was a streaming format produced by Darwin Streaming Server
-+   * ca 2009 which hasn't been in active use for well over a decade.
-+   *
-+   * We simply return here as defensive measure.
-+   *
-+   * We post an error message in the state change function, so this processing
-+   * function should never be reached, we just ifdef the code out for clarity.
-+   *
-+   * If anyone actually does have a legitimate need for this and can provide
-+   * sample streams, we will happily implement a depayloader in Rust.
-+   */
-+  return NULL;
-+
-+#if 0
-   GstRtpQDM2Depay *rtpqdm2depay;
-   GstBuffer *outbuf = NULL;
-   guint16 seq;
-@@ -371,6 +390,7 @@ bad_packet:
-         (NULL), ("Packet was too short"));
-     return NULL;
-   }
-+#endif
- }
- 
- static GstStateChangeReturn
-@@ -384,7 +404,10 @@ gst_rtp_qdm2_depay_change_state (GstElement * element,
- 
-   switch (transition) {
-     case GST_STATE_CHANGE_NULL_TO_READY:
--      break;
-+      GST_ELEMENT_ERROR (rtpqdm2depay, STREAM, DECODE,
-+          ("This element should not be used."),
-+          ("Please report an issue if you encounter this message."));
-+      return GST_STATE_CHANGE_FAILURE;
-     case GST_STATE_CHANGE_READY_TO_PAUSED:
-       gst_adapter_clear (rtpqdm2depay->adapter);
-       break;
--- 
-2.53.0
-

SOURCES/0004-qtdemux-Avoid-integer-overflow-when-parsing-Theora-e.patch

@@ -1,41 +0,0 @@
-From f0007ee8579f97999d69bbc6d7f9ac166a06fddb Mon Sep 17 00:00:00 2001
-From: Wim Taymans <wtaymans@redhat.com>
-Date: Mon, 16 Dec 2024 11:45:27 +0100
-Subject: [PATCH 4/9] qtdemux: Avoid integer overflow when parsing Theora
- extension
-
-Thanks to Antonio Morales for finding and reporting the issue.
-
-Fixes GHSL-2024-166
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3851
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8094>
----
- gst/isomp4/qtdemux.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
-index ad07c1e36..229edb3e5 100644
---- a/gst/isomp4/qtdemux.c
-+++ b/gst/isomp4/qtdemux.c
-@@ -7816,7 +7816,7 @@ qtdemux_parse_theora_extension (GstQTDemux * qtdemux, QtDemuxStream * stream,
-   end -= 8;
- 
-   while (buf < end) {
--    gint size;
-+    guint32 size;
-     guint32 type;
- 
-     size = QT_UINT32 (buf);
-@@ -7824,7 +7824,7 @@ qtdemux_parse_theora_extension (GstQTDemux * qtdemux, QtDemuxStream * stream,
- 
-     GST_LOG_OBJECT (qtdemux, "%p %p", buf, end);
- 
--    if (buf + size > end || size <= 0)
-+    if (end - buf < size || size < 8)
-       break;
- 
-     buf += 8;
--- 
-2.47.0
-

SOURCES/0005-gdkpixbufdec-Check-if-initializing-the-video-info-ac.patch

@@ -1,49 +0,0 @@
-From 8d4c79e61a62245dc6a499b0a439317bb37d0508 Mon Sep 17 00:00:00 2001
-From: Wim Taymans <wtaymans@redhat.com>
-Date: Mon, 16 Dec 2024 11:47:09 +0100
-Subject: [PATCH 5/9] gdkpixbufdec: Check if initializing the video info
- actually succeeded
-
-Otherwise a 0-byte buffer would be allocated, which gives NULL memory when
-mapped.
-
-Thanks to Antonio Morales for finding and reporting the issue.
-
-Fixes GHSL-2024-118
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3876
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8103>
----
- ext/gdk_pixbuf/gstgdkpixbufdec.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/ext/gdk_pixbuf/gstgdkpixbufdec.c b/ext/gdk_pixbuf/gstgdkpixbufdec.c
-index c119236a8..c0ecb3a08 100644
---- a/ext/gdk_pixbuf/gstgdkpixbufdec.c
-+++ b/ext/gdk_pixbuf/gstgdkpixbufdec.c
-@@ -318,7 +318,8 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter)
- 
- 
-     gst_video_info_init (&info);
--    gst_video_info_set_format (&info, fmt, width, height);
-+    if (!gst_video_info_set_format (&info, fmt, width, height))
-+      goto format_not_supported;
-     info.fps_n = filter->in_fps_n;
-     info.fps_d = filter->in_fps_d;
-     caps = gst_video_info_to_caps (&info);
-@@ -379,6 +380,12 @@ channels_not_supported:
-         ("%d channels not supported", n_channels));
-     return GST_FLOW_ERROR;
-   }
-+format_not_supported:
-+  {
-+    GST_ELEMENT_ERROR (filter, STREAM, DECODE, (NULL),
-+        ("%d channels with %dx%d not supported", n_channels, width, height));
-+    return GST_FLOW_ERROR;
-+  }
- no_buffer:
-   {
-     GST_DEBUG ("Failed to create outbuffer - %s", gst_flow_get_name (ret));
--- 
-2.47.0
-

SOURCES/0006-matroskademux-Only-unmap-GstMapInfo-in-WavPack-heade.patch

@@ -1,52 +0,0 @@
-From c7f995f1030efb3281faa72a1a8827969f3591bc Mon Sep 17 00:00:00 2001
-From: Wim Taymans <wtaymans@redhat.com>
-Date: Mon, 16 Dec 2024 11:48:03 +0100
-Subject: [PATCH 6/9] matroskademux: Only unmap GstMapInfo in WavPack header
- extraction error paths if previously mapped
-
-Thanks to Antonio Morales for finding and reporting the issue.
-
-Fixes GHSL-2024-197
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3863
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057>
----
- gst/matroska/matroska-demux.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/gst/matroska/matroska-demux.c b/gst/matroska/matroska-demux.c
-index f890ae611..2db68bc1f 100644
---- a/gst/matroska/matroska-demux.c
-+++ b/gst/matroska/matroska-demux.c
-@@ -3687,7 +3687,6 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
-   GstMatroskaTrackAudioContext *audiocontext =
-       (GstMatroskaTrackAudioContext *) stream;
-   GstBuffer *newbuf = NULL;
--  GstMapInfo map, outmap;
-   guint8 *buf_data, *data;
-   Wavpack4Header wvh;
- 
-@@ -3704,11 +3703,11 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
- 
-   if (audiocontext->channels <= 2) {
-     guint32 block_samples, tmp;
-+    GstMapInfo outmap;
-     gsize size = gst_buffer_get_size (*buf);
- 
-     if (size < 4) {
-       GST_ERROR_OBJECT (element, "Too small wavpack buffer");
--      gst_buffer_unmap (*buf, &map);
-       return GST_FLOW_ERROR;
-     }
- 
-@@ -3746,6 +3745,7 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
-     *buf = newbuf;
-     audiocontext->wvpk_block_index += block_samples;
-   } else {
-+    GstMapInfo map, outmap;
-     guint8 *outdata = NULL;
-     gsize buf_size, size;
-     guint32 block_samples, flags, crc, blocksize;
--- 
-2.47.0
-

SOURCES/0007-matroskademux-Fix-off-by-one-when-parsing-multi-chan.patch

@@ -1,27 +0,0 @@
-From 5d1ac58fa39a4e8e1cb0545c44aae69f71099f27 Mon Sep 17 00:00:00 2001
-From: Wim Taymans <wtaymans@redhat.com>
-Date: Mon, 16 Dec 2024 11:49:04 +0100
-Subject: [PATCH 7/9] matroskademux: Fix off-by-one when parsing multi-channel
- WavPack
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057>
----
- gst/matroska/matroska-demux.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/gst/matroska/matroska-demux.c b/gst/matroska/matroska-demux.c
-index 2db68bc1f..0466c9a6b 100644
---- a/gst/matroska/matroska-demux.c
-+++ b/gst/matroska/matroska-demux.c
-@@ -3771,7 +3771,7 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
-     data += 4;
-     size -= 4;
- 
--    while (size > 12) {
-+    while (size >= 12) {
-       flags = GST_READ_UINT32_LE (data);
-       data += 4;
-       size -= 4;
--- 
-2.47.0
-

SOURCES/0008-qtdemux-Fix-integer-overflow-when-allocating-the-sam.patch

@@ -1,59 +0,0 @@
-From f3358d7e6fb9540e45f1cde0378e94482846f216 Mon Sep 17 00:00:00 2001
-From: Wim Taymans <wtaymans@redhat.com>
-Date: Mon, 16 Dec 2024 11:49:37 +0100
-Subject: [PATCH 8/9] qtdemux: Fix integer overflow when allocating the samples
- table for fragmented MP4
-
-This can lead to out of bounds writes and NULL pointer dereferences.
-
-Fixes GHSL-2024-094, GHSL-2024-237, GHSL-2024-241
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3839
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059>
----
- gst/isomp4/qtdemux.c | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
-index 229edb3e5..a37c92933 100644
---- a/gst/isomp4/qtdemux.c
-+++ b/gst/isomp4/qtdemux.c
-@@ -3327,6 +3327,7 @@ qtdemux_parse_trun (GstQTDemux * qtdemux, GstByteReader * trun,
-   gint i;
-   guint8 *data;
-   guint entry_size, dur_offset, size_offset, flags_offset = 0, ct_offset = 0;
-+  guint new_n_samples;
-   QtDemuxSample *sample;
-   gboolean ismv = FALSE;
-   gint64 initial_offset;
-@@ -3426,14 +3427,13 @@ qtdemux_parse_trun (GstQTDemux * qtdemux, GstByteReader * trun,
-     goto fail;
-   data = (guint8 *) gst_byte_reader_peek_data_unchecked (trun);
- 
--  if (stream->n_samples + samples_count >=
--      QTDEMUX_MAX_SAMPLE_INDEX_SIZE / sizeof (QtDemuxSample))
-+  if (!g_uint_checked_add (&new_n_samples, stream->n_samples, samples_count) ||
-+      new_n_samples >= QTDEMUX_MAX_SAMPLE_INDEX_SIZE / sizeof (QtDemuxSample))
-     goto index_too_big;
- 
-   GST_DEBUG_OBJECT (qtdemux, "allocating n_samples %u * %u (%.2f MB)",
--      stream->n_samples + samples_count, (guint) sizeof (QtDemuxSample),
--      (stream->n_samples + samples_count) *
--      sizeof (QtDemuxSample) / (1024.0 * 1024.0));
-+      new_n_samples, (guint) sizeof (QtDemuxSample),
-+      (new_n_samples) * sizeof (QtDemuxSample) / (1024.0 * 1024.0));
- 
-   /* create a new array of samples if it's the first sample parsed */
-   if (stream->n_samples == 0) {
-@@ -3442,7 +3442,7 @@ qtdemux_parse_trun (GstQTDemux * qtdemux, GstByteReader * trun,
-     /* or try to reallocate it with space enough to insert the new samples */
-   } else
-     stream->samples = g_try_renew (QtDemuxSample, stream->samples,
--        stream->n_samples + samples_count);
-+        new_n_samples);
-   if (stream->samples == NULL)
-     goto out_of_memory;
- 
--- 
-2.47.0
-

SOURCES/0009-qtdemux-Make-sure-only-an-even-number-of-bytes-is-pr.patch

@@ -1,40 +0,0 @@
-From 6b751c71eb130f2c69eeacf5f47e0d6de639dc78 Mon Sep 17 00:00:00 2001
-From: Wim Taymans <wtaymans@redhat.com>
-Date: Mon, 16 Dec 2024 11:52:04 +0100
-Subject: [PATCH 9/9] qtdemux: Make sure only an even number of bytes is
- processed when handling CEA608 data
-
-An odd number of bytes would lead to out of bound reads and writes, and doesn't
-make any sense as CEA608 comes in byte pairs.
-
-Strip off any leftover bytes and assume everything before that is valid.
-
-Thanks to Antonio Morales for finding and reporting the issue.
-
-Fixes GHSL-2024-195
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3841
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059>
----
- gst/isomp4/qtdemux.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/gst/isomp4/qtdemux.c b/gst/isomp4/qtdemux.c
-index a37c92933..8336ff302 100644
---- a/gst/isomp4/qtdemux.c
-+++ b/gst/isomp4/qtdemux.c
-@@ -5612,6 +5612,11 @@ convert_to_s334_1a (const guint8 * ccpair, guint8 ccpair_size, guint field,
-   guint8 *storage;
-   gsize i;
- 
-+  /* Strip off any leftover odd bytes and assume everything before is valid */
-+  if (ccpair_size % 2 != 0) {
-+    ccpair_size -= 1;
-+  }
-+
-   /* We are converting from pairs to triplets */
-   *res = ccpair_size / 2 * 3;
-   storage = g_malloc (*res);
--- 
-2.47.0
-

SOURCES/9efd93e20dd7789e4172ad6c8f4108271b3fb1ee.patch

@@ -1,7 +1,7 @@
-From fff62c8b65cd18e2673944a2a9c95520e7b5ddf3 Mon Sep 17 00:00:00 2001
+From 9efd93e20dd7789e4172ad6c8f4108271b3fb1ee Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
 Date: Thu, 4 Mar 2021 13:05:19 +0200
-Subject: [PATCH 1/9] matroskademux: Fix extraction of multichannel WavPack
+Subject: [PATCH] matroskademux: Fix extraction of multichannel WavPack
 
 The old code had a couple of issues that all lead to potential memory
 safety bugs.
@@ -32,10 +32,10 @@ Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/merge_requ
  2 files changed, 55 insertions(+), 46 deletions(-)
 
 diff --git a/gst/matroska/matroska-demux.c b/gst/matroska/matroska-demux.c
-index b2cd9b5d4..5e724c8e0 100644
+index 4eb3d2a9f..f890ae611 100644
 --- a/gst/matroska/matroska-demux.c
 +++ b/gst/matroska/matroska-demux.c
-@@ -3704,6 +3704,12 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
+@@ -3706,6 +3706,12 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
      guint32 block_samples, tmp;
      gsize size = gst_buffer_get_size (*buf);
  
@@ -48,7 +48,7 @@ index b2cd9b5d4..5e724c8e0 100644
      gst_buffer_extract (*buf, 0, &tmp, sizeof (guint32));
      block_samples = GUINT32_FROM_LE (tmp);
      /* we need to reconstruct the header of the wavpack block */
-@@ -3711,10 +3717,10 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
+@@ -3713,10 +3719,10 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
      /* -20 because ck_size is the size of the wavpack block -8
       * and lace_size is the size of the wavpack block + 12
       * (the three guint32 of the header that already are in the buffer) */
@@ -61,7 +61,7 @@ index b2cd9b5d4..5e724c8e0 100644
  
      gst_buffer_map (newbuf, &outmap, GST_MAP_WRITE);
      data = outmap.data;
-@@ -3739,9 +3745,11 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
+@@ -3741,9 +3747,11 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
      audiocontext->wvpk_block_index += block_samples;
    } else {
      guint8 *outdata = NULL;
@@ -75,7 +75,7 @@ index b2cd9b5d4..5e724c8e0 100644
  
      gst_buffer_map (*buf, &map, GST_MAP_READ);
      buf_data = map.data;
-@@ -3750,6 +3758,7 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
+@@ -3752,6 +3760,7 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
      if (buf_size < 4) {
        GST_ERROR_OBJECT (element, "Too small wavpack buffer");
        gst_buffer_unmap (*buf, &map);
@@ -83,7 +83,7 @@ index b2cd9b5d4..5e724c8e0 100644
        return GST_FLOW_ERROR;
      }
  
-@@ -3771,59 +3780,57 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
+@@ -3773,59 +3782,57 @@ gst_matroska_demux_add_wvpk_header (GstElement * element,
        data += 4;
        size -= 4;
  
@@ -197,5 +197,5 @@ index 9b263d8a1..a0d68343f 100644
    GST_MATROSKA_TRACK_ENCODING_SCOPE_FRAME = (1<<0),
    GST_MATROSKA_TRACK_ENCODING_SCOPE_CODEC_DATA = (1<<1),
 -- 
-2.47.0
+GitLab
 

SOURCES/d62cecf193d6bf3b16fe91d725f4514161f602c3.patch

@@ -1,8 +1,8 @@
-From a88489c4bc2a807912a12398c04c0fc8579037df Mon Sep 17 00:00:00 2001
+From d62cecf193d6bf3b16fe91d725f4514161f602c3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
 Date: Wed, 3 Mar 2021 11:31:52 +0200
-Subject: [PATCH 2/9] matroskademux: Initialize track context out parameter to
- NULL before parsing
+Subject: [PATCH] matroskademux: Initialize track context out parameter to NULL
+ before parsing
 
 Various error return paths don't set it to NULL and callers are only
 checking if the pointer is NULL. As it's allocated on the stack this
@@ -21,7 +21,7 @@ Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/merge_requ
  1 file changed, 2 insertions(+)
 
 diff --git a/gst/matroska/matroska-demux.c b/gst/matroska/matroska-demux.c
-index 5e724c8e0..f890ae611 100644
+index b2cd9b5d4..4eb3d2a9f 100644
 --- a/gst/matroska/matroska-demux.c
 +++ b/gst/matroska/matroska-demux.c
 @@ -660,6 +660,8 @@ gst_matroska_demux_parse_stream (GstMatroskaDemux * demux, GstEbmlRead * ebml,
@@ -34,5 +34,5 @@ index 5e724c8e0..f890ae611 100644
    if ((ret = gst_ebml_read_master (ebml, &id)) != GST_FLOW_OK) {
      DEBUG_ELEMENT_STOP (demux, ebml, "TrackEntry", ret);
 -- 
-2.47.0
+GitLab
 

SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-18296.patch

@@ -1,259 +0,0 @@
-From d487603fa1f0eb7202a7e3f662eb7617da4969ef Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Wed, 17 Jun 2026 16:18:50 +0300
-Subject: [PATCH] qtmoovrecover: Validate box sizes
-
-Also validate box versions where it matters.
-
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5118
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5120
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12041>
----
- gst/isomp4/atomsrecovery.c | 88 ++++++++++++++++++++++++++++++++++++--
- 1 file changed, 84 insertions(+), 4 deletions(-)
-
-diff --git a/gst/isomp4/atomsrecovery.c b/gst/isomp4/atomsrecovery.c
-index edc4434..1761854 100644
---- a/gst/isomp4/atomsrecovery.c
-+++ b/gst/isomp4/atomsrecovery.c
-@@ -283,6 +283,8 @@ moov_recov_file_parse_prefix (MoovRecovFile * moovrf)
-   if (!read_atom_header (moovrf->file, &fourcc, &size)) {
-     return FALSE;
-   }
-+  if (size < 8)
-+    return FALSE;
- 
-   if (fourcc != FOURCC_ftyp) {
-     /* we might have a prefix here */
-@@ -294,6 +296,8 @@ moov_recov_file_parse_prefix (MoovRecovFile * moovrf)
-     /* now read the ftyp */
-     if (!read_atom_header (moovrf->file, &fourcc, &size))
-       return FALSE;
-+    if (size < 8)
-+      return FALSE;
-   }
- 
-   /* this has to be the ftyp */
-@@ -315,12 +319,25 @@ moov_recov_file_parse_mvhd (MoovRecovFile * moovrf)
-   /* check for sanity */
-   if (fourcc != FOURCC_mvhd)
-     return FALSE;
-+  if (size < 8)
-+    return FALSE;
- 
-   moovrf->mvhd_size = size;
-   moovrf->mvhd_pos = ftell (moovrf->file) - 8;
- 
-+  guint8 version;
-+  if (fread (&version, 1, 1, moovrf->file) != 1)
-+    return FALSE;
-+  if (version != 0) {
-+    GST_WARNING ("Version %d mvhd not supported", version);
-+    return FALSE;
-+  }
-+
-+  if (size != 108)
-+    return FALSE;
-+
-   /* skip the remaining of the mvhd in the file */
--  return fseek (moovrf->file, size - 8, SEEK_CUR) == 0;
-+  return fseek (moovrf->file, size - 8 - 1, SEEK_CUR) == 0;
- }
- 
- static gboolean
-@@ -357,6 +374,8 @@ mdat_recov_file_find_mdat (FILE * file, GError ** err)
-       case FOURCC_ftyp:
-       case FOURCC_free:
-       case FOURCC_udta:
-+        if (size < 8)
-+          return FALSE;
-         if (fseek (file, size - 8, SEEK_CUR) != 0) {
-           goto file_seek_error;
-         }
-@@ -486,6 +505,8 @@ skip_atom (MoovRecovFile * moovrf, guint32 expected_fourcc)
-     return FALSE;
-   if (fourcc != expected_fourcc)
-     return FALSE;
-+  if (size < 8)
-+    return FALSE;
- 
-   return (fseek (moovrf->file, size - 8, SEEK_CUR) == 0);
- }
-@@ -502,11 +523,24 @@ moov_recov_parse_tkhd (MoovRecovFile * moovrf, TrakRecovData * trakrd)
-     return FALSE;
-   if (fourcc != FOURCC_tkhd)
-     return FALSE;
-+  if (size < 8)
-+    return FALSE;
- 
-   trakrd->tkhd_file_offset = ftell (moovrf->file) - 8;
- 
--  /* move 8 bytes forward to the trak_id pos */
--  if (fseek (moovrf->file, 12, SEEK_CUR) != 0)
-+  guint8 version;
-+  if (fread (&version, 1, 1, moovrf->file) != 1)
-+    return FALSE;
-+  if (version != 0) {
-+    GST_WARNING ("Version %d tkhd not supported", version);
-+    return FALSE;
-+  }
-+
-+  if (size != 92)
-+    return FALSE;
-+
-+  /* move 12-1 bytes forward to the trak_id pos */
-+  if (fseek (moovrf->file, 12 - 1, SEEK_CUR) != 0)
-     return FALSE;
-   if (fread (data, 1, 4, moovrf->file) != 4)
-     return FALSE;
-@@ -530,6 +564,8 @@ moov_recov_parse_stbl (MoovRecovFile * moovrf, TrakRecovData * trakrd)
-     return FALSE;
-   if (fourcc != FOURCC_stbl)
-     return FALSE;
-+  if (size < 8)
-+    return FALSE;
- 
-   trakrd->stbl_file_offset = ftell (moovrf->file) - 8;
-   trakrd->stbl_size = size;
-@@ -539,12 +575,17 @@ moov_recov_parse_stbl (MoovRecovFile * moovrf, TrakRecovData * trakrd)
-     return FALSE;
-   if (fourcc != FOURCC_stsd)
-     return FALSE;
-+  if (auxsize < 8)
-+    return FALSE;
-   if (fseek (moovrf->file, auxsize - 8, SEEK_CUR) != 0)
-     return FALSE;
- 
-   trakrd->stsd_size = auxsize;
-   trakrd->post_stsd_offset = ftell (moovrf->file);
- 
-+  if (trakrd->stbl_size < trakrd->post_stsd_offset - trakrd->stbl_file_offset)
-+    return FALSE;
-+
-   /* as this is the last atom we parse, we don't skip forward */
- 
-   return TRUE;
-@@ -556,11 +597,14 @@ moov_recov_parse_minf (MoovRecovFile * moovrf, TrakRecovData * trakrd)
-   guint32 size;
-   guint32 fourcc;
-   guint32 auxsize;
-+  guint64 offset;
- 
-   if (!read_atom_header (moovrf->file, &fourcc, &size))
-     return FALSE;
-   if (fourcc != FOURCC_minf)
-     return FALSE;
-+  if (size < 8)
-+    return FALSE;
- 
-   trakrd->minf_file_offset = ftell (moovrf->file) - 8;
-   trakrd->minf_size = size;
-@@ -571,17 +615,23 @@ moov_recov_parse_minf (MoovRecovFile * moovrf, TrakRecovData * trakrd)
-   if (fourcc != FOURCC_vmhd && fourcc != FOURCC_smhd && fourcc != FOURCC_hmhd &&
-       fourcc != FOURCC_gmhd)
-     return FALSE;
-+  if (auxsize < 8)
-+    return FALSE;
-   if (fseek (moovrf->file, auxsize - 8, SEEK_CUR))
-     return FALSE;
- 
-   /* skip a possible hdlr and the following dinf */
-   if (!read_atom_header (moovrf->file, &fourcc, &auxsize))
-     return FALSE;
-+  if (auxsize < 8)
-+    return FALSE;
-   if (fourcc == FOURCC_hdlr) {
-     if (fseek (moovrf->file, auxsize - 8, SEEK_CUR))
-       return FALSE;
-     if (!read_atom_header (moovrf->file, &fourcc, &auxsize))
-       return FALSE;
-+    if (auxsize < 8)
-+      return FALSE;
-   }
-   if (fourcc != FOURCC_dinf)
-     return FALSE;
-@@ -592,6 +642,10 @@ moov_recov_parse_minf (MoovRecovFile * moovrf, TrakRecovData * trakrd)
-   if (!moov_recov_parse_stbl (moovrf, trakrd))
-     return FALSE;
- 
-+  offset = ftell (moovrf->file);
-+  if (trakrd->minf_size < offset - trakrd->minf_file_offset)
-+    return FALSE;
-+
-   return TRUE;
- }
- 
-@@ -607,11 +661,24 @@ moov_recov_parse_mdhd (MoovRecovFile * moovrf, TrakRecovData * trakrd)
-     return FALSE;
-   if (fourcc != FOURCC_mdhd)
-     return FALSE;
-+  if (size < 8)
-+    return FALSE;
- 
-   trakrd->mdhd_file_offset = ftell (moovrf->file) - 8;
- 
-+  guint8 version;
-+  if (fread (&version, 1, 1, moovrf->file) != 1)
-+    return FALSE;
-+  if (version != 0) {
-+    GST_WARNING ("Version %d mdhd not supported", version);
-+    return FALSE;
-+  }
-+
-+  if (size != 32)
-+    return FALSE;
-+
-   /* get the timescale */
--  if (fseek (moovrf->file, 12, SEEK_CUR) != 0)
-+  if (fseek (moovrf->file, 12 - 1, SEEK_CUR) != 0)
-     return FALSE;
-   if (fread (data, 1, 4, moovrf->file) != 4)
-     return FALSE;
-@@ -626,12 +693,15 @@ moov_recov_parse_mdia (MoovRecovFile * moovrf, TrakRecovData * trakrd)
- {
-   guint32 size;
-   guint32 fourcc;
-+  guint64 offset;
- 
-   /* make sure we are on a tkhd atom */
-   if (!read_atom_header (moovrf->file, &fourcc, &size))
-     return FALSE;
-   if (fourcc != FOURCC_mdia)
-     return FALSE;
-+  if (size < 8)
-+    return FALSE;
- 
-   trakrd->mdia_file_offset = ftell (moovrf->file) - 8;
-   trakrd->mdia_size = size;
-@@ -643,6 +713,11 @@ moov_recov_parse_mdia (MoovRecovFile * moovrf, TrakRecovData * trakrd)
-     return FALSE;
-   if (!moov_recov_parse_minf (moovrf, trakrd))
-     return FALSE;
-+
-+  offset = ftell (moovrf->file);
-+  if (trakrd->mdia_size < offset - trakrd->mdia_file_offset)
-+    return FALSE;
-+
-   return TRUE;
- }
- 
-@@ -665,6 +740,8 @@ moov_recov_parse_trak (MoovRecovFile * moovrf, TrakRecovData * trakrd)
-   if (fourcc != FOURCC_trak) {
-     return FALSE;
-   }
-+  if (size < 8)
-+    return FALSE;
-   trakrd->trak_size = size;
- 
-   /* now we should have a trak header 'tkhd' */
-@@ -683,6 +760,9 @@ moov_recov_parse_trak (MoovRecovFile * moovrf, TrakRecovData * trakrd)
-     return FALSE;
- 
-   trakrd->extra_atoms_offset = ftell (moovrf->file);
-+  if (trakrd->trak_size < trakrd->extra_atoms_offset - offset)
-+    return FALSE;
-+
-   trakrd->extra_atoms_size = size - (trakrd->extra_atoms_offset - offset);
- 
-   trakrd->file_offset = offset;

SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-18298.patch

@@ -1,66 +0,0 @@
-From 6f1894e23e665cb538051f301a6318850e601c5a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Fri, 19 Jun 2026 13:20:04 +0300
-Subject: [PATCH] gdkpixbufdec: Handle format and resolution changes correctly
-
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5121
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043>
----
- ext/gdk_pixbuf/gstgdkpixbufdec.c | 31 ++++++++++++++++---------------
- 1 file changed, 16 insertions(+), 15 deletions(-)
-
-diff --git a/ext/gdk_pixbuf/gstgdkpixbufdec.c b/ext/gdk_pixbuf/gstgdkpixbufdec.c
-index c0ecb3a..4472e79 100644
---- a/ext/gdk_pixbuf/gstgdkpixbufdec.c
-+++ b/ext/gdk_pixbuf/gstgdkpixbufdec.c
-@@ -289,6 +289,7 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter)
-   gint width, height;
-   gint n_channels;
-   GstVideoFrame frame;
-+  GstVideoFormat fmt;
- 
-   pixbuf = gdk_pixbuf_loader_get_pixbuf (filter->pixbuf_loader);
-   if (pixbuf == NULL)
-@@ -297,26 +298,26 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDec * filter)
-   width = gdk_pixbuf_get_width (pixbuf);
-   height = gdk_pixbuf_get_height (pixbuf);
- 
--  if (GST_VIDEO_INFO_FORMAT (&filter->info) == GST_VIDEO_FORMAT_UNKNOWN) {
-+  n_channels = gdk_pixbuf_get_n_channels (pixbuf);
-+  switch (n_channels) {
-+    case 3:
-+      fmt = GST_VIDEO_FORMAT_RGB;
-+      break;
-+    case 4:
-+      fmt = GST_VIDEO_FORMAT_RGBA;
-+      break;
-+    default:
-+      goto channels_not_supported;
-+  }
-+
-+  if (GST_VIDEO_INFO_FORMAT (&filter->info) != fmt ||
-+      GST_VIDEO_INFO_WIDTH (&filter->info) != width ||
-+      GST_VIDEO_INFO_HEIGHT (&filter->info) != height) {
-     GstVideoInfo info;
--    GstVideoFormat fmt;
-     GList *l;
- 
-     GST_DEBUG ("Set size to %dx%d", width, height);
- 
--    n_channels = gdk_pixbuf_get_n_channels (pixbuf);
--    switch (n_channels) {
--      case 3:
--        fmt = GST_VIDEO_FORMAT_RGB;
--        break;
--      case 4:
--        fmt = GST_VIDEO_FORMAT_RGBA;
--        break;
--      default:
--        goto channels_not_supported;
--    }
--
--
-     gst_video_info_init (&info);
-     if (!gst_video_info_set_format (&info, fmt, width, height))
-       goto format_not_supported;

SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-18299.patch

@@ -1,111 +0,0 @@
-From bbd02aa9846afe23511f6da40d55ebf19297c1a1 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Fri, 19 Jun 2026 12:50:32 +0300
-Subject: [PATCH 1/3] rtpsbcdepay: Check for available data in the adapter
- before getting data
-
-Consider empty packets with the last flag as bad packets.
-
-Also reset buffers to NULL after giving away ownership of them to avoid
-returning an already freed buffer.
-
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5119
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042>
----
- gst/rtp/gstrtpsbcdepay.c | 29 ++++++++++++++++++-----------
- 1 file changed, 18 insertions(+), 11 deletions(-)
-
-diff --git a/gst/rtp/gstrtpsbcdepay.c b/gst/rtp/gstrtpsbcdepay.c
-index 9549bb0..8d416b0 100644
---- a/gst/rtp/gstrtpsbcdepay.c
-+++ b/gst/rtp/gstrtpsbcdepay.c
-@@ -324,19 +324,26 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp)
-     }
- 
-     gst_adapter_push (depay->adapter, data);
-+    data = NULL;
- 
-     if (last) {
--      gint framelen, samples;
--      guint8 header[4];
--
--      data = gst_adapter_take_buffer (depay->adapter,
--          gst_adapter_available (depay->adapter));
--      gst_rtp_drop_non_audio_meta (depay, data);
--
--      if (gst_buffer_extract (data, 0, &header, 4) != 4 ||
--          gst_rtp_sbc_depay_get_params (depay, header,
--              payload_len, &framelen, &samples) < 0) {
--        gst_buffer_unref (data);
-+      if (gst_adapter_available (depay->adapter)) {
-+        gint framelen, samples;
-+        guint8 header[4];
-+
-+        data = gst_adapter_take_buffer (depay->adapter,
-+            gst_adapter_available (depay->adapter));
-+        gst_rtp_drop_non_audio_meta (depay, data);
-+
-+        if (gst_buffer_extract (data, 0, &header, 4) != 4 ||
-+            gst_rtp_sbc_depay_get_params (depay, header,
-+                payload_len, &framelen, &samples) < 0) {
-+          gst_buffer_unref (data);
-+          data = NULL;
-+          goto bad_packet;
-+        }
-+      } else {
-+        data = NULL;
-         goto bad_packet;
-       }
-     } else {
-
-From c3fe759262470cb02cd098a488ac64cd27ace43f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Fri, 19 Jun 2026 12:55:34 +0300
-Subject: [PATCH 2/3] rtpsbcdepay: Check that enough data is available for the
- payload header
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042>
----
- gst/rtp/gstrtpsbcdepay.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/gst/rtp/gstrtpsbcdepay.c b/gst/rtp/gstrtpsbcdepay.c
-index 8d416b0..d9fd005 100644
---- a/gst/rtp/gstrtpsbcdepay.c
-+++ b/gst/rtp/gstrtpsbcdepay.c
-@@ -297,6 +297,8 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp)
- 
-   payload = gst_rtp_buffer_get_payload (rtp);
-   payload_len = gst_rtp_buffer_get_payload_len (rtp);
-+  if (payload_len < 1)
-+    goto bad_packet;
- 
-   fragment = payload[0] & 0x80;
-   start = payload[0] & 0x40;
-
-From 511581656f27df4251f05568718346a8d6bf775c Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Fri, 19 Jun 2026 13:00:27 +0300
-Subject: [PATCH 3/3] rtpsbcdepay: Remove wrong variable shadowing
-
-`samples` is expected to be set in the outer scope at a later time.
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042>
----
- gst/rtp/gstrtpsbcdepay.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/gst/rtp/gstrtpsbcdepay.c b/gst/rtp/gstrtpsbcdepay.c
-index d9fd005..280c41b 100644
---- a/gst/rtp/gstrtpsbcdepay.c
-+++ b/gst/rtp/gstrtpsbcdepay.c
-@@ -330,7 +330,7 @@ gst_rtp_sbc_depay_process (GstRTPBaseDepayload * base, GstRTPBuffer * rtp)
- 
-     if (last) {
-       if (gst_adapter_available (depay->adapter)) {
--        gint framelen, samples;
-+        gint framelen;
-         guint8 header[4];
- 
-         data = gst_adapter_take_buffer (depay->adapter,

SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-18649.patch

@@ -1,296 +0,0 @@
-From 07cbde0479905b968c54f6ca22999aa9b62bd653 Mon Sep 17 00:00:00 2001
-From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
-Date: Fri, 7 Aug 2026 14:34:04 +0000
-Subject: [PATCH] rtph264depay: rtph265depay: Limit the maximum fragmentation
- unit size
-
-Adds a max-fragmentation-unit-size property (default 32 MB) to both
-H.264 and H.265 RTP depayloaders. If a fragmentation unit exceeds
-this limit while being assembled, it is dropped and the depayloader
-state is reset to prevent excessive memory usage.
-
-Adapted from upstream commits:
-- 5cd490c125e04676659593b0f5b19130fc2face7
-- 820bd15585b13af8be9b0131699655194ae68a5b
-
-Fixes: CVE-2026-18649
----
- gst/rtp/gstrtph264depay.c | 79 ++++++++++++++++++++++++++++++++++++++-
- gst/rtp/gstrtph264depay.h |  2 +
- gst/rtp/gstrtph265depay.c | 75 +++++++++++++++++++++++++++++++++++++
- gst/rtp/gstrtph265depay.h |  2 +
- 4 files changed, 157 insertions(+), 1 deletion(-)
-
-diff --git a/gst/rtp/gstrtph264depay.c b/gst/rtp/gstrtph264depay.c
-index 275a9a0..625244f 100644
---- a/gst/rtp/gstrtph264depay.c
-+++ b/gst/rtp/gstrtph264depay.c
-@@ -38,6 +38,13 @@ GST_DEBUG_CATEGORY_STATIC (rtph264depay_debug);
-  * expressed a restriction or preference via caps */
- #define DEFAULT_BYTE_STREAM   TRUE
- #define DEFAULT_ACCESS_UNIT   FALSE
-+#define DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE (32 * 1024 * 1024)
-+
-+enum
-+{
-+  PROP_0,
-+  PROP_MAX_FRAGMENTATION_UNIT_SIZE,
-+};
- 
- /* 3 zero bytes syncword */
- static const guint8 sync_bytes[] = { 0, 0, 0, 1 };
-@@ -83,6 +90,10 @@ G_DEFINE_TYPE (GstRtpH264Depay, gst_rtp_h264_depay,
-     GST_TYPE_RTP_BASE_DEPAYLOAD);
- 
- static void gst_rtp_h264_depay_finalize (GObject * object);
-+static void gst_rtp_h264_depay_set_property (GObject * object, guint prop_id,
-+    const GValue * value, GParamSpec * pspec);
-+static void gst_rtp_h264_depay_get_property (GObject * object, guint prop_id,
-+    GValue * value, GParamSpec * pspec);
- 
- static GstStateChangeReturn gst_rtp_h264_depay_change_state (GstElement *
-     element, GstStateChange transition);
-@@ -111,6 +122,24 @@ gst_rtp_h264_depay_class_init (GstRtpH264DepayClass * klass)
-   gstrtpbasedepayload_class = (GstRTPBaseDepayloadClass *) klass;
- 
-   gobject_class->finalize = gst_rtp_h264_depay_finalize;
-+  gobject_class->set_property = gst_rtp_h264_depay_set_property;
-+  gobject_class->get_property = gst_rtp_h264_depay_get_property;
-+
-+  /**
-+   * GstRtpH264Depay:max-fragmentation-unit-size:
-+   *
-+   * Maximum size in bytes for a fragmentation unit. Larger units
-+   * will be dropped to prevent excessive memory usage.
-+   *
-+   * Use 0 for automatic.
-+   */
-+  g_object_class_install_property (gobject_class,
-+      PROP_MAX_FRAGMENTATION_UNIT_SIZE,
-+      g_param_spec_uint ("max-fragmentation-unit-size",
-+          "Max Fragmentation Unit Size",
-+          "Maximum size in bytes for a fragmentation unit (0 = auto)", 0,
-+          G_MAXUINT, DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE,
-+          G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
- 
-   gst_element_class_add_static_pad_template (gstelement_class,
-       &gst_rtp_h264_depay_src_template);
-@@ -128,6 +157,38 @@ gst_rtp_h264_depay_class_init (GstRtpH264DepayClass * klass)
-   gstrtpbasedepayload_class->handle_event = gst_rtp_h264_depay_handle_event;
- }
- 
-+static void
-+gst_rtp_h264_depay_set_property (GObject * object, guint prop_id,
-+    const GValue * value, GParamSpec * pspec)
-+{
-+  GstRtpH264Depay *self = GST_RTP_H264_DEPAY (object);
-+
-+  switch (prop_id) {
-+    case PROP_MAX_FRAGMENTATION_UNIT_SIZE:
-+      self->max_fragmentation_unit_size = g_value_get_uint (value);
-+      break;
-+    default:
-+      G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
-+      break;
-+  }
-+}
-+
-+static void
-+gst_rtp_h264_depay_get_property (GObject * object, guint prop_id,
-+    GValue * value, GParamSpec * pspec)
-+{
-+  GstRtpH264Depay *self = GST_RTP_H264_DEPAY (object);
-+
-+  switch (prop_id) {
-+    case PROP_MAX_FRAGMENTATION_UNIT_SIZE:
-+      g_value_set_uint (value, self->max_fragmentation_unit_size);
-+      break;
-+    default:
-+      G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
-+      break;
-+  }
-+}
-+
- static void
- gst_rtp_h264_depay_init (GstRtpH264Depay * rtph264depay)
- {
-@@ -139,6 +200,8 @@ gst_rtp_h264_depay_init (GstRtpH264Depay * rtph264depay)
-       (GDestroyNotify) gst_buffer_unref);
-   rtph264depay->pps = g_ptr_array_new_with_free_func (
-       (GDestroyNotify) gst_buffer_unref);
-+  rtph264depay->max_fragmentation_unit_size =
-+      DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE;
- }
- 
- static void
-@@ -1241,8 +1304,22 @@ gst_rtp_h264_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
-         rtph264depay->fu_marker = marker;
- 
-         /* if NAL unit ends, flush the adapter */
--        if (E)
-+        if (E) {
-           gst_rtp_h264_finish_fragmentation_unit (rtph264depay);
-+          GST_DEBUG_OBJECT (rtph264depay, "End of Fragmentation Unit");
-+        } else {
-+          guint limit = rtph264depay->max_fragmentation_unit_size ?
-+              rtph264depay->max_fragmentation_unit_size :
-+              DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE;
-+          if (gst_adapter_available (rtph264depay->adapter) > limit) {
-+            GST_WARNING_OBJECT (rtph264depay,
-+                "Too big (> %u bytes) fragmentation unit, dropping.", limit);
-+            rtph264depay->wait_start = TRUE;
-+            rtph264depay->current_fu_type = 0;
-+            gst_adapter_clear (rtph264depay->adapter);
-+            return NULL;
-+          }
-+        }
-         break;
-       }
-       default:
-diff --git a/gst/rtp/gstrtph264depay.h b/gst/rtp/gstrtph264depay.h
-index ba41312..a02a65d 100644
---- a/gst/rtp/gstrtph264depay.h
-+++ b/gst/rtp/gstrtph264depay.h
-@@ -62,6 +62,8 @@ struct _GstRtpH264Depay
-   GstClockTime fu_timestamp;
-   gboolean fu_marker;
- 
-+  guint max_fragmentation_unit_size;
-+
-   /* misc */
-   GPtrArray *sps;
-   GPtrArray *pps;
-diff --git a/gst/rtp/gstrtph265depay.c b/gst/rtp/gstrtph265depay.c
-index 551e08a..b046030 100644
---- a/gst/rtp/gstrtph265depay.c
-+++ b/gst/rtp/gstrtph265depay.c
-@@ -38,6 +38,13 @@ GST_DEBUG_CATEGORY_STATIC (rtph265depay_debug);
-  * expressed a restriction or preference via caps */
- #define DEFAULT_STREAM_FORMAT GST_H265_STREAM_FORMAT_BYTESTREAM
- #define DEFAULT_ACCESS_UNIT   FALSE
-+#define DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE (32 * 1024 * 1024)
-+
-+enum
-+{
-+  PROP_0,
-+  PROP_MAX_FRAGMENTATION_UNIT_SIZE,
-+};
- 
- /* 3 zero bytes syncword */
- static const guint8 sync_bytes[] = { 0, 0, 0, 1 };
-@@ -99,6 +106,10 @@ G_DEFINE_TYPE (GstRtpH265Depay, gst_rtp_h265_depay,
-     GST_TYPE_RTP_BASE_DEPAYLOAD);
- 
- static void gst_rtp_h265_depay_finalize (GObject * object);
-+static void gst_rtp_h265_depay_set_property (GObject * object, guint prop_id,
-+    const GValue * value, GParamSpec * pspec);
-+static void gst_rtp_h265_depay_get_property (GObject * object, guint prop_id,
-+    GValue * value, GParamSpec * pspec);
- 
- static GstStateChangeReturn gst_rtp_h265_depay_change_state (GstElement *
-     element, GstStateChange transition);
-@@ -128,6 +139,24 @@ gst_rtp_h265_depay_class_init (GstRtpH265DepayClass * klass)
-   gstrtpbasedepayload_class = (GstRTPBaseDepayloadClass *) klass;
- 
-   gobject_class->finalize = gst_rtp_h265_depay_finalize;
-+  gobject_class->set_property = gst_rtp_h265_depay_set_property;
-+  gobject_class->get_property = gst_rtp_h265_depay_get_property;
-+
-+  /**
-+   * GstRtpH265Depay:max-fragmentation-unit-size:
-+   *
-+   * Maximum size in bytes for a fragmentation unit. Larger units
-+   * will be dropped to prevent excessive memory usage.
-+   *
-+   * Use 0 for automatic.
-+   */
-+  g_object_class_install_property (gobject_class,
-+      PROP_MAX_FRAGMENTATION_UNIT_SIZE,
-+      g_param_spec_uint ("max-fragmentation-unit-size",
-+          "Max Fragmentation Unit Size",
-+          "Maximum size in bytes for a fragmentation unit (0 = auto)", 0,
-+          G_MAXUINT, DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE,
-+          G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS));
- 
-   gst_element_class_add_static_pad_template (gstelement_class,
-       &gst_rtp_h265_depay_src_template);
-@@ -145,6 +174,38 @@ gst_rtp_h265_depay_class_init (GstRtpH265DepayClass * klass)
-   gstrtpbasedepayload_class->handle_event = gst_rtp_h265_depay_handle_event;
- }
- 
-+static void
-+gst_rtp_h265_depay_set_property (GObject * object, guint prop_id,
-+    const GValue * value, GParamSpec * pspec)
-+{
-+  GstRtpH265Depay *self = GST_RTP_H265_DEPAY (object);
-+
-+  switch (prop_id) {
-+    case PROP_MAX_FRAGMENTATION_UNIT_SIZE:
-+      self->max_fragmentation_unit_size = g_value_get_uint (value);
-+      break;
-+    default:
-+      G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
-+      break;
-+  }
-+}
-+
-+static void
-+gst_rtp_h265_depay_get_property (GObject * object, guint prop_id,
-+    GValue * value, GParamSpec * pspec)
-+{
-+  GstRtpH265Depay *self = GST_RTP_H265_DEPAY (object);
-+
-+  switch (prop_id) {
-+    case PROP_MAX_FRAGMENTATION_UNIT_SIZE:
-+      g_value_set_uint (value, self->max_fragmentation_unit_size);
-+      break;
-+    default:
-+      G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
-+      break;
-+  }
-+}
-+
- static void
- gst_rtp_h265_depay_init (GstRtpH265Depay * rtph265depay)
- {
-@@ -161,6 +222,8 @@ gst_rtp_h265_depay_init (GstRtpH265Depay * rtph265depay)
-       (GDestroyNotify) gst_buffer_unref);
-   rtph265depay->pps = g_ptr_array_new_with_free_func (
-       (GDestroyNotify) gst_buffer_unref);
-+  rtph265depay->max_fragmentation_unit_size =
-+      DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE;
- }
- 
- static void
-@@ -1520,6 +1583,18 @@ gst_rtp_h265_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
-         if (E) {
-           gst_rtp_h265_finish_fragmentation_unit (rtph265depay);
-           GST_DEBUG_OBJECT (rtph265depay, "End of Fragmentation Unit");
-+        } else {
-+          guint limit = rtph265depay->max_fragmentation_unit_size ?
-+              rtph265depay->max_fragmentation_unit_size :
-+              DEFAULT_MAX_FRAGMENTATION_UNIT_SIZE;
-+          if (gst_adapter_available (rtph265depay->adapter) > limit) {
-+            GST_WARNING_OBJECT (rtph265depay,
-+                "Too big (> %u bytes) fragmentation unit, dropping.", limit);
-+            rtph265depay->wait_start = TRUE;
-+            rtph265depay->current_fu_type = 0;
-+            gst_adapter_clear (rtph265depay->adapter);
-+            return NULL;
-+          }
-         }
-         break;
-       }
-diff --git a/gst/rtp/gstrtph265depay.h b/gst/rtp/gstrtph265depay.h
-index cf17694..e851d3b 100644
---- a/gst/rtp/gstrtph265depay.h
-+++ b/gst/rtp/gstrtph265depay.h
-@@ -76,6 +76,8 @@ struct _GstRtpH265Depay
-   GstClockTime fu_timestamp;
-   gboolean fu_marker;
- 
-+  guint max_fragmentation_unit_size;
-+
-   /* misc */
-   GPtrArray *vps;
-   GPtrArray *sps;

SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-53705.patch

@@ -1,162 +0,0 @@
-From 558209ddcf3aad3603f5cb19d7267d1f9fa61f4a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Fri, 5 Jun 2026 11:24:21 +0300
-Subject: [PATCH 1/4] wavpackdec: Avoid integer overflow when calculating
- output buffer size
-
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5069
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811>
----
- ext/wavpack/gstwavpackdec.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/ext/wavpack/gstwavpackdec.c b/ext/wavpack/gstwavpackdec.c
-index 7cce543..96daeb0 100644
---- a/ext/wavpack/gstwavpackdec.c
-+++ b/ext/wavpack/gstwavpackdec.c
-@@ -279,6 +279,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
-   gboolean format_changed;
-   gint width, depth, i, j, max;
-   gint32 *dec_data = NULL;
-+  gsize dec_data_size;
-   guint8 *out_data;
-   GstMapInfo map, omap;
- 
-@@ -351,7 +352,11 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
-   }
- 
-   /* alloc output buffer */
--  dec_data = g_malloc (4 * wph.block_samples * dec->channels);
-+  dec_data_size = 4;
-+  if (!g_size_checked_mul (&dec_data_size, dec_data_size, wph.block_samples) ||
-+      !g_size_checked_mul (&dec_data_size, dec_data_size, dec->channels))
-+    goto invalid_header;
-+  dec_data = g_malloc (dec_data_size);
- 
-   /* decode */
-   decoded = WavpackUnpackSamples (dec->context, dec_data, wph.block_samples);
--- 
-2.52.0
-
-
-From 6d5f8cbf6cd7924131bfe3556167921782ab70c6 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Fri, 5 Jun 2026 11:24:25 +0300
-Subject: [PATCH 2/4] wavpackdec: Use correctly-sized variable types
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811>
----
- ext/wavpack/gstwavpackdec.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/ext/wavpack/gstwavpackdec.c b/ext/wavpack/gstwavpackdec.c
-index 96daeb0..f7798df 100644
---- a/ext/wavpack/gstwavpackdec.c
-+++ b/ext/wavpack/gstwavpackdec.c
-@@ -275,11 +275,11 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
-   GstBuffer *outbuf = NULL;
-   GstFlowReturn ret = GST_FLOW_OK;
-   WavpackHeader wph;
--  int32_t decoded, unpacked_size;
-   gboolean format_changed;
--  gint width, depth, i, j, max;
-+  gint width, depth, max;
-   gint32 *dec_data = NULL;
--  gsize dec_data_size;
-+  gsize i, j, dec_data_size, unpacked_size;
-+  uint32_t decoded;
-   guint8 *out_data;
-   GstMapInfo map, omap;
- 
--- 
-2.52.0
-
-
-From 5981e286114d83f963abdef5304ef3bbfe46f9d1 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Fri, 5 Jun 2026 11:24:29 +0300
-Subject: [PATCH 3/4] wavpackdec: Avoid integer overflow when checking input
- buffer size
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811>
----
- ext/wavpack/gstwavpackdec.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/ext/wavpack/gstwavpackdec.c b/ext/wavpack/gstwavpackdec.c
-index f7798df..bf28f38 100644
---- a/ext/wavpack/gstwavpackdec.c
-+++ b/ext/wavpack/gstwavpackdec.c
-@@ -296,7 +296,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
-   if (!gst_wavpack_read_header (&wph, map.data))
-     goto invalid_header;
- 
--  if (map.size < wph.ckSize + 4 * 1 + 4)
-+  if (map.size - 4 * 1 - 4 < wph.ckSize)
-     goto input_not_framed;
- 
-   if (!(wph.flags & INITIAL_BLOCK))
--- 
-2.52.0
-
-
-From 4cbfaa356e027111909d612a8ad828364241cafe Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Fri, 5 Jun 2026 11:24:33 +0300
-Subject: [PATCH 4/4] wavpackdec: Unmap input buffer directly after decoding
-
-In case of decoder errors we would otherwise unmap the buffer after
-finish_frame(), which potentially invalidates the input buffer already.
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811>
----
- ext/wavpack/gstwavpackdec.c | 8 +++++---
- 1 file changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/ext/wavpack/gstwavpackdec.c b/ext/wavpack/gstwavpackdec.c
-index bf28f38..3c9fa0f 100644
---- a/ext/wavpack/gstwavpackdec.c
-+++ b/ext/wavpack/gstwavpackdec.c
-@@ -280,6 +280,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
-   gint32 *dec_data = NULL;
-   gsize i, j, dec_data_size, unpacked_size;
-   uint32_t decoded;
-+  guint64 offset;
-   guint8 *out_data;
-   GstMapInfo map, omap;
- 
-@@ -357,9 +358,12 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
-       !g_size_checked_mul (&dec_data_size, dec_data_size, dec->channels))
-     goto invalid_header;
-   dec_data = g_malloc (dec_data_size);
-+  offset = GST_BUFFER_OFFSET (buf);
- 
-   /* decode */
-   decoded = WavpackUnpackSamples (dec->context, dec_data, wph.block_samples);
-+  gst_buffer_unmap (buf, &map);
-+  buf = NULL;
-   if (decoded != wph.block_samples)
-     goto decode_error;
- 
-@@ -367,7 +371,7 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
-   outbuf = gst_buffer_new_and_alloc (unpacked_size);
- 
-   /* legacy; pass along offset, whatever that might entail */
--  GST_BUFFER_OFFSET (outbuf) = GST_BUFFER_OFFSET (buf);
-+  GST_BUFFER_OFFSET (outbuf) = offset;
- 
-   gst_buffer_map (outbuf, &omap, GST_MAP_WRITE);
-   out_data = omap.data;
-@@ -412,8 +416,6 @@ gst_wavpack_dec_handle_frame (GstAudioDecoder * bdec, GstBuffer * buf)
-   }
- 
-   gst_buffer_unmap (outbuf, &omap);
--  gst_buffer_unmap (buf, &map);
--  buf = NULL;
- 
-   g_free (dec_data);
- 
--- 
-2.52.0
-

SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch

@@ -1,365 +0,0 @@
-From 901efd4d415752fc6b539bdebcb550c9345f6487 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Tue, 14 Jul 2026 12:00:34 +0300
-Subject: [PATCH 1/6] avidemux: Make sure enough data is available when parsing
- FUJIFILM strd
-
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
----
- gst/avi/gstavidemux.c | 23 +++++++++++++----------
- 1 file changed, 13 insertions(+), 10 deletions(-)
-
-diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
-index 834af76..4be47b2 100644
---- a/gst/avi/gstavidemux.c
-+++ b/gst/avi/gstavidemux.c
-@@ -3821,13 +3821,13 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
- 
-       ptr += 98;
-       left -= 98;
--      if (!memcmp (ptr, "FUJIFILM", 8)) {
-+      if (left >= 10 && !memcmp (ptr, "FUJIFILM", 8)) {
-         GST_MEMDUMP_OBJECT (avi, "fujifim tag", ptr, 48);
- 
-         ptr += 10;
-         left -= 10;
-         sub_size = 0;
--        while (ptr[sub_size] && sub_size < left)
-+        while (sub_size < left && ptr[sub_size])
-           sub_size++;
- 
-         if (avi->globaltags == NULL)
-@@ -3838,21 +3838,24 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
-         parse_tag_value (avi, avi->globaltags, GST_TAG_DEVICE_MODEL, ptr,
-             sub_size);
- 
--        while (ptr[sub_size] == '\0' && sub_size < left)
-+        while (sub_size < left && ptr[sub_size] == '\0')
-           sub_size++;
- 
-         ptr += sub_size;
-         left -= sub_size;
-         sub_size = 0;
--        while (ptr[sub_size] && sub_size < left)
-+        while (sub_size < left && ptr[sub_size])
-           sub_size++;
--        if (ptr[4] == ':')
--          ptr[4] = '-';
--        if (ptr[7] == ':')
--          ptr[7] = '-';
- 
--        parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
--            sub_size);
-+        if (sub_size >= 8) {
-+          if (ptr[4] == ':')
-+            ptr[4] = '-';
-+          if (ptr[7] == ':')
-+            ptr[7] = '-';
-+
-+          parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
-+              sub_size);
-+        }
-       }
-     }
-   }
-
-From 3f527d85b7280b020b328121ef4c0e62c333f79f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Tue, 14 Jul 2026 12:27:37 +0300
-Subject: [PATCH 2/6] avidemux: Don't modify read-only mapped buffer data
-
-And improve const-correctness in many places.
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
----
- gst/avi/gstavidemux.c | 59 ++++++++++++++++++++++++++++---------------
- 1 file changed, 38 insertions(+), 21 deletions(-)
-
-diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
-index 4be47b2..7a8957c 100644
---- a/gst/avi/gstavidemux.c
-+++ b/gst/avi/gstavidemux.c
-@@ -126,7 +126,7 @@ static void gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf);
- static void gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf);
- 
- static void parse_tag_value (GstAviDemux * avi, GstTagList * taglist,
--    const gchar * type, guint8 * ptr, guint tsize);
-+    const gchar * type, const guint8 * ptr, guint tsize);
- 
- /* GObject methods */
- 
-@@ -1238,7 +1238,7 @@ gst_avi_demux_parse_superindex (GstAviDemux * avi,
-     GstBuffer * buf, guint64 ** _indexes)
- {
-   GstMapInfo map;
--  guint8 *data;
-+  const guint8 *data;
-   guint16 bpe = 16;
-   guint32 num, i;
-   guint64 *indexes;
-@@ -1526,7 +1526,7 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream,
-     GstBuffer * buf)
- {
-   GstMapInfo map;
--  guint8 *data;
-+  const guint8 *data;
-   guint16 bpe;
-   guint32 num, i;
-   guint64 baseoff;
-@@ -1974,7 +1974,7 @@ gst_avi_demux_check_caps (GstAviDemux * avi, GstAviStream * stream,
-   /* some muxers put invalid bytestream stuff in h264 extra data */
-   val = gst_structure_get_value (s, "codec_data");
-   if (val && (buf = gst_value_get_buffer (val))) {
--    guint8 *data;
-+    const guint8 *data;
-     gint size;
-     GstMapInfo map;
- 
-@@ -2730,7 +2730,7 @@ gst_avi_demux_parse_index (GstAviDemux * avi, GstBuffer * buf)
- {
-   GstMapInfo map;
-   guint i, num, n;
--  gst_riff_index_entry *index;
-+  const gst_riff_index_entry *index;
-   GstClockTime stamp;
-   GstAviStream *stream;
-   GstAviIndexEntry entry;
-@@ -3714,7 +3714,7 @@ static void
- gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf)
- {
-   GstMapInfo map;
--  gchar *ptr;
-+  const gchar *ptr;
-   gsize left;
-   gchar *safedata = NULL;
- 
-@@ -3732,7 +3732,7 @@ gst_avi_demux_parse_idit (GstAviDemux * avi, GstBuffer * buf)
-    */
- 
-   /* skip eventual initial whitespace */
--  ptr = (gchar *) map.data;
-+  ptr = (const gchar *) map.data;
-   left = map.size;
- 
-   while (left > 0 && g_ascii_isspace (ptr[0])) {
-@@ -3769,7 +3769,7 @@ non_parsable:
- 
- static void
- parse_tag_value (GstAviDemux * avi, GstTagList * taglist, const gchar * type,
--    guint8 * ptr, guint tsize)
-+    const guint8 * ptr, guint tsize)
- {
-   static const gchar *env_vars[] = { "GST_AVI_TAG_ENCODING",
-     "GST_RIFF_TAG_ENCODING", "GST_TAG_ENCODING", NULL
-@@ -3809,7 +3809,7 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
- 
-   gst_buffer_map (buf, &map, GST_MAP_READ);
-   if (map.size > 4) {
--    guint8 *ptr = map.data;
-+    const guint8 *ptr = map.data;
-     gsize left = map.size;
- 
-     /* parsing based on
-@@ -3848,13 +3848,17 @@ gst_avi_demux_parse_strd (GstAviDemux * avi, GstBuffer * buf)
-           sub_size++;
- 
-         if (sub_size >= 8) {
--          if (ptr[4] == ':')
--            ptr[4] = '-';
--          if (ptr[7] == ':')
--            ptr[7] = '-';
-+          guint8 *ptr_dup = g_memdup2 (ptr, sub_size);
-+
-+          if (ptr_dup[4] == ':')
-+            ptr_dup[4] = '-';
-+          if (ptr_dup[7] == ':')
-+            ptr_dup[7] = '-';
- 
--          parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr,
-+          parse_tag_value (avi, avi->globaltags, GST_TAG_DATE_TIME, ptr_dup,
-               sub_size);
-+
-+          g_free (ptr_dup);
-         }
-       }
-     }
-@@ -3877,7 +3881,7 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf,
-     GstTagList ** _taglist)
- {
-   GstMapInfo info;
--  guint8 *ptr;
-+  const guint8 *ptr;
-   gsize left;
-   guint tsize;
-   guint32 tag;
-@@ -3946,14 +3950,27 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf,
-               type = GST_TAG_ENCODER;
-               break;
-             case 0x13:         /* CreationDate */
--              type = GST_TAG_DATE_TIME;
--              if (left > 7) {
--                if (ptr[4] == ':')
--                  ptr[4] = '-';
--                if (ptr[7] == ':')
--                  ptr[7] = '-';
-+            {
-+              type = NULL;
-+
-+              if (left > 7 && ptr[0] != '\0') {
-+                guint8 *ptr_dup = g_memdup2 (ptr, sub_size);
-+
-+                if (ptr_dup[4] == ':')
-+                  ptr_dup[4] = '-';
-+                if (ptr_dup[7] == ':')
-+                  ptr_dup[7] = '-';
-+
-+                GST_DEBUG_OBJECT (avi, "mapped tag %u to tag %s", sub_tag,
-+                    GST_TAG_DATE_TIME);
-+
-+                parse_tag_value (avi, taglist, GST_TAG_DATE_TIME, ptr_dup,
-+                    sub_size);
-+
-+                g_free (ptr_dup);
-               }
-               break;
-+            }
-             default:
-               type = NULL;
-               break;
-
-From 345735b66d7049991fb27a8f64ea1adfc9352e46 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Tue, 14 Jul 2026 12:29:14 +0300
-Subject: [PATCH 3/6] avidemux: Check that at least 1 byte is available before
- dereferencing tag pointer
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
----
- gst/avi/gstavidemux.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
-index 7a8957c..64a28d2 100644
---- a/gst/avi/gstavidemux.c
-+++ b/gst/avi/gstavidemux.c
-@@ -3975,7 +3975,7 @@ gst_avi_demux_parse_ncdt (GstAviDemux * avi, GstBuffer * buf,
-               type = NULL;
-               break;
-           }
--          if (type != NULL && ptr[0] != '\0') {
-+          if (type != NULL && left > 0 && ptr[0] != '\0') {
-             GST_DEBUG_OBJECT (avi, "mapped tag %u to tag %s", sub_tag, type);
- 
-             parse_tag_value (avi, taglist, type, ptr, sub_size);
-
-From a224a7a063ef1a53c1210c9c9bbfeb610d0d2253 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Tue, 14 Jul 2026 12:35:12 +0300
-Subject: [PATCH 4/6] avidemux: Use correct divisor for calculating available
- number of vprp field infos
-
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
----
- gst/avi/gstavidemux.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
-index 64a28d2..6a4bf7a 100644
---- a/gst/avi/gstavidemux.c
-+++ b/gst/avi/gstavidemux.c
-@@ -1805,7 +1805,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element,
- 
-   /* size checking */
-   /* calculate fields based on size */
--  k = (size - G_STRUCT_OFFSET (gst_riff_vprp, field_info)) / vprp->fields;
-+  k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
-+          field_info)) / sizeof (vprp->field_info[0]);
-   if (vprp->fields > k) {
-     GST_WARNING_OBJECT (element,
-         "vprp header indicated %d fields, only %d available", vprp->fields, k);
-
-From 6b063d86c99298cb8901a4134b82f7bcc84fa6a9 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Tue, 14 Jul 2026 13:22:04 +0300
-Subject: [PATCH 5/6] avidemux: Avoid integer overflow in bounds checks when
- parsing the index
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
----
- gst/avi/gstavidemux.c | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
-
-diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
-index 6a4bf7a..20fd207 100644
---- a/gst/avi/gstavidemux.c
-+++ b/gst/avi/gstavidemux.c
-@@ -1280,8 +1280,13 @@ gst_avi_demux_parse_superindex (GstAviDemux * avi,
- 
-   indexes = g_new (guint64, num + 1);
-   for (i = 0; i < num; i++) {
--    if (size < 24 + bpe * (i + 1))
-+    gsize required_size;
-+
-+    if (!g_size_checked_mul (&required_size, bpe, i + 1))
-+      break;
-+    if (size - 24 < required_size)
-       break;
-+
-     indexes[i] = GST_READ_UINT64_LE (&data[24 + bpe * i]);
-     GST_DEBUG_OBJECT (avi, "index %d at %" G_GUINT64_FORMAT, i, indexes[i]);
-   }
-@@ -1568,8 +1573,11 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream,
- 
-   for (i = 0; i < num; i++) {
-     GstAviIndexEntry entry;
-+    gsize required_size;
- 
--    if (map.size < 24 + bpe * (i + 1))
-+    if (!g_size_checked_mul (&required_size, bpe, i + 1))
-+      break;
-+    if (map.size - 24 < required_size)
-       break;
- 
-     /* fill in offset and size. offset contains the keyframe flag in the
-
-From a6ac7c3a64bce23d504f0b62313120ae1bfb08e2 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Tue, 14 Jul 2026 13:22:38 +0300
-Subject: [PATCH 6/6] avidemux: Don't read a subindex with too many items
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
----
- gst/avi/gstavidemux.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
-index 20fd207..4d3f608 100644
---- a/gst/avi/gstavidemux.c
-+++ b/gst/avi/gstavidemux.c
-@@ -1569,6 +1569,10 @@ gst_avi_demux_parse_subindex (GstAviDemux * avi, GstAviStream * stream,
-   if (num == 0)
-     goto empty_index;
- 
-+  /* this can't work out well ... */
-+  if (num > G_MAXUINT32 >> 1)
-+    goto invalid_params;
-+
-   GST_INFO_OBJECT (avi, "Parsing subindex, nr_entries = %6d", num);
- 
-   for (i = 0; i < num; i++) {
-@@ -1620,6 +1624,11 @@ not_implemented:
-     gst_buffer_unref (buf);
-     return FALSE;
-   }
-+invalid_params:
-+  {
-+    GST_ERROR_OBJECT (avi, "invalid subindex parameters (num = %d)", num);
-+    goto done;                  /* continue */
-+  }
- empty_index:
-   {
-     GST_DEBUG_OBJECT (avi, "the index is empty");

SOURCES/gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch

@@ -1,35 +0,0 @@
-From b3a928896a6a87897d9f42e2b10088eb0e13e418 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Tue, 14 Jul 2026 12:35:12 +0300
-Subject: [PATCH] avidemux: Use correct divisor for calculating available
- number of vprp field infos
-
-Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5213
-
-Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231>
-
-NOTE: The functional change in this patch (CVE-2026-73434) was already
-included in the CVE-2026-73433 patch (Patch11). This patch is adapted
-as a no-op for CVE tracking purposes.
----
- gst/avi/gstavidemux.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/gst/avi/gstavidemux.c b/gst/avi/gstavidemux.c
-index 4be47b2..dbe0d88 100644
---- a/gst/avi/gstavidemux.c
-+++ b/gst/avi/gstavidemux.c
-@@ -1822,8 +1822,8 @@ gst_avi_demux_riff_parse_vprp (GstElement * element,
- 
-   /* size checking */
-   /* calculate fields based on size */
--  k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
--          field_info)) / sizeof (vprp->field_info[0]);
-+  k = (size - G_STRUCT_OFFSET (gst_riff_vprp,
-+          field_info)) / sizeof (vprp->field_info[0]);
-   if (vprp->fields > k) {
-     GST_WARNING_OBJECT (element,
-         "vprp header indicated %d fields, only %d available", vprp->fields, k);
--- 
-2.43.0
-

SPECS/gstreamer1-plugins-good.spec

@@ -15,7 +15,7 @@
 
 Name:           gstreamer1-plugins-good
 Version:        1.16.1
-Release:        7%{?gitcommit:.git%{shortcommit}}%{?dist}.7
+Release:        4%{?gitcommit:.git%{shortcommit}}%{?dist}
 Summary:        GStreamer plugins with good code and licensing
 
 License:        LGPLv2+
@@ -29,39 +29,9 @@ Source0:        gst-plugins-good-%{version}.tar.xz
 Source0:        http://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-%{version}.tar.xz
 %endif
 
-Patch0:		0001-matroskademux-Fix-extraction-of-multichannel-WavPack.patch
-Patch1:		0002-matroskademux-Initialize-track-context-out-parameter.patch
-Patch2:		0003-flacparse-Avoid-integer-overflow-in-available-data-c.patch
-Patch3:		0004-qtdemux-Avoid-integer-overflow-when-parsing-Theora-e.patch
-Patch4:		0005-gdkpixbufdec-Check-if-initializing-the-video-info-ac.patch
-Patch5:		0006-matroskademux-Only-unmap-GstMapInfo-in-WavPack-heade.patch
-Patch6:		0007-matroskademux-Fix-off-by-one-when-parsing-multi-chan.patch
-Patch7:		0008-qtdemux-Fix-integer-overflow-when-allocating-the-sam.patch
-Patch8:		0009-qtdemux-Make-sure-only-an-even-number-of-bytes-is-pr.patch
-Patch9:         0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch
-# https://issues.redhat.com/browse/RHEL-184473
-# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11811
-Patch10:        gstreamer1-plugins-good-1.16.1-CVE-2026-53705.patch
-# https://issues.redhat.com/browse/RHEL-239068
-# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12231
-Patch11:        gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch
-# https://issues.redhat.com/browse/RHEL-224145
-# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12244
-Patch12:        gstreamer1-plugins-good-1.16.1-CVE-2026-18649.patch
-# https://issues.redhat.com/browse/RHEL-239048
-# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/0bcc6564c7deedc7d6d7373a2ab6479c9bf3889f
-Patch13:        gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch
-# https://issues.redhat.com/browse/RHEL-246549
-# https://issues.redhat.com/browse/RHEL-246382
-# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/93fa4cd30ba43b38b02a9de76a7a80dc198c87a0
-# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12041
-Patch14:        gstreamer1-plugins-good-1.16.1-CVE-2026-18296.patch
-# https://issues.redhat.com/browse/RHEL-246618
-# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042
-Patch15:        gstreamer1-plugins-good-1.16.1-CVE-2026-18299.patch
-# https://issues.redhat.com/browse/RHEL-246561
-# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/cf4f7cbc081cde7769862b424c105f10c083171b
-Patch16:        gstreamer1-plugins-good-1.16.1-CVE-2026-18298.patch
+Patch0:         d62cecf193d6bf3b16fe91d725f4514161f602c3.patch
+Patch1:         9efd93e20dd7789e4172ad6c8f4108271b3fb1ee.patch
+Patch2:		0001-flacparse-Avoid-integer-overflow-in-available-data-c.patch
 
 BuildRequires:  gcc
 BuildRequires:  gcc-c++
@@ -198,20 +168,6 @@ to be installed.
 %patch0 -p1
 %patch1 -p1
 %patch2 -p1
-%patch3 -p1
-%patch4 -p1
-%patch5 -p1
-%patch6 -p1
-%patch7 -p1
-%patch8 -p1
-%patch9 -p1
-%patch10 -p1
-%patch11 -p1
-%patch12 -p1
-%patch13 -p1
-%patch14 -p1
-%patch15 -p1
-%patch16 -p1
 
 %build
 %configure --disable-silent-rules --disable-fatal-warnings \
@@ -396,49 +352,6 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 
 
 %changelog
-* Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.7
-- Fix CVE-2026-18296: heap buffer overflow in qtmoovrecover
-  Resolves: RHEL-246382
-
-* Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.6
-- Fix CVE-2026-18298: heap buffer overflow in GdkPixbuf image decoder
-  Resolves: RHEL-246561
-
-* Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.5
-- Fix CVE-2026-18299: Use-After-Free in rtpsbcdepay
-  Resolves: RHEL-246618
-
-* Sat Aug 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.4
-- Fix CVE-2026-18296: validate box sizes and versions in
-  qtmoovrecover (atomsrecovery)
-  Resolves: RHEL-246549
-
-* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.3
-- Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling
-  Resolves: RHEL-239048
-
-* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.2
-- Fix CVE-2026-18649 in H.264/H.265 RTP depayloaders
-  Resolves: RHEL-224145
-
-* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7.1
-- Fix multiple security issues in AVI demuxer (CVE-2026-73433)
-  Resolves: RHEL-239068
-
-* Fri Jun 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-7
-- Fix integer overflow vulnerabilities in wavpackdec (CVE-2026-53705)
-  Resolves: RHEL-184473
-
-* Tue Mar 31 2026 Wim Taymans <wtaymans@redhat.com> - 1.16.1-6
-- Add patch for CVE-2026-3083 and CVE-2026-3085
-  Resolves: RHEL-156183, RHEL-156153
-
-* Mon Dec 16 2024 Wim Taymans <wtaymans@redhat.com> - 1.16.1-5
-- CVE-2024-47537, CVE-2024-47539, CVE-2024-47540, CVE-2024-47606,
-  CVE-2024-47613
-  Resolves: RHEL-70949, RHEL-70962, RHEL-70936, RHEL-71022
-  Resolves: RHEL-70998
-
 * Wed Jan 17 2024 Wim Taymans <wtaymans@redhat.com> - 1.16.1-4
 - CVE-2023-37327: integer overflow leading to heap overwrite in
   FLAC image tag handling