GStreamer plugins with good code and licensing
8970e129a7
RHEL-246869: the CVE-2026-73433 backport (Patch11) introduces two calls to g_memdup2() in gst/avi/gstavidemux.c (gst_avi_demux_parse_strd and gst_avi_demux_parse_ncdt). g_memdup2() was only added in GLib 2.68; RHEL 8 ships GLib 2.56.4. Since GStreamer elements are dlopen-loaded plugins, the missing symbol does not fail the build -- it fails at plugin load time with 'undefined symbol: g_memdup2', silently disabling the entire avi plugin (avidemux/avimux). There is no upstream commit to backport for this: upstream's own gst/glib-compat-private.h already provides this exact fallback macro for builds against GLib < 2.67.4 (see commit b16e96dd87 in the gstreamer monorepo), and meson wires it into config.h automatically. That mechanism doesn't exist in this 1.16.1 autotools-based tree, so add the same macro directly to gstavidemux.c ahead of its first use, as an additional hunk appended to the existing CVE-2026-73433 patch. This follows Option A from the Jira discussion (preferred by both the Ymir triage agent and Wim Taymans), matching the exact mechanism GStreamer itself uses rather than replacing g_memdup2 with a plain g_memdup call. Verified: applying the modified patch with "patch -p1" against a pristine gst-plugins-good-1.16.1 source tree succeeds cleanly (exit 0, no .rej files), with the compat macro defined before both g_memdup2 call sites. Resolves: RHEL-246869 |
||
|---|---|---|
| .gitignore | ||
| 0001-matroskademux-Fix-extraction-of-multichannel-WavPack.patch | ||
| 0001-rtpqdm2depay-error-out-if-anyone-tries-to-use-this-e.patch | ||
| 0002-matroskademux-Initialize-track-context-out-parameter.patch | ||
| 0003-flacparse-Avoid-integer-overflow-in-available-data-c.patch | ||
| 0004-qtdemux-Avoid-integer-overflow-when-parsing-Theora-e.patch | ||
| 0005-gdkpixbufdec-Check-if-initializing-the-video-info-ac.patch | ||
| 0006-matroskademux-Only-unmap-GstMapInfo-in-WavPack-heade.patch | ||
| 0007-matroskademux-Fix-off-by-one-when-parsing-multi-chan.patch | ||
| 0008-qtdemux-Fix-integer-overflow-when-allocating-the-sam.patch | ||
| 0009-qtdemux-Make-sure-only-an-even-number-of-bytes-is-pr.patch | ||
| gating.yaml | ||
| gstreamer1-plugins-good-1.16.1-CVE-2026-18296.patch | ||
| gstreamer1-plugins-good-1.16.1-CVE-2026-18298.patch | ||
| gstreamer1-plugins-good-1.16.1-CVE-2026-18299.patch | ||
| gstreamer1-plugins-good-1.16.1-CVE-2026-18649.patch | ||
| gstreamer1-plugins-good-1.16.1-CVE-2026-53705.patch | ||
| gstreamer1-plugins-good-1.16.1-CVE-2026-73433.patch | ||
| gstreamer1-plugins-good-1.16.1-CVE-2026-73434.patch | ||
| gstreamer1-plugins-good-1.16.1-RHEL-246382.patch | ||
| gstreamer1-plugins-good.spec | ||
| sources | ||