Fix OOB reads in realmedia demuxer (CVE-2026-53703, CVE-2026-53704)

Backport upstream MR !11832 (7 commits) from the GStreamer 1.24
branch to gstreamer1-plugins-ugly-free 1.22.12. The fixes address
integer overflow and out-of-bounds read issues in the realmedia
demuxer (rmdemux, rmutils, rademux), covering both CVE-2026-53703
and CVE-2026-53704.

CVE: CVE-2026-53703
CVE: CVE-2026-53704
Upstream patches:
 - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11832.patch
Resolves: RHEL-184437
Resolves: RHEL-184465

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir

gstreamer1-plugins-ugly-free.spec

@@ -13,7 +13,7 @@
 
 Name:           gstreamer1-plugins-ugly-free
 Version:        1.22.12
-Release:        6%{?dist}
+Release:        7%{?dist}
 Summary:        GStreamer streaming media framework "ugly" plugins
 
 License:        LGPL-2.0-or-later AND LGPL-2.1-or-later AND CC0-1.0
@@ -29,6 +29,8 @@ Source0:        https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugi
 Patch:          0001-asfdemux-Error-out-on-files-with-more-than-32-stream.patch
 Patch:          0002-rmdemux-Check-if-new-video-fragment-overflows-the-fr.patch
 Patch:          0003-rmdemux-Avoid-integer-overflow-when-checking-if-enou.patch
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11832
+Patch:          0004-CVE-2026-53704.patch
 
 BuildRequires:	meson >= 0.48.0
 BuildRequires:	gcc
@@ -168,6 +170,9 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 %endif
 
 %changelog
+* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-7
+- Fix OOB reads in the realmedia demuxer (CVE-2026-53703, CVE-2026-53704)
+
 * Tue Mar 31 2026 Veronika Kabatova <vkabatov@redhat.com> - 1.22.12-6
 - Rebuild to fix missing binaries due to buildsystem oversight