public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Sandro Mani <manisandro@gmail.com>
To: git-commits@fedoraproject.org
Subject: [rpms/mingw-gstreamer1-plugins-good] f43: Backport fix for CVE-2026-5056
Date: Sun, 02 Aug 2026 10:33:29 GMT [thread overview]
Message-ID: <178566680909.1.416714150360389572.rpms-mingw-gstreamer1-plugins-good-2c42bbce9a46@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/mingw-gstreamer1-plugins-good
Branch : f43
Commit : 2c42bbce9a46aa11d2e2f740b232e186db762ac6
Author : Sandro Mani <manisandro@gmail.com>
Date : 2026-08-02T12:33:15+02:00
Stats : +92/-4 in 3 file(s)
URL : https://src.fedoraproject.org/rpms/mingw-gstreamer1-plugins-good/c/2c42bbce9a46aa11d2e2f740b232e186db762ac6?branch=f43
Log:
Backport fix for CVE-2026-5056
---
diff --git a/CVE-2026-3083_3085.patch b/CVE-2026-3083_3085.patch
index 62c7ca8..c007c99 100644
--- a/CVE-2026-3083_3085.patch
+++ b/CVE-2026-3083_3085.patch
@@ -1,6 +1,6 @@
diff -rupN --no-dereference gst-plugins-good-1.26.11/docs/gst_plugins_cache.json gst-plugins-good-1.26.11-new/docs/gst_plugins_cache.json
--- gst-plugins-good-1.26.11/docs/gst_plugins_cache.json 2026-03-10 14:08:25.000000000 +0100
-+++ gst-plugins-good-1.26.11-new/docs/gst_plugins_cache.json 2026-03-27 19:42:35.547507509 +0100
++++ gst-plugins-good-1.26.11-new/docs/gst_plugins_cache.json 2026-08-02 12:32:54.257402391 +0200
@@ -16809,34 +16809,6 @@
"properties": {},
"rank": "secondary"
@@ -38,7 +38,7 @@ diff -rupN --no-dereference gst-plugins-good-1.26.11/docs/gst_plugins_cache.json
"description": "Decode Redundant Audio Data (RED)",
diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/rtp/gstrtp.c gst-plugins-good-1.26.11-new/gst/rtp/gstrtp.c
--- gst-plugins-good-1.26.11/gst/rtp/gstrtp.c 2026-03-10 14:08:25.000000000 +0100
-+++ gst-plugins-good-1.26.11-new/gst/rtp/gstrtp.c 2026-03-27 19:42:35.548623650 +0100
++++ gst-plugins-good-1.26.11-new/gst/rtp/gstrtp.c 2026-08-02 12:32:54.259293713 +0200
@@ -101,7 +101,6 @@ plugin_init (GstPlugin * plugin)
ret |= GST_ELEMENT_REGISTER (rtpmp4gdepay, plugin);
ret |= GST_ELEMENT_REGISTER (rtpmp4gpay, plugin);
@@ -574,7 +574,7 @@ diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/rtp/gstrtpqdmdepay.h gs
-#endif /* __GST_RTP_QDM2_DEPAY_H__ */
diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/rtp/meson.build gst-plugins-good-1.26.11-new/gst/rtp/meson.build
--- gst-plugins-good-1.26.11/gst/rtp/meson.build 2026-03-10 14:08:25.000000000 +0100
-+++ gst-plugins-good-1.26.11-new/gst/rtp/meson.build 2026-03-27 19:42:35.549356393 +0100
++++ gst-plugins-good-1.26.11-new/gst/rtp/meson.build 2026-08-02 12:32:54.259974976 +0200
@@ -76,7 +76,6 @@ rtp_sources = [
'gstrtpmp4adepay.c',
'gstrtpmp4apay.c',
diff --git a/CVE-2026-5056.patch b/CVE-2026-5056.patch
new file mode 100644
index 0000000..ebcbce0
--- /dev/null
+++ b/CVE-2026-5056.patch
@@ -0,0 +1,82 @@
+diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/isomp4/qtdemux.c gst-plugins-good-1.26.11-new/gst/isomp4/qtdemux.c
+--- gst-plugins-good-1.26.11/gst/isomp4/qtdemux.c 2026-03-10 14:08:25.000000000 +0100
++++ gst-plugins-good-1.26.11-new/gst/isomp4/qtdemux.c 2026-08-02 12:32:54.389401227 +0200
+@@ -12160,6 +12160,14 @@ qtdemux_parse_cmpd (GstQTDemux * qtdemux
+
+ cmpd->component_count = gst_byte_reader_get_uint32_be_unchecked (reader);
+
++ /* Let's use 16 as a upper bound here for now to avoid overflows and
++ * allocating lots of memory */
++ if (cmpd->component_count > 16) {
++ GST_ERROR_OBJECT (qtdemux, "Unsupported number of cmpd components %u",
++ cmpd->component_count);
++ goto error;
++ }
++
+ guint32 minimum_size = cmpd->component_count * 2 + 4; // assuming type_uris are not used
+ if (gst_byte_reader_get_size (reader) < minimum_size) {
+ GST_ERROR_OBJECT (qtdemux, "cmpd size is too short");
+@@ -12218,6 +12226,14 @@ qtdemux_parse_uncC (GstQTDemux * qtdemux
+ goto error;
+ }
+
++ /* Let's use 16 as a upper bound here for now to avoid overflows and
++ * allocating lots of memory */
++ if (uncC->component_count > 16) {
++ GST_ERROR_OBJECT (qtdemux, "Unsupported number of uncC components %u",
++ uncC->component_count);
++ goto error;
++ }
++
+ guint32 expected_size = uncC->component_count * 5 + 36;
+ if (gst_byte_reader_get_size (reader) != expected_size) {
+ GST_ERROR_OBJECT (qtdemux, "uncC size is incorrect");
+@@ -12471,7 +12487,6 @@ qtdemux_get_format_from_uncv (GstQTDemux
+ guint32 num_components = uncC->component_count;
+ guint16 component_types[4];
+
+-
+ if (uncC->version == 1) {
+ // Determine format with profile
+ // The only permitted profiles for version 1 are `rgb3`, `rgba`, and `abgr`
+@@ -12499,6 +12514,11 @@ qtdemux_get_format_from_uncv (GstQTDemux
+ goto unsupported_feature;
+ }
+
++ if (num_components > 4 || num_components == 0) {
++ GST_WARNING_OBJECT (qtdemux,
++ "Unsupported number of components for uncC: %u", num_components);
++ goto unsupported_feature;
++ }
+
+ /* Assert that components are similar */
+ UncompressedFrameConfigComponent *first_comp = &uncC->components[0];
+@@ -12540,6 +12560,11 @@ qtdemux_get_format_from_uncv (GstQTDemux
+ // Get Component Types
+ for (guint32 i = 0; i < num_components; i++) {
+ guint16 component_index = uncC->components[i].index;
++ if (component_index >= cmpd->component_count) {
++ GST_WARNING_OBJECT (qtdemux,
++ "Invalid component index %u for component %u", component_index, i);
++ goto unsupported_feature;
++ }
+ component_types[i] = cmpd->types[component_index];
+ }
+
+@@ -18961,10 +18986,12 @@ qtdemux_video_caps (GstQTDemux * qtdemux
+ }
+
+ format = qtdemux_get_format_from_uncv (qtdemux, &uncC, &cmpd);
+- gst_video_info_set_format (&stream->pre_info, format, entry->width,
+- entry->height);
+- qtdemux_set_info_from_uncv (qtdemux, entry, &uncC, &stream->pre_info);
+- stream->alignment = 32;
++ if (format != GST_VIDEO_FORMAT_UNKNOWN) {
++ gst_video_info_set_format (&stream->pre_info, format, entry->width,
++ entry->height);
++ qtdemux_set_info_from_uncv (qtdemux, entry, &uncC, &stream->pre_info);
++ stream->alignment = 32;
++ }
+
+ /* Free Memory */
+ qtdemux_clear_uncC (&uncC);
diff --git a/mingw-gstreamer1-plugins-good.spec b/mingw-gstreamer1-plugins-good.spec
index 66c19c3..87cd05e 100644
--- a/mingw-gstreamer1-plugins-good.spec
+++ b/mingw-gstreamer1-plugins-good.spec
@@ -4,7 +4,7 @@
Name: mingw-gstreamer1-plugins-good
Version: 1.26.11
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: Cross compiled GStreamer1 plug-ins good
License: LGPL-2.0-or-later
@@ -13,6 +13,9 @@ Source: http://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugin
# Backport fix for CVE-2026-3083, CVE-2026-3085
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8349cdd35f85246e113b18e55fd11abf9cb248bf
Patch0: CVE-2026-3083_3085.patch
+# Backport fix for CVE-2026-5056
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/bad6721ca4901123e5cb57eec9d8e84d69c08597
+Patch1: CVE-2026-5056.patch
BuildArch: noarch
@@ -280,6 +283,9 @@ rm -rf %{buildroot}%{mingw64_libdir}/gstreamer-%{api_version}/*.dll.a
%changelog
+* Sun Aug 02 2026 Sandro Mani <manisandro@gmail.com> - 1.26.11-2
+- Backport fix for CVE-2026-5056
+
* Fri Mar 27 2026 Sandro Mani <manisandro@gmail.com> - 1.26.11-1
- Update to 1.26.11
- Backport fix for CVE-2026-3083, CVE-2026-3085
reply other threads:[~2026-08-02 10:33 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178566680909.1.416714150360389572.rpms-mingw-gstreamer1-plugins-good-2c42bbce9a46@fedoraproject.org \
--to=manisandro@gmail.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox