[rpms/mingw-gstreamer1-plugins-good] f43: Backport fix for CVE-2026-5056

[rpms/mingw-gstreamer1-plugins-good] f43: Backport fix for CVE-2026-5056

[Sandro Mani]

A new commit has been pushed.

Repo   : rpms/mingw-gstreamer1-plugins-good
Branch : f43
Commit : 2c42bbce9a46aa11d2e2f740b232e186db762ac6
Author : Sandro Mani <manisandro@gmail.com>
Date   : 2026-08-02T12:33:15+02:00
Stats  : +92/-4 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/mingw-gstreamer1-plugins-good/c/2c42bbce9a46aa11d2e2f740b232e186db762ac6?branch=f43

Log:
Backport fix for CVE-2026-5056

---
diff --git a/CVE-2026-3083_3085.patch b/CVE-2026-3083_3085.patch
index 62c7ca8..c007c99 100644
--- a/CVE-2026-3083_3085.patch
+++ b/CVE-2026-3083_3085.patch
@@ -1,6 +1,6 @@
 diff -rupN --no-dereference gst-plugins-good-1.26.11/docs/gst_plugins_cache.json gst-plugins-good-1.26.11-new/docs/gst_plugins_cache.json
 --- gst-plugins-good-1.26.11/docs/gst_plugins_cache.json	2026-03-10 14:08:25.000000000 +0100
-+++ gst-plugins-good-1.26.11-new/docs/gst_plugins_cache.json	2026-03-27 19:42:35.547507509 +0100
++++ gst-plugins-good-1.26.11-new/docs/gst_plugins_cache.json	2026-08-02 12:32:54.257402391 +0200
 @@ -16809,34 +16809,6 @@
                  "properties": {},
                  "rank": "secondary"
@@ -38,7 +38,7 @@ diff -rupN --no-dereference gst-plugins-good-1.26.11/docs/gst_plugins_cache.json
                  "description": "Decode Redundant Audio Data (RED)",
 diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/rtp/gstrtp.c gst-plugins-good-1.26.11-new/gst/rtp/gstrtp.c
 --- gst-plugins-good-1.26.11/gst/rtp/gstrtp.c	2026-03-10 14:08:25.000000000 +0100
-+++ gst-plugins-good-1.26.11-new/gst/rtp/gstrtp.c	2026-03-27 19:42:35.548623650 +0100
++++ gst-plugins-good-1.26.11-new/gst/rtp/gstrtp.c	2026-08-02 12:32:54.259293713 +0200
 @@ -101,7 +101,6 @@ plugin_init (GstPlugin * plugin)
    ret |= GST_ELEMENT_REGISTER (rtpmp4gdepay, plugin);
    ret |= GST_ELEMENT_REGISTER (rtpmp4gpay, plugin);
@@ -574,7 +574,7 @@ diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/rtp/gstrtpqdmdepay.h gs
 -#endif /* __GST_RTP_QDM2_DEPAY_H__ */
 diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/rtp/meson.build gst-plugins-good-1.26.11-new/gst/rtp/meson.build
 --- gst-plugins-good-1.26.11/gst/rtp/meson.build	2026-03-10 14:08:25.000000000 +0100
-+++ gst-plugins-good-1.26.11-new/gst/rtp/meson.build	2026-03-27 19:42:35.549356393 +0100
++++ gst-plugins-good-1.26.11-new/gst/rtp/meson.build	2026-08-02 12:32:54.259974976 +0200
 @@ -76,7 +76,6 @@ rtp_sources = [
    'gstrtpmp4adepay.c',
    'gstrtpmp4apay.c',

diff --git a/CVE-2026-5056.patch b/CVE-2026-5056.patch
new file mode 100644
index 0000000..ebcbce0
--- /dev/null
+++ b/CVE-2026-5056.patch
@@ -0,0 +1,82 @@
+diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/isomp4/qtdemux.c gst-plugins-good-1.26.11-new/gst/isomp4/qtdemux.c
+--- gst-plugins-good-1.26.11/gst/isomp4/qtdemux.c	2026-03-10 14:08:25.000000000 +0100
++++ gst-plugins-good-1.26.11-new/gst/isomp4/qtdemux.c	2026-08-02 12:32:54.389401227 +0200
+@@ -12160,6 +12160,14 @@ qtdemux_parse_cmpd (GstQTDemux * qtdemux
+ 
+   cmpd->component_count = gst_byte_reader_get_uint32_be_unchecked (reader);
+ 
++  /* Let's use 16 as a upper bound here for now to avoid overflows and
++   * allocating lots of memory */
++  if (cmpd->component_count > 16) {
++    GST_ERROR_OBJECT (qtdemux, "Unsupported number of cmpd components %u",
++        cmpd->component_count);
++    goto error;
++  }
++
+   guint32 minimum_size = cmpd->component_count * 2 + 4; // assuming type_uris are not used
+   if (gst_byte_reader_get_size (reader) < minimum_size) {
+     GST_ERROR_OBJECT (qtdemux, "cmpd size is too short");
+@@ -12218,6 +12226,14 @@ qtdemux_parse_uncC (GstQTDemux * qtdemux
+     goto error;
+   }
+ 
++  /* Let's use 16 as a upper bound here for now to avoid overflows and
++   * allocating lots of memory */
++  if (uncC->component_count > 16) {
++    GST_ERROR_OBJECT (qtdemux, "Unsupported number of uncC components %u",
++        uncC->component_count);
++    goto error;
++  }
++
+   guint32 expected_size = uncC->component_count * 5 + 36;
+   if (gst_byte_reader_get_size (reader) != expected_size) {
+     GST_ERROR_OBJECT (qtdemux, "uncC size is incorrect");
+@@ -12471,7 +12487,6 @@ qtdemux_get_format_from_uncv (GstQTDemux
+   guint32 num_components = uncC->component_count;
+   guint16 component_types[4];
+ 
+-
+   if (uncC->version == 1) {
+     // Determine format with profile
+     // The only permitted profiles for version 1 are `rgb3`, `rgba`, and `abgr`
+@@ -12499,6 +12514,11 @@ qtdemux_get_format_from_uncv (GstQTDemux
+     goto unsupported_feature;
+   }
+ 
++  if (num_components > 4 || num_components == 0) {
++    GST_WARNING_OBJECT (qtdemux,
++        "Unsupported number of components for uncC: %u", num_components);
++    goto unsupported_feature;
++  }
+ 
+   /* Assert that components are similar */
+   UncompressedFrameConfigComponent *first_comp = &uncC->components[0];
+@@ -12540,6 +12560,11 @@ qtdemux_get_format_from_uncv (GstQTDemux
+   // Get Component Types
+   for (guint32 i = 0; i < num_components; i++) {
+     guint16 component_index = uncC->components[i].index;
++    if (component_index >= cmpd->component_count) {
++      GST_WARNING_OBJECT (qtdemux,
++          "Invalid component index %u for component %u", component_index, i);
++      goto unsupported_feature;
++    }
+     component_types[i] = cmpd->types[component_index];
+   }
+ 
+@@ -18961,10 +18986,12 @@ qtdemux_video_caps (GstQTDemux * qtdemux
+       }
+ 
+       format = qtdemux_get_format_from_uncv (qtdemux, &uncC, &cmpd);
+-      gst_video_info_set_format (&stream->pre_info, format, entry->width,
+-          entry->height);
+-      qtdemux_set_info_from_uncv (qtdemux, entry, &uncC, &stream->pre_info);
+-      stream->alignment = 32;
++      if (format != GST_VIDEO_FORMAT_UNKNOWN) {
++        gst_video_info_set_format (&stream->pre_info, format, entry->width,
++            entry->height);
++        qtdemux_set_info_from_uncv (qtdemux, entry, &uncC, &stream->pre_info);
++        stream->alignment = 32;
++      }
+ 
+       /* Free Memory */
+       qtdemux_clear_uncC (&uncC);

diff --git a/mingw-gstreamer1-plugins-good.spec b/mingw-gstreamer1-plugins-good.spec
index 66c19c3..87cd05e 100644
--- a/mingw-gstreamer1-plugins-good.spec
+++ b/mingw-gstreamer1-plugins-good.spec
@@ -4,7 +4,7 @@
 
 Name:           mingw-gstreamer1-plugins-good
 Version:        1.26.11
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Cross compiled GStreamer1 plug-ins good
 
 License:        LGPL-2.0-or-later
@@ -13,6 +13,9 @@ Source:         http://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugin
 # Backport fix for CVE-2026-3083, CVE-2026-3085
 # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8349cdd35f85246e113b18e55fd11abf9cb248bf
 Patch0:         CVE-2026-3083_3085.patch
+# Backport fix for CVE-2026-5056
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/bad6721ca4901123e5cb57eec9d8e84d69c08597
+Patch1:         CVE-2026-5056.patch
 
 BuildArch:      noarch
 
@@ -280,6 +283,9 @@ rm -rf %{buildroot}%{mingw64_libdir}/gstreamer-%{api_version}/*.dll.a
 
 
 %changelog
+* Sun Aug 02 2026 Sandro Mani <manisandro@gmail.com> - 1.26.11-2
+- Backport fix for CVE-2026-5056
+
 * Fri Mar 27 2026 Sandro Mani <manisandro@gmail.com> - 1.26.11-1
 - Update to 1.26.11
 - Backport fix for CVE-2026-3083, CVE-2026-3085