public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/mingw-gstreamer1-plugins-good] f43: Backport fixes for CVE-2026-18295 CVE-2026-18296 CVE-2026-18299 CVE-2026-18298
@ 2026-08-25 21:26 Sandro Mani
0 siblings, 0 replies; only message in thread
From: Sandro Mani @ 2026-08-25 21:26 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/mingw-gstreamer1-plugins-good
Branch : f43
Commit : aebe1ee905387d05f103927abc12bc521b60b443
Author : Sandro Mani <manisandro@gmail.com>
Date : 2026-08-25T23:26:27+02:00
Stats : +385/-5 in 6 file(s)
URL : https://src.fedoraproject.org/rpms/mingw-gstreamer1-plugins-good/c/aebe1ee905387d05f103927abc12bc521b60b443?branch=f43
Log:
Backport fixes for CVE-2026-18295 CVE-2026-18296 CVE-2026-18299 CVE-2026-18298
---
diff --git a/CVE-2026-18295.patch b/CVE-2026-18295.patch
new file mode 100644
index 0000000..5a6d151
--- /dev/null
+++ b/CVE-2026-18295.patch
@@ -0,0 +1,243 @@
+diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/isomp4/atomsrecovery.c gst-plugins-good-1.26.11-new/gst/isomp4/atomsrecovery.c
+--- gst-plugins-good-1.26.11/gst/isomp4/atomsrecovery.c 2026-03-10 14:08:25.000000000 +0100
++++ gst-plugins-good-1.26.11-new/gst/isomp4/atomsrecovery.c 2026-08-25 23:18:14.255458134 +0200
+@@ -283,6 +283,8 @@ moov_recov_file_parse_prefix (MoovRecovF
+ if (!read_atom_header (moovrf->file, &fourcc, &size)) {
+ return FALSE;
+ }
++ if (size < 8)
++ return FALSE;
+
+ if (fourcc != FOURCC_ftyp) {
+ /* we might have a prefix here */
+@@ -294,6 +296,8 @@ moov_recov_file_parse_prefix (MoovRecovF
+ /* now read the ftyp */
+ if (!read_atom_header (moovrf->file, &fourcc, &size))
+ return FALSE;
++ if (size < 8)
++ return FALSE;
+ }
+
+ /* this has to be the ftyp */
+@@ -315,12 +319,25 @@ moov_recov_file_parse_mvhd (MoovRecovFil
+ /* check for sanity */
+ if (fourcc != FOURCC_mvhd)
+ return FALSE;
++ if (size < 8)
++ return FALSE;
+
+ moovrf->mvhd_size = size;
+ moovrf->mvhd_pos = ftell (moovrf->file) - 8;
+
++ guint8 version;
++ if (fread (&version, 1, 1, moovrf->file) != 1)
++ return FALSE;
++ if (version != 0) {
++ GST_WARNING ("Version %d mvhd not supported", version);
++ return FALSE;
++ }
++
++ if (size != 108)
++ return FALSE;
++
+ /* skip the remaining of the mvhd in the file */
+- return fseek (moovrf->file, size - 8, SEEK_CUR) == 0;
++ return fseek (moovrf->file, size - 8 - 1, SEEK_CUR) == 0;
+ }
+
+ static gboolean
+@@ -357,6 +374,8 @@ mdat_recov_file_find_mdat (FILE * file,
+ case FOURCC_ftyp:
+ case FOURCC_free:
+ case FOURCC_udta:
++ if (size < 8)
++ return FALSE;
+ if (fseek (file, size - 8, SEEK_CUR) != 0) {
+ goto file_seek_error;
+ }
+@@ -486,6 +505,8 @@ skip_atom (MoovRecovFile * moovrf, guint
+ return FALSE;
+ if (fourcc != expected_fourcc)
+ return FALSE;
++ if (size < 8)
++ return FALSE;
+
+ return (fseek (moovrf->file, size - 8, SEEK_CUR) == 0);
+ }
+@@ -502,11 +523,24 @@ moov_recov_parse_tkhd (MoovRecovFile * m
+ return FALSE;
+ if (fourcc != FOURCC_tkhd)
+ return FALSE;
++ if (size < 8)
++ return FALSE;
+
+ trakrd->tkhd_file_offset = ftell (moovrf->file) - 8;
+
+- /* move 8 bytes forward to the trak_id pos */
+- if (fseek (moovrf->file, 12, SEEK_CUR) != 0)
++ guint8 version;
++ if (fread (&version, 1, 1, moovrf->file) != 1)
++ return FALSE;
++ if (version != 0) {
++ GST_WARNING ("Version %d tkhd not supported", version);
++ return FALSE;
++ }
++
++ if (size != 92)
++ return FALSE;
++
++ /* move 12-1 bytes forward to the trak_id pos */
++ if (fseek (moovrf->file, 12 - 1, SEEK_CUR) != 0)
+ return FALSE;
+ if (fread (data, 1, 4, moovrf->file) != 4)
+ return FALSE;
+@@ -530,6 +564,8 @@ moov_recov_parse_stbl (MoovRecovFile * m
+ return FALSE;
+ if (fourcc != FOURCC_stbl)
+ return FALSE;
++ if (size < 8)
++ return FALSE;
+
+ trakrd->stbl_file_offset = ftell (moovrf->file) - 8;
+ trakrd->stbl_size = size;
+@@ -539,12 +575,17 @@ moov_recov_parse_stbl (MoovRecovFile * m
+ return FALSE;
+ if (fourcc != FOURCC_stsd)
+ return FALSE;
++ if (auxsize < 8)
++ return FALSE;
+ if (fseek (moovrf->file, auxsize - 8, SEEK_CUR) != 0)
+ return FALSE;
+
+ trakrd->stsd_size = auxsize;
+ trakrd->post_stsd_offset = ftell (moovrf->file);
+
++ if (trakrd->stbl_size < trakrd->post_stsd_offset - trakrd->stbl_file_offset)
++ return FALSE;
++
+ /* as this is the last atom we parse, we don't skip forward */
+
+ return TRUE;
+@@ -556,11 +597,14 @@ moov_recov_parse_minf (MoovRecovFile * m
+ guint32 size;
+ guint32 fourcc;
+ guint32 auxsize;
++ guint64 offset;
+
+ if (!read_atom_header (moovrf->file, &fourcc, &size))
+ return FALSE;
+ if (fourcc != FOURCC_minf)
+ return FALSE;
++ if (size < 8)
++ return FALSE;
+
+ trakrd->minf_file_offset = ftell (moovrf->file) - 8;
+ trakrd->minf_size = size;
+@@ -571,17 +615,23 @@ moov_recov_parse_minf (MoovRecovFile * m
+ if (fourcc != FOURCC_vmhd && fourcc != FOURCC_smhd && fourcc != FOURCC_hmhd &&
+ fourcc != FOURCC_gmhd)
+ return FALSE;
++ if (auxsize < 8)
++ return FALSE;
+ if (fseek (moovrf->file, auxsize - 8, SEEK_CUR))
+ return FALSE;
+
+ /* skip a possible hdlr and the following dinf */
+ if (!read_atom_header (moovrf->file, &fourcc, &auxsize))
+ return FALSE;
++ if (auxsize < 8)
++ return FALSE;
+ if (fourcc == FOURCC_hdlr) {
+ if (fseek (moovrf->file, auxsize - 8, SEEK_CUR))
+ return FALSE;
+ if (!read_atom_header (moovrf->file, &fourcc, &auxsize))
+ return FALSE;
++ if (auxsize < 8)
++ return FALSE;
+ }
+ if (fourcc != FOURCC_dinf)
+ return FALSE;
+@@ -592,6 +642,10 @@ moov_recov_parse_minf (MoovRecovFile * m
+ if (!moov_recov_parse_stbl (moovrf, trakrd))
+ return FALSE;
+
++ offset = ftell (moovrf->file);
++ if (trakrd->minf_size < offset - trakrd->minf_file_offset)
++ return FALSE;
++
+ return TRUE;
+ }
+
+@@ -607,11 +661,24 @@ moov_recov_parse_mdhd (MoovRecovFile * m
+ return FALSE;
+ if (fourcc != FOURCC_mdhd)
+ return FALSE;
++ if (size < 8)
++ return FALSE;
+
+ trakrd->mdhd_file_offset = ftell (moovrf->file) - 8;
+
++ guint8 version;
++ if (fread (&version, 1, 1, moovrf->file) != 1)
++ return FALSE;
++ if (version != 0) {
++ GST_WARNING ("Version %d mdhd not supported", version);
++ return FALSE;
++ }
++
++ if (size != 32)
++ return FALSE;
++
+ /* get the timescale */
+- if (fseek (moovrf->file, 12, SEEK_CUR) != 0)
++ if (fseek (moovrf->file, 12 - 1, SEEK_CUR) != 0)
+ return FALSE;
+ if (fread (data, 1, 4, moovrf->file) != 4)
+ return FALSE;
+@@ -626,12 +693,15 @@ moov_recov_parse_mdia (MoovRecovFile * m
+ {
+ guint32 size;
+ guint32 fourcc;
++ guint64 offset;
+
+ /* make sure we are on a tkhd atom */
+ if (!read_atom_header (moovrf->file, &fourcc, &size))
+ return FALSE;
+ if (fourcc != FOURCC_mdia)
+ return FALSE;
++ if (size < 8)
++ return FALSE;
+
+ trakrd->mdia_file_offset = ftell (moovrf->file) - 8;
+ trakrd->mdia_size = size;
+@@ -643,6 +713,11 @@ moov_recov_parse_mdia (MoovRecovFile * m
+ return FALSE;
+ if (!moov_recov_parse_minf (moovrf, trakrd))
+ return FALSE;
++
++ offset = ftell (moovrf->file);
++ if (trakrd->mdia_size < offset - trakrd->mdia_file_offset)
++ return FALSE;
++
+ return TRUE;
+ }
+
+@@ -665,6 +740,8 @@ moov_recov_parse_trak (MoovRecovFile * m
+ if (fourcc != FOURCC_trak) {
+ return FALSE;
+ }
++ if (size < 8)
++ return FALSE;
+ trakrd->trak_size = size;
+
+ /* now we should have a trak header 'tkhd' */
+@@ -683,6 +760,9 @@ moov_recov_parse_trak (MoovRecovFile * m
+ return FALSE;
+
+ trakrd->extra_atoms_offset = ftell (moovrf->file);
++ if (trakrd->trak_size < trakrd->extra_atoms_offset - offset)
++ return FALSE;
++
+ trakrd->extra_atoms_size = size - (trakrd->extra_atoms_offset - offset);
+
+ trakrd->file_offset = offset;
diff --git a/CVE-2026-18298.patch b/CVE-2026-18298.patch
new file mode 100644
index 0000000..5a45bd4
--- /dev/null
+++ b/CVE-2026-18298.patch
@@ -0,0 +1,75 @@
+diff -rupN --no-dereference gst-plugins-good-1.26.11/docs/gst_plugins_cache.json gst-plugins-good-1.26.11-new/docs/gst_plugins_cache.json
+--- gst-plugins-good-1.26.11/docs/gst_plugins_cache.json 2026-08-25 23:18:14.155388324 +0200
++++ gst-plugins-good-1.26.11-new/docs/gst_plugins_cache.json 2026-08-25 23:18:14.427384192 +0200
+@@ -7507,7 +7507,7 @@
+ "presence": "always"
+ }
+ },
+- "rank": "secondary"
++ "rank": "none"
+ },
+ "gdkpixbufoverlay": {
+ "author": "Tim-Philipp Müller <tim centricular net>",
+diff -rupN --no-dereference gst-plugins-good-1.26.11/ext/gdk_pixbuf/gstgdkpixbufdec.c gst-plugins-good-1.26.11-new/ext/gdk_pixbuf/gstgdkpixbufdec.c
+--- gst-plugins-good-1.26.11/ext/gdk_pixbuf/gstgdkpixbufdec.c 2026-03-10 14:08:25.000000000 +0100
++++ gst-plugins-good-1.26.11-new/ext/gdk_pixbuf/gstgdkpixbufdec.c 2026-08-25 23:18:14.429648032 +0200
+@@ -76,8 +76,7 @@ static gboolean gst_gdk_pixbuf_dec_sink_
+ #define gst_gdk_pixbuf_dec_parent_class parent_class
+ G_DEFINE_TYPE (GstGdkPixbufDec, gst_gdk_pixbuf_dec, GST_TYPE_ELEMENT);
+ GST_ELEMENT_REGISTER_DEFINE_WITH_CODE (gdkpixbufdec, "gdkpixbufdec",
+- GST_RANK_SECONDARY, GST_TYPE_GDK_PIXBUF_DEC,
+- gdk_pixbuf_element_init (plugin));
++ GST_RANK_NONE, GST_TYPE_GDK_PIXBUF_DEC, gdk_pixbuf_element_init (plugin));
+
+ static gboolean
+ gst_gdk_pixbuf_dec_sink_setcaps (GstGdkPixbufDec * filter, GstCaps * caps)
+@@ -293,6 +292,7 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDe
+ gint width, height;
+ gint n_channels;
+ GstVideoFrame frame;
++ GstVideoFormat fmt;
+
+ pixbuf = gdk_pixbuf_loader_get_pixbuf (filter->pixbuf_loader);
+ if (pixbuf == NULL)
+@@ -301,26 +301,26 @@ gst_gdk_pixbuf_dec_flush (GstGdkPixbufDe
+ width = gdk_pixbuf_get_width (pixbuf);
+ height = gdk_pixbuf_get_height (pixbuf);
+
+- if (GST_VIDEO_INFO_FORMAT (&filter->info) == GST_VIDEO_FORMAT_UNKNOWN) {
++ n_channels = gdk_pixbuf_get_n_channels (pixbuf);
++ switch (n_channels) {
++ case 3:
++ fmt = GST_VIDEO_FORMAT_RGB;
++ break;
++ case 4:
++ fmt = GST_VIDEO_FORMAT_RGBA;
++ break;
++ default:
++ goto channels_not_supported;
++ }
++
++ if (GST_VIDEO_INFO_FORMAT (&filter->info) != fmt ||
++ GST_VIDEO_INFO_WIDTH (&filter->info) != width ||
++ GST_VIDEO_INFO_HEIGHT (&filter->info) != height) {
+ GstVideoInfo info;
+- GstVideoFormat fmt;
+ GList *l;
+
+ GST_DEBUG ("Set size to %dx%d", width, height);
+
+- n_channels = gdk_pixbuf_get_n_channels (pixbuf);
+- switch (n_channels) {
+- case 3:
+- fmt = GST_VIDEO_FORMAT_RGB;
+- break;
+- case 4:
+- fmt = GST_VIDEO_FORMAT_RGBA;
+- break;
+- default:
+- goto channels_not_supported;
+- }
+-
+-
+ gst_video_info_init (&info);
+ if (!gst_video_info_set_format (&info, fmt, width, height))
+ goto format_not_supported;
diff --git a/CVE-2026-18299.patch b/CVE-2026-18299.patch
new file mode 100644
index 0000000..55f66c7
--- /dev/null
+++ b/CVE-2026-18299.patch
@@ -0,0 +1,50 @@
+diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/rtp/gstrtpsbcdepay.c gst-plugins-good-1.26.11-new/gst/rtp/gstrtpsbcdepay.c
+--- gst-plugins-good-1.26.11/gst/rtp/gstrtpsbcdepay.c 2026-03-10 14:08:25.000000000 +0100
++++ gst-plugins-good-1.26.11-new/gst/rtp/gstrtpsbcdepay.c 2026-08-25 23:18:14.339564459 +0200
+@@ -303,6 +303,8 @@ gst_rtp_sbc_depay_process (GstRTPBaseDep
+
+ payload = gst_rtp_buffer_get_payload (rtp);
+ payload_len = gst_rtp_buffer_get_payload_len (rtp);
++ if (payload_len < 1)
++ goto bad_packet;
+
+ fragment = payload[0] & 0x80;
+ start = payload[0] & 0x40;
+@@ -331,19 +333,26 @@ gst_rtp_sbc_depay_process (GstRTPBaseDep
+ }
+
+ gst_adapter_push (depay->adapter, data);
++ data = NULL;
+
+ if (last) {
+- gint framelen, samples;
+- guint8 header[4];
+-
+- data = gst_adapter_take_buffer (depay->adapter,
+- gst_adapter_available (depay->adapter));
+- gst_rtp_drop_non_audio_meta (depay, data);
+-
+- if (gst_buffer_extract (data, 0, &header, 4) != 4 ||
+- gst_rtp_sbc_depay_get_params (depay, header,
+- payload_len, &framelen, &samples) < 0) {
+- gst_buffer_unref (data);
++ if (gst_adapter_available (depay->adapter)) {
++ gint framelen;
++ guint8 header[4];
++
++ data = gst_adapter_take_buffer (depay->adapter,
++ gst_adapter_available (depay->adapter));
++ gst_rtp_drop_non_audio_meta (depay, data);
++
++ if (gst_buffer_extract (data, 0, &header, 4) != 4 ||
++ gst_rtp_sbc_depay_get_params (depay, header,
++ payload_len, &framelen, &samples) < 0) {
++ gst_buffer_unref (data);
++ data = NULL;
++ goto bad_packet;
++ }
++ } else {
++ data = NULL;
+ goto bad_packet;
+ }
+ } else {
diff --git a/CVE-2026-3083_3085.patch b/CVE-2026-3083_3085.patch
index c007c99..d795f67 100644
--- a/CVE-2026-3083_3085.patch
+++ b/CVE-2026-3083_3085.patch
@@ -1,6 +1,6 @@
diff -rupN --no-dereference gst-plugins-good-1.26.11/docs/gst_plugins_cache.json gst-plugins-good-1.26.11-new/docs/gst_plugins_cache.json
--- gst-plugins-good-1.26.11/docs/gst_plugins_cache.json 2026-03-10 14:08:25.000000000 +0100
-+++ gst-plugins-good-1.26.11-new/docs/gst_plugins_cache.json 2026-08-02 12:32:54.257402391 +0200
++++ gst-plugins-good-1.26.11-new/docs/gst_plugins_cache.json 2026-08-25 23:18:14.042390040 +0200
@@ -16809,34 +16809,6 @@
"properties": {},
"rank": "secondary"
@@ -38,7 +38,7 @@ diff -rupN --no-dereference gst-plugins-good-1.26.11/docs/gst_plugins_cache.json
"description": "Decode Redundant Audio Data (RED)",
diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/rtp/gstrtp.c gst-plugins-good-1.26.11-new/gst/rtp/gstrtp.c
--- gst-plugins-good-1.26.11/gst/rtp/gstrtp.c 2026-03-10 14:08:25.000000000 +0100
-+++ gst-plugins-good-1.26.11-new/gst/rtp/gstrtp.c 2026-08-02 12:32:54.259293713 +0200
++++ gst-plugins-good-1.26.11-new/gst/rtp/gstrtp.c 2026-08-25 23:18:14.044350309 +0200
@@ -101,7 +101,6 @@ plugin_init (GstPlugin * plugin)
ret |= GST_ELEMENT_REGISTER (rtpmp4gdepay, plugin);
ret |= GST_ELEMENT_REGISTER (rtpmp4gpay, plugin);
@@ -574,7 +574,7 @@ diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/rtp/gstrtpqdmdepay.h gs
-#endif /* __GST_RTP_QDM2_DEPAY_H__ */
diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/rtp/meson.build gst-plugins-good-1.26.11-new/gst/rtp/meson.build
--- gst-plugins-good-1.26.11/gst/rtp/meson.build 2026-03-10 14:08:25.000000000 +0100
-+++ gst-plugins-good-1.26.11-new/gst/rtp/meson.build 2026-08-02 12:32:54.259974976 +0200
++++ gst-plugins-good-1.26.11-new/gst/rtp/meson.build 2026-08-25 23:18:14.045249281 +0200
@@ -76,7 +76,6 @@ rtp_sources = [
'gstrtpmp4adepay.c',
'gstrtpmp4apay.c',
diff --git a/CVE-2026-5056.patch b/CVE-2026-5056.patch
index ebcbce0..8fd4d4a 100644
--- a/CVE-2026-5056.patch
+++ b/CVE-2026-5056.patch
@@ -1,6 +1,6 @@
diff -rupN --no-dereference gst-plugins-good-1.26.11/gst/isomp4/qtdemux.c gst-plugins-good-1.26.11-new/gst/isomp4/qtdemux.c
--- gst-plugins-good-1.26.11/gst/isomp4/qtdemux.c 2026-03-10 14:08:25.000000000 +0100
-+++ gst-plugins-good-1.26.11-new/gst/isomp4/qtdemux.c 2026-08-02 12:32:54.389401227 +0200
++++ gst-plugins-good-1.26.11-new/gst/isomp4/qtdemux.c 2026-08-25 23:18:14.162388217 +0200
@@ -12160,6 +12160,14 @@ qtdemux_parse_cmpd (GstQTDemux * qtdemux
cmpd->component_count = gst_byte_reader_get_uint32_be_unchecked (reader);
diff --git a/mingw-gstreamer1-plugins-good.spec b/mingw-gstreamer1-plugins-good.spec
index 87cd05e..b68b04e 100644
--- a/mingw-gstreamer1-plugins-good.spec
+++ b/mingw-gstreamer1-plugins-good.spec
@@ -4,7 +4,7 @@
Name: mingw-gstreamer1-plugins-good
Version: 1.26.11
-Release: 2%{?dist}
+Release: 3%{?dist}
Summary: Cross compiled GStreamer1 plug-ins good
License: LGPL-2.0-or-later
@@ -16,6 +16,15 @@ Patch0: CVE-2026-3083_3085.patch
# Backport fix for CVE-2026-5056
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/bad6721ca4901123e5cb57eec9d8e84d69c08597
Patch1: CVE-2026-5056.patch
+# Backport fix for CVE-2026-18295, CVE-2026-18296
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12041.patch
+Patch2: CVE-2026-18295.patch
+# Backport fix for CVE-2026-18299
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12042.patch
+Patch3: CVE-2026-18299.patch
+# Backport fix for CVE-2026-18298
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12043.patch
+Patch4: CVE-2026-18298.patch
BuildArch: noarch
@@ -283,6 +292,9 @@ rm -rf %{buildroot}%{mingw64_libdir}/gstreamer-%{api_version}/*.dll.a
%changelog
+* Tue Aug 25 2026 Sandro Mani <manisandro@gmail.com> - 1.26.11-3
+- Backport fixes for CVE-2026-18295 CVE-2026-18296 CVE-2026-18299 CVE-2026-18298
+
* Sun Aug 02 2026 Sandro Mani <manisandro@gmail.com> - 1.26.11-2
- Backport fix for CVE-2026-5056
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-25 21:26 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-25 21:26 [rpms/mingw-gstreamer1-plugins-good] f43: Backport fixes for CVE-2026-18295 CVE-2026-18296 CVE-2026-18299 CVE-2026-18298 Sandro Mani
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox