c8
imports/c8/gstreamer1-plugins-base-1.16.1-5.el8_10
MSVSphere Packaging Team
2 months ago
parent
6365262e7b
commit
5f466ed8a1
GPG Key ID:
B2B0B9F29E528FE8
@ -1,8 +1,8 @@
|
||||
From 58deb2c68fda0cf46a03643aefa28efdc0753efa Mon Sep 17 00:00:00 2001
|
||||
From: Wim Taymans <wtaymans@redhat.com>
|
||||
Date: Fri, 8 Nov 2024 10:45:07 +0100
|
||||
Subject: [PATCH] exiftag: Prevent integer overflows and out of bounds reads
|
||||
when handling undefined tags
|
||||
Subject: [PATCH 5/8] exiftag: Prevent integer overflows and out of bounds
|
||||
reads when handling undefined tags
|
||||
|
||||
Fixes ZDI-CAN-23896
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3483
|
||||
@ -0,0 +1,37 @@
|
||||
From 0cd2cd6ffe7e5c2dc11cebf56aef39b23103c9aa Mon Sep 17 00:00:00 2001
|
||||
From: Wim Taymans <wtaymans@redhat.com>
|
||||
Date: Mon, 16 Dec 2024 11:24:39 +0100
|
||||
Subject: [PATCH 6/8] opusdec: Set at most 64 channels to NONE position
|
||||
|
||||
Thanks to Antonio Morales for finding and reporting the issue.
|
||||
|
||||
Fixes GHSL-2024-116
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3871
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8096>
|
||||
---
|
||||
ext/opus/gstopusdec.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/ext/opus/gstopusdec.c b/ext/opus/gstopusdec.c
|
||||
index 7ff9bee2e..16b2a2932 100644
|
||||
--- a/ext/opus/gstopusdec.c
|
||||
+++ b/ext/opus/gstopusdec.c
|
||||
@@ -369,12 +369,12 @@ gst_opus_dec_parse_header (GstOpusDec * dec, GstBuffer * buf)
|
||||
posn = gst_opus_channel_positions[dec->n_channels - 1];
|
||||
break;
|
||||
default:{
|
||||
- gint i;
|
||||
+ guint i, max_pos = MIN (dec->n_channels, 64);
|
||||
|
||||
GST_ELEMENT_WARNING (GST_ELEMENT (dec), STREAM, DECODE,
|
||||
(NULL), ("Using NONE channel layout for more than 8 channels"));
|
||||
|
||||
- for (i = 0; i < dec->n_channels; i++)
|
||||
+ for (i = 0; i < max_pos; i++)
|
||||
pos[i] = GST_AUDIO_CHANNEL_POSITION_NONE;
|
||||
|
||||
posn = pos;
|
||||
--
|
||||
2.47.0
|
||||
|
||||
@ -0,0 +1,76 @@
|
||||
From 478653961d090f868521e8513518fe8d7c67cba3 Mon Sep 17 00:00:00 2001
|
||||
From: Wim Taymans <wtaymans@redhat.com>
|
||||
Date: Mon, 16 Dec 2024 11:26:07 +0100
|
||||
Subject: [PATCH 7/8] vorbis_parse: check writes to
|
||||
GstOggStream.vorbis_mode_sizes
|
||||
|
||||
Thanks to Antonio Morales for finding and reporting the issue.
|
||||
|
||||
Fixes GHSL-2024-117 Fixes gstreamer#3875
|
||||
|
||||
Also perform out-of-bounds check for accesses to op->packet
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8097>
|
||||
---
|
||||
ext/ogg/vorbis_parse.c | 21 +++++++++++++++++++++
|
||||
1 file changed, 21 insertions(+)
|
||||
|
||||
diff --git a/ext/ogg/vorbis_parse.c b/ext/ogg/vorbis_parse.c
|
||||
index 2d85e9397..df52f7eb5 100644
|
||||
--- a/ext/ogg/vorbis_parse.c
|
||||
+++ b/ext/ogg/vorbis_parse.c
|
||||
@@ -165,6 +165,10 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
|
||||
if (offset == 0) {
|
||||
offset = 8;
|
||||
current_pos -= 1;
|
||||
+
|
||||
+ /* have we underrun? */
|
||||
+ if (current_pos < op->packet)
|
||||
+ return -1;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -178,6 +182,10 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
|
||||
if (offset == 7)
|
||||
current_pos -= 1;
|
||||
|
||||
+ /* have we underrun? */
|
||||
+ if (current_pos < op->packet + 5)
|
||||
+ return -1;
|
||||
+
|
||||
if (((current_pos[-5] & ~((1 << (offset + 1)) - 1)) != 0)
|
||||
||
|
||||
current_pos[-4] != 0
|
||||
@@ -199,9 +207,18 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
|
||||
/* Give ourselves a chance to recover if we went back too far by using
|
||||
* the size check. */
|
||||
for (ii = 0; ii < 2; ii++) {
|
||||
+
|
||||
if (offset > 4) {
|
||||
+ /* have we underrun? */
|
||||
+ if (current_pos < op->packet)
|
||||
+ return -1;
|
||||
+
|
||||
size_check = (current_pos[0] >> (offset - 5)) & 0x3F;
|
||||
} else {
|
||||
+ /* have we underrun? */
|
||||
+ if (current_pos < op->packet + 1)
|
||||
+ return -1;
|
||||
+
|
||||
/* mask part of byte from current_pos */
|
||||
size_check = (current_pos[0] & ((1 << (offset + 1)) - 1));
|
||||
/* shift to appropriate position */
|
||||
@@ -229,6 +246,10 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
|
||||
|
||||
mode_size_ptr = pad->vorbis_mode_sizes;
|
||||
|
||||
+ if (size > G_N_ELEMENTS (pad->vorbis_mode_sizes)) {
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
for (i = 0; i < size; i++) {
|
||||
offset = (offset + 1) % 8;
|
||||
if (offset == 0)
|
||||
--
|
||||
2.47.0
|
||||
|
||||
@ -0,0 +1,31 @@
|
||||
From 58375a492ee3b28e6e7f3d0be0f4bd9ec861a8cf Mon Sep 17 00:00:00 2001
|
||||
From: Wim Taymans <wtaymans@redhat.com>
|
||||
Date: Mon, 16 Dec 2024 11:27:39 +0100
|
||||
Subject: [PATCH 8/8] vorbisdec: Set at most 64 channels to NONE position
|
||||
|
||||
Thanks to Antonio Morales for finding and reporting the issue.
|
||||
|
||||
Fixes GHSL-2024-115
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3869
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8101>
|
||||
---
|
||||
ext/vorbis/gstvorbisdec.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/ext/vorbis/gstvorbisdec.c b/ext/vorbis/gstvorbisdec.c
|
||||
index a0b48b71b..b44398945 100644
|
||||
--- a/ext/vorbis/gstvorbisdec.c
|
||||
+++ b/ext/vorbis/gstvorbisdec.c
|
||||
@@ -191,7 +191,7 @@ vorbis_handle_identification_packet (GstVorbisDec * vd)
|
||||
}
|
||||
default:{
|
||||
GstAudioChannelPosition position[64];
|
||||
- gint i, max_pos = MAX (vd->vi.channels, 64);
|
||||
+ gint i, max_pos = MIN (vd->vi.channels, 64);
|
||||
|
||||
GST_ELEMENT_WARNING (vd, STREAM, DECODE,
|
||||
(NULL), ("Using NONE channel layout for more than 8 channels"));
|
||||
--
|
||||
2.47.0
|
||||
|
||||
Loading…
Reference in new issue