From 16881f0cb2867cbc6da3f3f10bccf0c8cf00a247 Mon Sep 17 00:00:00 2001 From: Craig Andrews Date: Tue, 3 Nov 2026 11:07:09 -0500 Subject: [PATCH] media-video/rtmpdump: add 2.6, fix CVE-2026-112060, CVE-2026-112061 Fix AMF decoding error handling and checks Bug: https://bugs.gentoo.org/985570 Signed-off-by: Craig Andrews --- media-video/rtmpdump/Manifest | 1 + .../files/rtmpdump-fix-amf-decoder.patch | 48 ++++++++++ media-video/rtmpdump/rtmpdump-2.6.ebuild | 93 +++++++++++++++++++ 3 files changed, 142 insertions(+) create mode 100644 media-video/rtmpdump/files/rtmpdump-fix-amf-decoder.patch create mode 100644 media-video/rtmpdump/rtmpdump-2.6.ebuild diff --git a/media-video/rtmpdump/Manifest b/media-video/rtmpdump/Manifest index 677d4003e7148..134f0701d6dbf 100644 --- a/media-video/rtmpdump/Manifest +++ b/media-video/rtmpdump/Manifest @@ -1 +1,2 @@ DIST rtmpdump-2.4_p20210219.tar.gz 143043 BLAKE2B 312a44fa6caba3fbae19c248d76dccd22c637884ce37c207afe9de80eb0655a97af51101cd2800a2aea52620578f63e1ccede5070772126297e1c75baff0217b SHA512 2bcd169c8c142390e4a37a5f115bb722f8878188920818349aead50ad6c40b8e96c4f929f1b4d6c26ebc05ee264e6675d3843bf963ad4fbac04c3ce74b7fbb20 +DIST rtmpdump-2.6.tar.gz 143575 BLAKE2B 02224376295119a497911c1eecd2f96c0613aa289532084640db707b2fb8ed0ea1771945df3a455e25089ccdf4a39b8a6e00c48563e6275e312754327286d686 SHA512 e6c108576fdd3430d81e2f72b343864eee5d6be396c9378a2ae2bfc871e9464e20d7bd057a47ef2449a301d933b29265e7ffd3383631b24fc035f5483337bbce diff --git a/media-video/rtmpdump/files/rtmpdump-fix-amf-decoder.patch b/media-video/rtmpdump/files/rtmpdump-fix-amf-decoder.patch new file mode 100644 index 0000000000000..b098452a86b0f --- /dev/null +++ b/media-video/rtmpdump/files/rtmpdump-fix-amf-decoder.patch @@ -0,0 +1,48 @@ +From d281cd47b41e8a4ef9a7e73fad5c84189b60a34a Mon Sep 17 00:00:00 2001 +From: Craig Andrews +Date: Tue, 3 Nov 2026 11:04:44 -0500 +Subject: [PATCH] Fix AMF decoding error handling and checks + +Fix CVE-2026-112060 and CVE-2026-112061 + +See: https://hackmd.io/@haindpwn/cve-2026-112060-112061-librtmp-amf3-decode-and-strict-array-oob +--- + librtmp/amf.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/librtmp/amf.c b/librtmp/amf.c +index 7954144..b1dc6df 100644 +--- a/librtmp/amf.c ++++ b/librtmp/amf.c +@@ -730,6 +730,8 @@ AMFProp_Decode(AMFObjectProperty *prop, const char *pBuffer, int nSize, + } + case AMF_STRICT_ARRAY: + { ++ if (nSize < 4) ++ return -1; + unsigned int nArrayLen = AMF_DecodeInt32(pBuffer); + nSize -= 4; + +@@ -1143,8 +1145,11 @@ AMF3_Decode(AMFObject *obj, const char *pBuffer, int nSize, int bAMFData) + goto invalid; + nRes = AMF3Prop_Decode(&prop, pBuffer, nSize, FALSE); + if (nRes == -1) +- RTMP_Log(RTMP_LOGDEBUG, "%s, failed to decode AMF3 property!", +- __FUNCTION__); ++ { ++ RTMP_Log(RTMP_LOGDEBUG, "%s, failed to decode AMF3 property!", ++ __FUNCTION__); ++ break; ++ } + + AMFProp_SetName(&prop, AMF3CD_GetProp(&cd, i)); + AMF_AddProp(obj, &prop); +@@ -1161,6 +1166,8 @@ AMF3_Decode(AMFObject *obj, const char *pBuffer, int nSize, int bAMFData) + if (nSize <=0) + goto invalid; + nRes = AMF3Prop_Decode(&prop, pBuffer, nSize, TRUE); ++ if (nRes == -1) ++ break; + AMF_AddProp(obj, &prop); + + pBuffer += nRes; diff --git a/media-video/rtmpdump/rtmpdump-2.6.ebuild b/media-video/rtmpdump/rtmpdump-2.6.ebuild new file mode 100644 index 0000000000000..326dc09c1e38f --- /dev/null +++ b/media-video/rtmpdump/rtmpdump-2.6.ebuild @@ -0,0 +1,93 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI="8" + +inherit multilib toolchain-funcs multilib-minimal flag-o-matic + +DESCRIPTION="RTMP client, librtmp library intended to stream audio or video flash content" +HOMEPAGE="https://rtmpdump.mplayerhq.hu/" + +# the library is LGPL-2.1, the command is GPL-2 +LICENSE="LGPL-2.1 tools? ( GPL-2 )" +SLOT="0" +IUSE="gnutls ssl static-libs +tools" + +DEPEND="ssl? ( + gnutls? ( + >=net-libs/gnutls-2.12.23-r6[${MULTILIB_USEDEP},nettle(+)] + dev-libs/nettle:0=[${MULTILIB_USEDEP}] + ) + !gnutls? ( dev-libs/openssl:0=[${MULTILIB_USEDEP}] ) + >=virtual/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}] + )" +RDEPEND="${DEPEND}" + +PATCHES=( + "${FILESDIR}/${PN}-swf_vertification_type_2.patch" + "${FILESDIR}/${PN}-swf_vertification_type_2_part_2.patch" + "${FILESDIR}/${PN}-fix-chunk-size.patch" + "${FILESDIR}/${PN}-fix-amf-decoder.patch" +) + +if [[ ${PV} == *9999 ]] ; then + SRC_URI="" + EGIT_REPO_URI="https://git.ffmpeg.org/rtmpdump.git" + inherit git-r3 +else + KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~x86" + commit="6f6bb1353fc84f4cc37138baa99f586750028a01" + SRC_URI="https://github.com/mirror/rtmpdump/archive/${commit}.tar.gz -> ${P}.tar.gz" + S="${WORKDIR}/${PN}-${commit}" +fi + +pkg_setup() { + if ! use ssl; then + if use gnutls; then + ewarn "USE='gnutls' is ignored without USE='ssl'." + ewarn "Please review the local USE flags for this package." + fi + fi +} + +src_prepare() { + # fix #571106 by restoring pre-GCC5 inline semantics + append-cflags -std=gnu89 + # fix Makefile ( bug #298535 , bug #318353 and bug #324513 ) + sed -i 's/\$(MAKEFLAGS)//g' Makefile \ + || die "failed to fix Makefile" + sed -i -e 's:OPT=:&-fPIC :' \ + -e 's:OPT:OPTS:' \ + -e 's:CFLAGS=.*:& $(OPT):' librtmp/Makefile \ + || die "failed to fix Makefile" + default + multilib_copy_sources +} + +multilib_src_compile() { + if use ssl ; then + if use gnutls ; then + crypto="GNUTLS" + else + crypto="OPENSSL" + fi + fi + if ! multilib_is_native_abi || ! use tools ; then + cd librtmp || die + fi + emake CC="$(tc-getCC)" LD="$(tc-getLD)" AR="$(tc-getAR)" \ + OPT="${CFLAGS}" XLDFLAGS="${LDFLAGS}" CRYPTO="${crypto}" SYS=posix +} + +multilib_src_install() { + mkdir -p "${ED}"/usr/$(get_libdir) || die + if multilib_is_native_abi && use tools ; then + dodoc README ChangeLog rtmpdump.1.html rtmpgw.8.html + else + cd librtmp || die + fi + emake DESTDIR="${D}" prefix="${EPREFIX}/usr" mandir='$(prefix)/share/man' \ + CRYPTO="${crypto}" libdir="${EPREFIX}/usr/$(get_libdir)" install + find "${D}" -name '*.la' -delete || die + use static-libs || find "${D}" -name '*.a' -delete || die +}