mirror of
https://github.com/gentoo-mirror/gentoo.git
synced 2026-09-24 04:59:14 -07:00
media-libs/gst-plugins-good: backport vulnerability fixes
* One of the fixes is the removal of the rtpqdm2depay element. Bug: https://bugs.gentoo.org/970987 Signed-off-by: Alfred Wingate <parona@protonmail.com> Part-of: https://codeberg.org/gentoo/gentoo/pulls/354 Signed-off-by: Sam James <sam@gentoo.org>
This commit is contained in:
Alfred Wingate
committed by
Sam James
Sam James
parent
7861fe4f7a
commit
9a98f0e743
@@ -0,0 +1,111 @@
|
||||
https://bugs.gentoo.org/970987
|
||||
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/10949
|
||||
https://gstreamer.freedesktop.org/security/sa-2026-0008.html
|
||||
CVE-2026-3083
|
||||
CVE-2026-3085
|
||||
ZDI-26-166
|
||||
ZDI-26-167
|
||||
ZDI-CAN-28850
|
||||
ZDI-CAN-28851
|
||||
|
||||
From f39b6aeeb7da2ab85c9a2f37d76c5c725c947a28 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Tim-Philipp=20M=C3=BCller?= <tim@centricular.com>
|
||||
Date: Sun, 8 Feb 2026 16:01:21 +0000
|
||||
Subject: [PATCH] rtpqdm2depay: error out if anyone tries to use this element
|
||||
|
||||
Forbid use of this element and comment out all processing code.
|
||||
|
||||
There is no plausible reason this code should ever be executed in 2026
|
||||
seeing that this was a streaming format produced by Darwin Streaming Server
|
||||
ca 2009 which hasn't been in active use for well over a decade.
|
||||
|
||||
We simply error out for now as defensive measure and will remove the
|
||||
element entirely in the next release cycle.
|
||||
|
||||
The processing functions are hairy and rather tedious to fix without
|
||||
at least some sample stream at hand.
|
||||
|
||||
If anyone actually does have a legitimate need for this element and
|
||||
can provide a sample streams, we will happily implement a depayloader
|
||||
in Rust.
|
||||
|
||||
Fixes ZDI-CAN-28850, ZDI-CAN-28851, ZDI-CAN-28851, ZDI-CAN-28850, GST-SA-2026-0008.
|
||||
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4903
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4890
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/10949>
|
||||
--- a/gst/rtp/gstrtpqdmdepay.c
|
||||
+++ b/gst/rtp/gstrtpqdmdepay.c
|
||||
@@ -57,11 +57,13 @@ G_DEFINE_TYPE (GstRtpQDM2Depay, gst_rtp_qdm2_depay,
|
||||
GST_ELEMENT_REGISTER_DEFINE_WITH_CODE (rtpqdm2depay, "rtpqdm2depay",
|
||||
GST_RANK_SECONDARY, GST_TYPE_RTP_QDM2_DEPAY, _do_init);
|
||||
|
||||
+#if 0
|
||||
static const guint8 headheader[20] = {
|
||||
0x0, 0x0, 0x0, 0xc, 0x66, 0x72, 0x6d, 0x61,
|
||||
0x51, 0x44, 0x4d, 0x32, 0x0, 0x0, 0x0, 0x24,
|
||||
0x51, 0x44, 0x43, 0x41
|
||||
};
|
||||
+#endif
|
||||
|
||||
static void gst_rtp_qdm2_depay_finalize (GObject * object);
|
||||
|
||||
@@ -138,6 +140,7 @@ gst_rtp_qdm2_depay_setcaps (GstRTPBaseDepayload * filter, GstCaps * caps)
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
+#if 0
|
||||
static void
|
||||
flush_data (GstRtpQDM2Depay * depay)
|
||||
{
|
||||
@@ -230,10 +233,26 @@ add_packet (GstRtpQDM2Depay * depay, guint32 pid, guint32 len, guint8 * data)
|
||||
memcpy (packet->data + packet->offs, data, len);
|
||||
packet->offs += len;
|
||||
}
|
||||
+#endif
|
||||
|
||||
static GstBuffer *
|
||||
gst_rtp_qdm2_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp)
|
||||
{
|
||||
+ /* There is no plausible reason this code should ever be executed in 2026
|
||||
+ * seeing that this was a streaming format produced by Darwin Streaming Server
|
||||
+ * ca 2009 which hasn't been in active use for well over a decade.
|
||||
+ *
|
||||
+ * We simply return here as defensive measure.
|
||||
+ *
|
||||
+ * We post an error message in the state change function, so this processing
|
||||
+ * function should never be reached, we just ifdef the code out for clarity.
|
||||
+ *
|
||||
+ * If anyone actually does have a legitimate need for this and can provide
|
||||
+ * sample streams, we will happily implement a depayloader in Rust.
|
||||
+ */
|
||||
+ return NULL;
|
||||
+
|
||||
+#if 0
|
||||
GstRtpQDM2Depay *rtpqdm2depay;
|
||||
GstBuffer *outbuf = NULL;
|
||||
guint16 seq;
|
||||
@@ -378,6 +397,7 @@ bad_packet:
|
||||
(NULL), ("Packet was too short"));
|
||||
return NULL;
|
||||
}
|
||||
+#endif
|
||||
}
|
||||
|
||||
static GstStateChangeReturn
|
||||
@@ -391,7 +411,10 @@ gst_rtp_qdm2_depay_change_state (GstElement * element,
|
||||
|
||||
switch (transition) {
|
||||
case GST_STATE_CHANGE_NULL_TO_READY:
|
||||
- break;
|
||||
+ GST_ELEMENT_ERROR (rtpqdm2depay, STREAM, DECODE,
|
||||
+ ("This element should not be used."),
|
||||
+ ("Please report an issue if you encounter this message."));
|
||||
+ return GST_STATE_CHANGE_FAILURE;
|
||||
case GST_STATE_CHANGE_READY_TO_PAUSED:
|
||||
gst_adapter_clear (rtpqdm2depay->adapter);
|
||||
break;
|
||||
--
|
||||
GitLab
|
||||
|
||||
@@ -0,0 +1,56 @@
|
||||
https://bugs.gentoo.org/970987
|
||||
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/10880
|
||||
https://gstreamer.freedesktop.org/security/sa-2026-0002.html
|
||||
|
||||
From ce0a11b2657bbc434c570ffedd81668d44fd1277 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
||||
Date: Thu, 22 Jan 2026 08:13:56 +0200
|
||||
Subject: [PATCH] qtdemux: Fix out-of-bounds read when parsing PlayReady DRM
|
||||
UUIDs
|
||||
|
||||
Fixes GST-SA-2026-0002.
|
||||
|
||||
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4865
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/10880>
|
||||
--- a/gst/isomp4/qtdemux.c
|
||||
+++ b/gst/isomp4/qtdemux.c
|
||||
@@ -3036,7 +3036,7 @@ qtdemux_parse_piff (GstQTDemux * qtdemux, const guint8 * buffer, gint length,
|
||||
}
|
||||
|
||||
static void
|
||||
-qtdemux_parse_uuid (GstQTDemux * qtdemux, const guint8 * buffer, gint length)
|
||||
+qtdemux_parse_uuid (GstQTDemux * qtdemux, const guint8 * buffer, gsize length)
|
||||
{
|
||||
static const guint8 xmp_uuid[] = { 0xBE, 0x7A, 0xCF, 0xCB,
|
||||
0x97, 0xA9, 0x42, 0xE8,
|
||||
@@ -3080,16 +3080,18 @@ qtdemux_parse_uuid (GstQTDemux * qtdemux, const guint8 * buffer, gint length)
|
||||
qtdemux_handle_xmp_taglist (qtdemux, qtdemux->tag_list, taglist);
|
||||
|
||||
} else if (memcmp (buffer + offset, playready_uuid, 16) == 0) {
|
||||
- int len;
|
||||
- const gunichar2 *s_utf16;
|
||||
- char *contents;
|
||||
+ if (length >= offset + 0x30 + 2) {
|
||||
+ guint16 len = GST_READ_UINT16_LE (buffer + offset + 0x30);
|
||||
|
||||
- len = GST_READ_UINT16_LE (buffer + offset + 0x30);
|
||||
- s_utf16 = (const gunichar2 *) (buffer + offset + 0x32);
|
||||
- contents = g_utf16_to_utf8 (s_utf16, len / 2, NULL, NULL, NULL);
|
||||
- GST_ERROR_OBJECT (qtdemux, "contents: %s", contents);
|
||||
+ if (length >= offset + 0x30 + 2 + len) {
|
||||
+ const gunichar2 *s_utf16 = (const gunichar2 *) (buffer + offset + 0x32);
|
||||
+ char *contents = g_utf16_to_utf8 (s_utf16, len / 2, NULL, NULL, NULL);
|
||||
|
||||
- g_free (contents);
|
||||
+ GST_ERROR_OBJECT (qtdemux, "contents: %s", GST_STR_NULL (contents));
|
||||
+
|
||||
+ g_free (contents);
|
||||
+ }
|
||||
+ }
|
||||
|
||||
GST_ELEMENT_ERROR (qtdemux, STREAM, DECRYPT,
|
||||
(_("Cannot play stream because it is encrypted with PlayReady DRM.")),
|
||||
--
|
||||
GitLab
|
||||
|
||||
@@ -0,0 +1,74 @@
|
||||
# Copyright 1999-2026 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
GST_ORG_MODULE="gst-plugins-good"
|
||||
|
||||
inherit gstreamer-meson virtualx
|
||||
|
||||
DESCRIPTION="Basepack of plugins for GStreamer"
|
||||
HOMEPAGE="https://gstreamer.freedesktop.org/"
|
||||
|
||||
LICENSE="LGPL-2.1+"
|
||||
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
|
||||
IUSE="+orc"
|
||||
|
||||
# Old media-libs/gst-plugins-ugly blocker for xingmux moving from ugly->good
|
||||
RDEPEND="
|
||||
!<media-libs/gst-plugins-ugly-1.22.3
|
||||
>=media-libs/gst-plugins-base-${PV}:${SLOT}[${MULTILIB_USEDEP}]
|
||||
>=app-arch/bzip2-1.0.6-r4[${MULTILIB_USEDEP}]
|
||||
>=virtual/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
|
||||
orc? ( >=dev-lang/orc-0.4.33[${MULTILIB_USEDEP}] )
|
||||
"
|
||||
DEPEND="${RDEPEND}"
|
||||
|
||||
DOCS=( AUTHORS ChangeLog NEWS README.md RELEASE )
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}"/gst-plugins-good-1.24.13-fix-out-of-bounds-when-parsing-PlayReady-DRM-UUIDs.patch
|
||||
"${FILESDIR}"/gst-plugins-good-1.24.13-dont-allow-use-of-vulnerable-rtpqdm2depay-element.patch
|
||||
)
|
||||
|
||||
multilib_src_configure() {
|
||||
# gst/matroska can use bzip2
|
||||
GST_PLUGINS_NOAUTO="bz2"
|
||||
|
||||
local emesonargs=(
|
||||
-Dbz2=enabled
|
||||
)
|
||||
|
||||
gstreamer_multilib_src_configure
|
||||
}
|
||||
|
||||
multilib_src_test() {
|
||||
# Homebrew test skips for meson
|
||||
local -a tests
|
||||
tests=( $(meson test --list -C "${BUILD_DIR}") )
|
||||
|
||||
local -a _skip_tests=(
|
||||
# known flaky test bug #930448
|
||||
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2803
|
||||
elements_flvmux
|
||||
)
|
||||
|
||||
# Add suites which in this case are the project name
|
||||
if has_version ">=dev-build/meson-1.9.2"; then
|
||||
local -a skip_tests=()
|
||||
for skip_test in ${_skip_tests[@]}; do
|
||||
skip_tests+=( "${PN}:${skip_test}" )
|
||||
done
|
||||
else
|
||||
local -a skip_tests=( ${_skip_tests[@]} )
|
||||
fi
|
||||
unset _skip_tests
|
||||
|
||||
for test_index in ${!tests[@]}; do
|
||||
if [[ ${skip_tests[@]} =~ ${tests[${test_index}]} ]]; then
|
||||
unset tests[${test_index}]
|
||||
fi
|
||||
done
|
||||
|
||||
# gstreamer_multilib_src_test doesn't pass arguments
|
||||
GST_GL_WINDOW=x11 virtx meson_src_test --timeout-multiplier 5 ${tests[@]}
|
||||
}
|
||||
Reference in New Issue
Block a user