diff --git a/media-libs/gst-plugins-good/files/gst-plugins-good-1.24.13-dont-allow-use-of-vulnerable-rtpqdm2depay-element.patch b/media-libs/gst-plugins-good/files/gst-plugins-good-1.24.13-dont-allow-use-of-vulnerable-rtpqdm2depay-element.patch new file mode 100644 index 0000000000000..22627932a91f7 --- /dev/null +++ b/media-libs/gst-plugins-good/files/gst-plugins-good-1.24.13-dont-allow-use-of-vulnerable-rtpqdm2depay-element.patch @@ -0,0 +1,111 @@ +https://bugs.gentoo.org/970987 +https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/10949 +https://gstreamer.freedesktop.org/security/sa-2026-0008.html +CVE-2026-3083 +CVE-2026-3085 +ZDI-26-166 +ZDI-26-167 +ZDI-CAN-28850 +ZDI-CAN-28851 + +From f39b6aeeb7da2ab85c9a2f37d76c5c725c947a28 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tim-Philipp=20M=C3=BCller?= +Date: Sun, 8 Feb 2026 16:01:21 +0000 +Subject: [PATCH] rtpqdm2depay: error out if anyone tries to use this element + +Forbid use of this element and comment out all processing code. + +There is no plausible reason this code should ever be executed in 2026 +seeing that this was a streaming format produced by Darwin Streaming Server +ca 2009 which hasn't been in active use for well over a decade. + +We simply error out for now as defensive measure and will remove the +element entirely in the next release cycle. + +The processing functions are hairy and rather tedious to fix without +at least some sample stream at hand. + +If anyone actually does have a legitimate need for this element and +can provide a sample streams, we will happily implement a depayloader +in Rust. + +Fixes ZDI-CAN-28850, ZDI-CAN-28851, ZDI-CAN-28851, ZDI-CAN-28850, GST-SA-2026-0008. + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4903 +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4890 + +Part-of: +--- a/gst/rtp/gstrtpqdmdepay.c ++++ b/gst/rtp/gstrtpqdmdepay.c +@@ -57,11 +57,13 @@ G_DEFINE_TYPE (GstRtpQDM2Depay, gst_rtp_qdm2_depay, + GST_ELEMENT_REGISTER_DEFINE_WITH_CODE (rtpqdm2depay, "rtpqdm2depay", + GST_RANK_SECONDARY, GST_TYPE_RTP_QDM2_DEPAY, _do_init); + ++#if 0 + static const guint8 headheader[20] = { + 0x0, 0x0, 0x0, 0xc, 0x66, 0x72, 0x6d, 0x61, + 0x51, 0x44, 0x4d, 0x32, 0x0, 0x0, 0x0, 0x24, + 0x51, 0x44, 0x43, 0x41 + }; ++#endif + + static void gst_rtp_qdm2_depay_finalize (GObject * object); + +@@ -138,6 +140,7 @@ gst_rtp_qdm2_depay_setcaps (GstRTPBaseDepayload * filter, GstCaps * caps) + return TRUE; + } + ++#if 0 + static void + flush_data (GstRtpQDM2Depay * depay) + { +@@ -230,10 +233,26 @@ add_packet (GstRtpQDM2Depay * depay, guint32 pid, guint32 len, guint8 * data) + memcpy (packet->data + packet->offs, data, len); + packet->offs += len; + } ++#endif + + static GstBuffer * + gst_rtp_qdm2_depay_process (GstRTPBaseDepayload * depayload, GstRTPBuffer * rtp) + { ++ /* There is no plausible reason this code should ever be executed in 2026 ++ * seeing that this was a streaming format produced by Darwin Streaming Server ++ * ca 2009 which hasn't been in active use for well over a decade. ++ * ++ * We simply return here as defensive measure. ++ * ++ * We post an error message in the state change function, so this processing ++ * function should never be reached, we just ifdef the code out for clarity. ++ * ++ * If anyone actually does have a legitimate need for this and can provide ++ * sample streams, we will happily implement a depayloader in Rust. ++ */ ++ return NULL; ++ ++#if 0 + GstRtpQDM2Depay *rtpqdm2depay; + GstBuffer *outbuf = NULL; + guint16 seq; +@@ -378,6 +397,7 @@ bad_packet: + (NULL), ("Packet was too short")); + return NULL; + } ++#endif + } + + static GstStateChangeReturn +@@ -391,7 +411,10 @@ gst_rtp_qdm2_depay_change_state (GstElement * element, + + switch (transition) { + case GST_STATE_CHANGE_NULL_TO_READY: +- break; ++ GST_ELEMENT_ERROR (rtpqdm2depay, STREAM, DECODE, ++ ("This element should not be used."), ++ ("Please report an issue if you encounter this message.")); ++ return GST_STATE_CHANGE_FAILURE; + case GST_STATE_CHANGE_READY_TO_PAUSED: + gst_adapter_clear (rtpqdm2depay->adapter); + break; +-- +GitLab + diff --git a/media-libs/gst-plugins-good/files/gst-plugins-good-1.24.13-fix-out-of-bounds-when-parsing-PlayReady-DRM-UUIDs.patch b/media-libs/gst-plugins-good/files/gst-plugins-good-1.24.13-fix-out-of-bounds-when-parsing-PlayReady-DRM-UUIDs.patch new file mode 100644 index 0000000000000..97972dc27d05c --- /dev/null +++ b/media-libs/gst-plugins-good/files/gst-plugins-good-1.24.13-fix-out-of-bounds-when-parsing-PlayReady-DRM-UUIDs.patch @@ -0,0 +1,56 @@ +https://bugs.gentoo.org/970987 +https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/10880 +https://gstreamer.freedesktop.org/security/sa-2026-0002.html + +From ce0a11b2657bbc434c570ffedd81668d44fd1277 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Thu, 22 Jan 2026 08:13:56 +0200 +Subject: [PATCH] qtdemux: Fix out-of-bounds read when parsing PlayReady DRM + UUIDs + +Fixes GST-SA-2026-0002. + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4865 + +Part-of: +--- a/gst/isomp4/qtdemux.c ++++ b/gst/isomp4/qtdemux.c +@@ -3036,7 +3036,7 @@ qtdemux_parse_piff (GstQTDemux * qtdemux, const guint8 * buffer, gint length, + } + + static void +-qtdemux_parse_uuid (GstQTDemux * qtdemux, const guint8 * buffer, gint length) ++qtdemux_parse_uuid (GstQTDemux * qtdemux, const guint8 * buffer, gsize length) + { + static const guint8 xmp_uuid[] = { 0xBE, 0x7A, 0xCF, 0xCB, + 0x97, 0xA9, 0x42, 0xE8, +@@ -3080,16 +3080,18 @@ qtdemux_parse_uuid (GstQTDemux * qtdemux, const guint8 * buffer, gint length) + qtdemux_handle_xmp_taglist (qtdemux, qtdemux->tag_list, taglist); + + } else if (memcmp (buffer + offset, playready_uuid, 16) == 0) { +- int len; +- const gunichar2 *s_utf16; +- char *contents; ++ if (length >= offset + 0x30 + 2) { ++ guint16 len = GST_READ_UINT16_LE (buffer + offset + 0x30); + +- len = GST_READ_UINT16_LE (buffer + offset + 0x30); +- s_utf16 = (const gunichar2 *) (buffer + offset + 0x32); +- contents = g_utf16_to_utf8 (s_utf16, len / 2, NULL, NULL, NULL); +- GST_ERROR_OBJECT (qtdemux, "contents: %s", contents); ++ if (length >= offset + 0x30 + 2 + len) { ++ const gunichar2 *s_utf16 = (const gunichar2 *) (buffer + offset + 0x32); ++ char *contents = g_utf16_to_utf8 (s_utf16, len / 2, NULL, NULL, NULL); + +- g_free (contents); ++ GST_ERROR_OBJECT (qtdemux, "contents: %s", GST_STR_NULL (contents)); ++ ++ g_free (contents); ++ } ++ } + + GST_ELEMENT_ERROR (qtdemux, STREAM, DECRYPT, + (_("Cannot play stream because it is encrypted with PlayReady DRM.")), +-- +GitLab + diff --git a/media-libs/gst-plugins-good/gst-plugins-good-1.24.13-r1.ebuild b/media-libs/gst-plugins-good/gst-plugins-good-1.24.13-r1.ebuild new file mode 100644 index 0000000000000..832e78ace085e --- /dev/null +++ b/media-libs/gst-plugins-good/gst-plugins-good-1.24.13-r1.ebuild @@ -0,0 +1,74 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 +GST_ORG_MODULE="gst-plugins-good" + +inherit gstreamer-meson virtualx + +DESCRIPTION="Basepack of plugins for GStreamer" +HOMEPAGE="https://gstreamer.freedesktop.org/" + +LICENSE="LGPL-2.1+" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86" +IUSE="+orc" + +# Old media-libs/gst-plugins-ugly blocker for xingmux moving from ugly->good +RDEPEND=" + !=media-libs/gst-plugins-base-${PV}:${SLOT}[${MULTILIB_USEDEP}] + >=app-arch/bzip2-1.0.6-r4[${MULTILIB_USEDEP}] + >=virtual/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}] + orc? ( >=dev-lang/orc-0.4.33[${MULTILIB_USEDEP}] ) +" +DEPEND="${RDEPEND}" + +DOCS=( AUTHORS ChangeLog NEWS README.md RELEASE ) + +PATCHES=( + "${FILESDIR}"/gst-plugins-good-1.24.13-fix-out-of-bounds-when-parsing-PlayReady-DRM-UUIDs.patch + "${FILESDIR}"/gst-plugins-good-1.24.13-dont-allow-use-of-vulnerable-rtpqdm2depay-element.patch +) + +multilib_src_configure() { + # gst/matroska can use bzip2 + GST_PLUGINS_NOAUTO="bz2" + + local emesonargs=( + -Dbz2=enabled + ) + + gstreamer_multilib_src_configure +} + +multilib_src_test() { + # Homebrew test skips for meson + local -a tests + tests=( $(meson test --list -C "${BUILD_DIR}") ) + + local -a _skip_tests=( + # known flaky test bug #930448 + # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2803 + elements_flvmux + ) + + # Add suites which in this case are the project name + if has_version ">=dev-build/meson-1.9.2"; then + local -a skip_tests=() + for skip_test in ${_skip_tests[@]}; do + skip_tests+=( "${PN}:${skip_test}" ) + done + else + local -a skip_tests=( ${_skip_tests[@]} ) + fi + unset _skip_tests + + for test_index in ${!tests[@]}; do + if [[ ${skip_tests[@]} =~ ${tests[${test_index}]} ]]; then + unset tests[${test_index}] + fi + done + + # gstreamer_multilib_src_test doesn't pass arguments + GST_GL_WINDOW=x11 virtx meson_src_test --timeout-multiplier 5 ${tests[@]} +}