summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorVijay Anusuri <vanusuri@mvista.com>2025-01-05 11:13:10 +0530
committerSteve Sakoman <steve@sakoman.com>2025-01-09 08:41:04 -0800
commit3ad4123a24e35c13273531ebcc34bd81328f3da3 (patch)
tree218e169229887406c5b0db6cb351efbe7e76f2d5
parent6539977df41db8f7f0c920548450dace9421b2ec (diff)
downloadpoky-3ad4123a24e35c13273531ebcc34bd81328f3da3.tar.gz
gstreamer1.0-plugins-base: Fix for multiple CVE's
Backport fixes for below CVE: CVE-2024-47538 CVE-2024-47541 CVE-2024-47542 CVE-2024-47600 CVE-2024-47607 CVE-2024-47615 CVE-2024-47835 (From OE-Core rev: a26f77ae6d98e0bf22a682fad5f4353ae257b360) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat
-rw-r--r--meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47538.patch35
-rw-r--r--meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47541-1.patch38
-rw-r--r--meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47541-2.patch99
-rw-r--r--meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47542.patch64
-rw-r--r--meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47600.patch38
-rw-r--r--meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47607.patch41
-rw-r--r--meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47615-1.patch79
-rw-r--r--meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47615-2.patch168
-rw-r--r--meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47835.patch39
-rw-r--r--meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.7.bb9
10 files changed, 610 insertions, 0 deletions
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47538.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47538.patch
new file mode 100644
index 0000000000..3e353b39fd
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47538.patch
@@ -0,0 +1,35 @@
1From 7eb26b198beffecdba4dbb64299f9cb09a9181d6 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
3Date: Mon, 30 Sep 2024 21:35:07 +0300
4Subject: [PATCH] vorbisdec: Set at most 64 channels to NONE position
5
6Thanks to Antonio Morales for finding and reporting the issue.
7
8Fixes GHSL-2024-115
9Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3869
10
11Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8047>
12
13Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/7eb26b198beffecdba4dbb64299f9cb09a9181d6]
14CVE: CVE-2024-47538
15Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
16---
17 subprojects/gst-plugins-base/ext/vorbis/gstvorbisdec.c | 2 +-
18 1 file changed, 1 insertion(+), 1 deletion(-)
19
20diff --git a/subprojects/gst-plugins-base/ext/vorbis/gstvorbisdec.c b/subprojects/gst-plugins-base/ext/vorbis/gstvorbisdec.c
21index 6a410ed858ca..1fc4fa883e68 100644
22--- a/ext/vorbis/gstvorbisdec.c
23+++ b/ext/vorbis/gstvorbisdec.c
24@@ -204,7 +204,7 @@ vorbis_handle_identification_packet (GstVorbisDec * vd)
25 }
26 default:{
27 GstAudioChannelPosition position[64];
28- gint i, max_pos = MAX (vd->vi.channels, 64);
29+ gint i, max_pos = MIN (vd->vi.channels, 64);
30
31 GST_ELEMENT_WARNING (vd, STREAM, DECODE,
32 (NULL), ("Using NONE channel layout for more than 8 channels"));
33--
34GitLab
35
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47541-1.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47541-1.patch
new file mode 100644
index 0000000000..32628f323c
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47541-1.patch
@@ -0,0 +1,38 @@
1From 7108073b5be73eb2482eb8494745962b8c0571f1 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
3Date: Mon, 30 Sep 2024 21:40:44 +0300
4Subject: [PATCH] ssaparse: Search for closing brace after opening brace
5
6Otherwise removing anything between the braces leads to out of bound writes if
7there is a closing brace before the first opening brace.
8
9Thanks to Antonio Morales for finding and reporting the issue.
10
11Fixes GHSL-2024-228
12Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3870
13
14Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8048>
15
16Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/7108073b5be73eb2482eb8494745962b8c0571f1]
17CVE: CVE-2024-47541
18Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
19---
20 subprojects/gst-plugins-base/gst/subparse/gstssaparse.c | 2 +-
21 1 file changed, 1 insertion(+), 1 deletion(-)
22
23diff --git a/subprojects/gst-plugins-base/gst/subparse/gstssaparse.c b/subprojects/gst-plugins-base/gst/subparse/gstssaparse.c
24index 42fbb42b99fe..37b892e92843 100644
25--- a/gst/subparse/gstssaparse.c
26+++ b/gst/subparse/gstssaparse.c
27@@ -238,7 +238,7 @@ gst_ssa_parse_remove_override_codes (GstSsaParse * parse, gchar * txt)
28 gboolean removed_any = FALSE;
29
30 while ((t = strchr (txt, '{'))) {
31- end = strchr (txt, '}');
32+ end = strchr (t, '}');
33 if (end == NULL) {
34 GST_WARNING_OBJECT (parse, "Missing { for style override code");
35 return removed_any;
36--
37GitLab
38
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47541-2.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47541-2.patch
new file mode 100644
index 0000000000..5d0d13a3ff
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47541-2.patch
@@ -0,0 +1,99 @@
1From b66cf81e99ab9f400b6aea79a4b597c5ddac324d Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
3Date: Mon, 30 Sep 2024 18:36:19 +0300
4Subject: [PATCH] ssaparse: Don't use strstr() on strings that are potentially
5 not NULL-terminated
6
7Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8048>
8
9Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/b66cf81e99ab9f400b6aea79a4b597c5ddac324d]
10CVE: CVE-2024-47541
11Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
12---
13 .../gst/subparse/gstssaparse.c | 36 ++++++++++++++++++-
14 subprojects/gst-plugins-base/meson.build | 1 +
15 2 files changed, 36 insertions(+), 1 deletion(-)
16
17diff --git a/subprojects/gst-plugins-base/gst/subparse/gstssaparse.c b/subprojects/gst-plugins-base/gst/subparse/gstssaparse.c
18index 37b892e92843..c162a542f581 100644
19--- a/gst/subparse/gstssaparse.c
20+++ b/gst/subparse/gstssaparse.c
21@@ -146,6 +146,35 @@ gst_ssa_parse_sink_event (GstPad * pad, GstObject * parent, GstEvent * event)
22 return res;
23 }
24
25+#ifndef HAVE_MEMMEM
26+// memmem() is a GNU extension so if it's not available we'll need
27+// our own implementation here. Thanks C.
28+static void *
29+my_memmem (const void *haystack, size_t haystacklen, const void *needle,
30+ size_t needlelen)
31+{
32+ const guint8 *cur, *end;
33+
34+ if (needlelen > haystacklen)
35+ return NULL;
36+ if (needlelen == 0)
37+ return (void *) haystack;
38+
39+
40+ cur = haystack;
41+ end = cur + haystacklen - needlelen;
42+
43+ for (; cur <= end; cur++) {
44+ if (memcmp (cur, needle, needlelen) == 0)
45+ return (void *) cur;
46+ }
47+
48+ return NULL;
49+}
50+#else
51+#define my_memmem memmem
52+#endif
53+
54 static gboolean
55 gst_ssa_parse_setcaps (GstPad * sinkpad, GstCaps * caps)
56 {
57@@ -154,6 +183,7 @@ gst_ssa_parse_setcaps (GstPad * sinkpad, GstCaps * caps)
58 const GValue *val;
59 GstStructure *s;
60 const guchar bom_utf8[] = { 0xEF, 0xBB, 0xBF };
61+ const guint8 header[] = "[Script Info]";
62 const gchar *end;
63 GstBuffer *priv;
64 GstMapInfo map;
65@@ -193,7 +223,7 @@ gst_ssa_parse_setcaps (GstPad * sinkpad, GstCaps * caps)
66 left -= 3;
67 }
68
69- if (!strstr (ptr, "[Script Info]"))
70+ if (!my_memmem (ptr, left, header, sizeof (header) - 1))
71 goto invalid_init;
72
73 if (!g_utf8_validate (ptr, left, &end)) {
74@@ -231,6 +261,10 @@ invalid_init:
75 }
76 }
77
78+#ifdef my_memmem
79+#undef my_memmem
80+#endif
81+
82 static gboolean
83 gst_ssa_parse_remove_override_codes (GstSsaParse * parse, gchar * txt)
84 {
85diff --git a/subprojects/gst-plugins-base/meson.build b/subprojects/gst-plugins-base/meson.build
86index 65c5d944d30f..91f2b77aec23 100644
87--- a/meson.build
88+++ b/meson.build
89@@ -197,6 +197,7 @@ check_functions = [
90 ['HAVE_LRINTF', 'lrintf', '#include<math.h>'],
91 ['HAVE_MMAP', 'mmap', '#include<sys/mman.h>'],
92 ['HAVE_LOG2', 'log2', '#include<math.h>'],
93+ ['HAVE_MEMMEM', 'memmem', '#include<string.h>'],
94 ]
95
96 libm = cc.find_library('m', required : false)
97--
98GitLab
99
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47542.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47542.patch
new file mode 100644
index 0000000000..b982c04c40
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47542.patch
@@ -0,0 +1,64 @@
1From 921d8daa00c329932616dd5d197b601a7e271e79 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
3Date: Thu, 26 Sep 2024 13:43:06 +0300
4Subject: [PATCH] id3v2: Don't try parsing extended header if not enough data
5 is available
6
7Thanks to Antonio Morales for finding and reporting the issue.
8
9Fixes GHSL-2024-235
10Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3842
11
12Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8045>
13
14Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/921d8daa00c329932616dd5d197b601a7e271e79]
15CVE: CVE-2024-47542
16Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
17---
18 subprojects/gst-plugins-base/gst-libs/gst/tag/id3v2.c | 11 ++++++++---
19 1 file changed, 8 insertions(+), 3 deletions(-)
20
21diff --git a/subprojects/gst-plugins-base/gst-libs/gst/tag/id3v2.c b/subprojects/gst-plugins-base/gst-libs/gst/tag/id3v2.c
22index 7db2cb7e12b6..70f975d13374 100644
23--- a/gst-libs/gst/tag/id3v2.c
24+++ b/gst-libs/gst/tag/id3v2.c
25@@ -29,7 +29,7 @@
26
27 #define HANDLE_INVALID_SYNCSAFE
28
29-static gboolean id3v2_frames_to_tag_list (ID3TagsWorking * work, guint size);
30+static gboolean id3v2_frames_to_tag_list (ID3TagsWorking * work);
31
32 #ifndef GST_DISABLE_GST_DEBUG
33
34@@ -258,7 +258,7 @@ gst_tag_list_from_id3v2_tag (GstBuffer * buffer)
35 GST_MEMDUMP ("ID3v2 tag (un-unsyced)", uu_data, work.hdr.frame_data_size);
36 }
37
38- id3v2_frames_to_tag_list (&work, work.hdr.frame_data_size);
39+ id3v2_frames_to_tag_list (&work);
40
41 g_free (uu_data);
42
43@@ -440,12 +440,17 @@ id3v2_add_id3v2_frame_blob_to_taglist (ID3TagsWorking * work,
44 }
45
46 static gboolean
47-id3v2_frames_to_tag_list (ID3TagsWorking * work, guint size)
48+id3v2_frames_to_tag_list (ID3TagsWorking * work)
49 {
50 guint frame_hdr_size;
51
52 /* Extended header if present */
53 if (work->hdr.flags & ID3V2_HDR_FLAG_EXTHDR) {
54+ if (work->hdr.frame_data_size < 4) {
55+ GST_DEBUG ("Tag has no extended header data. Broken tag");
56+ return FALSE;
57+ }
58+
59 work->hdr.ext_hdr_size = id3v2_read_synch_uint (work->hdr.frame_data, 4);
60
61 /* In id3v2.4.x the header size is the size of the *whole*
62--
63GitLab
64
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47600.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47600.patch
new file mode 100644
index 0000000000..04bde3e62c
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47600.patch
@@ -0,0 +1,38 @@
1From 5b205225e2c6a19ddcace350fdc18a0edf87bcb5 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
3Date: Mon, 30 Sep 2024 18:19:30 +0300
4Subject: [PATCH] discoverer: Don't print channel layout for more than 64
5 channels
6
764+ channels are always unpositioned / unknown layout.
8
9Thanks to Antonio Morales for finding and reporting the issue.
10
11Fixes GHSL-2024-248
12Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3864
13
14Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8046>
15
16Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/5b205225e2c6a19ddcace350fdc18a0edf87bcb5]
17CVE: CVE-2024-47600
18Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
19---
20 subprojects/gst-plugins-base/tools/gst-discoverer.c | 2 +-
21 1 file changed, 1 insertion(+), 1 deletion(-)
22
23diff --git a/subprojects/gst-plugins-base/tools/gst-discoverer.c b/subprojects/gst-plugins-base/tools/gst-discoverer.c
24index b042be535d15..6028fc71c9d0 100644
25--- a/tools/gst-discoverer.c
26+++ b/tools/gst-discoverer.c
27@@ -222,7 +222,7 @@ format_channel_mask (GstDiscovererAudioInfo * ainfo)
28
29 channel_mask = gst_discoverer_audio_info_get_channel_mask (ainfo);
30
31- if (channel_mask != 0) {
32+ if (channel_mask != 0 && channels <= 64) {
33 gst_audio_channel_positions_from_mask (channels, channel_mask, position);
34
35 for (i = 0; i < channels; i++) {
36--
37GitLab
38
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47607.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47607.patch
new file mode 100644
index 0000000000..48249652d9
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47607.patch
@@ -0,0 +1,41 @@
1From 804eca458fb547942ed70b88c021b996be9228a2 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
3Date: Tue, 1 Oct 2024 13:22:50 +0300
4Subject: [PATCH] opusdec: Set at most 64 channels to NONE position
5
6Thanks to Antonio Morales for finding and reporting the issue.
7
8Fixes GHSL-2024-116
9Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3871
10
11Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8049>
12
13Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/804eca458fb547942ed70b88c021b996be9228a2]
14CVE: CVE-2024-47607
15Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
16---
17 subprojects/gst-plugins-base/ext/opus/gstopusdec.c | 4 ++--
18 1 file changed, 2 insertions(+), 2 deletions(-)
19
20diff --git a/subprojects/gst-plugins-base/ext/opus/gstopusdec.c b/subprojects/gst-plugins-base/ext/opus/gstopusdec.c
21index 99289fa7d223..d3f461d9a821 100644
22--- a/ext/opus/gstopusdec.c
23+++ b/ext/opus/gstopusdec.c
24@@ -440,12 +440,12 @@ gst_opus_dec_parse_header (GstOpusDec * dec, GstBuffer * buf)
25 posn = gst_opus_channel_positions[dec->n_channels - 1];
26 break;
27 default:{
28- gint i;
29+ guint i, max_pos = MIN (dec->n_channels, 64);
30
31 GST_ELEMENT_WARNING (GST_ELEMENT (dec), STREAM, DECODE,
32 (NULL), ("Using NONE channel layout for more than 8 channels"));
33
34- for (i = 0; i < dec->n_channels; i++)
35+ for (i = 0; i < max_pos; i++)
36 pos[i] = GST_AUDIO_CHANNEL_POSITION_NONE;
37
38 posn = pos;
39--
40GitLab
41
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47615-1.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47615-1.patch
new file mode 100644
index 0000000000..d9619ede52
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47615-1.patch
@@ -0,0 +1,79 @@
1From 30fa21ac45ef5dad2fef0d98f0e7130c75f0b628 Mon Sep 17 00:00:00 2001
2From: Mathieu Duponchelle <mathieu@centricular.com>
3Date: Wed, 2 Oct 2024 15:16:30 +0200
4Subject: [PATCH] vorbis_parse: check writes to GstOggStream.vorbis_mode_sizes
5
6Thanks to Antonio Morales for finding and reporting the issue.
7
8Fixes GHSL-2024-117 Fixes gstreamer#3875
9
10Also perform out-of-bounds check for accesses to op->packet
11
12Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8050>
13
14Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/30fa21ac45ef5dad2fef0d98f0e7130c75f0b628]
15CVE: CVE-2024-47615
16Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
17---
18 .../gst-plugins-base/ext/ogg/vorbis_parse.c | 21 +++++++++++++++++++
19 1 file changed, 21 insertions(+)
20
21diff --git a/subprojects/gst-plugins-base/ext/ogg/vorbis_parse.c b/subprojects/gst-plugins-base/ext/ogg/vorbis_parse.c
22index 65ef463808e1..757c7cd82b8d 100644
23--- a/ext/ogg/vorbis_parse.c
24+++ b/ext/ogg/vorbis_parse.c
25@@ -165,6 +165,10 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
26 if (offset == 0) {
27 offset = 8;
28 current_pos -= 1;
29+
30+ /* have we underrun? */
31+ if (current_pos < op->packet)
32+ return -1;
33 }
34 }
35
36@@ -178,6 +182,10 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
37 if (offset == 7)
38 current_pos -= 1;
39
40+ /* have we underrun? */
41+ if (current_pos < op->packet + 5)
42+ return -1;
43+
44 if (((current_pos[-5] & ~((1 << (offset + 1)) - 1)) != 0)
45 ||
46 current_pos[-4] != 0
47@@ -199,9 +207,18 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
48 /* Give ourselves a chance to recover if we went back too far by using
49 * the size check. */
50 for (ii = 0; ii < 2; ii++) {
51+
52 if (offset > 4) {
53+ /* have we underrun? */
54+ if (current_pos < op->packet)
55+ return -1;
56+
57 size_check = (current_pos[0] >> (offset - 5)) & 0x3F;
58 } else {
59+ /* have we underrun? */
60+ if (current_pos < op->packet + 1)
61+ return -1;
62+
63 /* mask part of byte from current_pos */
64 size_check = (current_pos[0] & ((1 << (offset + 1)) - 1));
65 /* shift to appropriate position */
66@@ -233,6 +250,10 @@ gst_parse_vorbis_setup_packet (GstOggStream * pad, ogg_packet * op)
67
68 mode_size_ptr = pad->vorbis_mode_sizes;
69
70+ if (size > G_N_ELEMENTS (pad->vorbis_mode_sizes)) {
71+ return -1;
72+ }
73+
74 for (i = 0; i < size; i++) {
75 offset = (offset + 1) % 8;
76 if (offset == 0)
77--
78GitLab
79
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47615-2.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47615-2.patch
new file mode 100644
index 0000000000..c5f1dfbb80
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47615-2.patch
@@ -0,0 +1,168 @@
1From c94c44ce497d285ebcfe866b9faaae9c66c81132 Mon Sep 17 00:00:00 2001
2From: Mathieu Duponchelle <mathieu@centricular.com>
3Date: Wed, 2 Oct 2024 16:52:51 +0200
4Subject: [PATCH] oggstream: review and fix per-format min_packet_size
5
6This addresses all manually detected invalid reads in setup functions.
7
8Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8050>
9
10Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c94c44ce497d285ebcfe866b9faaae9c66c81132]
11CVE: CVE-2024-47615
12Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
13---
14 .../gst-plugins-base/ext/ogg/gstoggstream.c | 40 ++++++-------------
15 1 file changed, 12 insertions(+), 28 deletions(-)
16
17diff --git a/subprojects/gst-plugins-base/ext/ogg/gstoggstream.c b/subprojects/gst-plugins-base/ext/ogg/gstoggstream.c
18index a8883304a5c0..ab6be238dc48 100644
19--- a/ext/ogg/gstoggstream.c
20+++ b/ext/ogg/gstoggstream.c
21@@ -665,11 +665,6 @@ setup_vp8_mapper (GstOggStream * pad, ogg_packet * packet)
22 {
23 gint width, height, par_n, par_d, fps_n, fps_d;
24
25- if (packet->bytes < 26) {
26- GST_DEBUG ("Failed to parse VP8 BOS page");
27- return FALSE;
28- }
29-
30 width = GST_READ_UINT16_BE (packet->packet + 8);
31 height = GST_READ_UINT16_BE (packet->packet + 10);
32 par_n = GST_READ_UINT24_BE (packet->packet + 12);
33@@ -1221,11 +1216,6 @@ setup_fishead_mapper (GstOggStream * pad, ogg_packet * packet)
34 gint64 prestime_n, prestime_d;
35 gint64 basetime_n, basetime_d;
36
37- if (packet->bytes < 44) {
38- GST_DEBUG ("Not enough data for fishead header");
39- return FALSE;
40- }
41-
42 data = packet->packet;
43
44 data += 8; /* header */
45@@ -1256,8 +1246,8 @@ setup_fishead_mapper (GstOggStream * pad, ogg_packet * packet)
46 pad->prestime = -1;
47
48 /* Ogg Skeleton 3.3+ streams provide additional information in the header */
49- if (packet->bytes >= SKELETON_FISHEAD_3_3_MIN_SIZE && pad->skeleton_major == 3
50- && pad->skeleton_minor > 0) {
51+ if (packet->bytes - 44 >= SKELETON_FISHEAD_3_3_MIN_SIZE
52+ && pad->skeleton_major == 3 && pad->skeleton_minor > 0) {
53 gint64 firstsampletime_n, firstsampletime_d;
54 gint64 lastsampletime_n, lastsampletime_d;
55 gint64 firstsampletime, lastsampletime;
56@@ -1296,7 +1286,7 @@ setup_fishead_mapper (GstOggStream * pad, ogg_packet * packet)
57
58 GST_INFO ("skeleton fishead parsed total: %" GST_TIME_FORMAT,
59 GST_TIME_ARGS (pad->total_time));
60- } else if (packet->bytes >= SKELETON_FISHEAD_4_0_MIN_SIZE
61+ } else if (packet->bytes - 44 >= SKELETON_FISHEAD_4_0_MIN_SIZE
62 && pad->skeleton_major == 4) {
63 guint64 segment_length, content_offset;
64
65@@ -1980,9 +1970,6 @@ setup_kate_mapper (GstOggStream * pad, ogg_packet * packet)
66 guint8 *data = packet->packet;
67 const char *category;
68
69- if (packet->bytes < 64)
70- return FALSE;
71-
72 pad->granulerate_n = GST_READ_UINT32_LE (data + 24);
73 pad->granulerate_d = GST_READ_UINT32_LE (data + 28);
74 pad->granuleshift = GST_READ_UINT8 (data + 15);
75@@ -2111,9 +2098,6 @@ setup_opus_mapper (GstOggStream * pad, ogg_packet * packet)
76 {
77 GstBuffer *buffer;
78
79- if (packet->bytes < 19)
80- return FALSE;
81-
82 pad->granulerate_n = 48000;
83 pad->granulerate_d = 1;
84 pad->granuleshift = 0;
85@@ -2394,7 +2378,7 @@ const GstOggMap mappers[] = {
86 NULL
87 },
88 {
89- "\001vorbis", 7, 22,
90+ "\001vorbis", 7, 29,
91 "audio/x-vorbis",
92 setup_vorbis_mapper,
93 NULL,
94@@ -2426,7 +2410,7 @@ const GstOggMap mappers[] = {
95 NULL
96 },
97 {
98- "PCM ", 8, 0,
99+ "PCM ", 8, 28,
100 "audio/x-raw",
101 setup_pcm_mapper,
102 NULL,
103@@ -2442,7 +2426,7 @@ const GstOggMap mappers[] = {
104 NULL
105 },
106 {
107- "CMML\0\0\0\0", 8, 0,
108+ "CMML\0\0\0\0", 8, 29,
109 "text/x-cmml",
110 setup_cmml_mapper,
111 NULL,
112@@ -2458,7 +2442,7 @@ const GstOggMap mappers[] = {
113 NULL
114 },
115 {
116- "Annodex", 7, 0,
117+ "Annodex", 7, 44,
118 "application/x-annodex",
119 setup_fishead_mapper,
120 NULL,
121@@ -2537,7 +2521,7 @@ const GstOggMap mappers[] = {
122 NULL
123 },
124 {
125- "CELT ", 8, 0,
126+ "CELT ", 8, 60,
127 "audio/x-celt",
128 setup_celt_mapper,
129 NULL,
130@@ -2553,7 +2537,7 @@ const GstOggMap mappers[] = {
131 NULL
132 },
133 {
134- "\200kate\0\0\0", 8, 0,
135+ "\200kate\0\0\0", 8, 64,
136 "text/x-kate",
137 setup_kate_mapper,
138 NULL,
139@@ -2585,7 +2569,7 @@ const GstOggMap mappers[] = {
140 NULL
141 },
142 {
143- "OVP80\1\1", 7, 4,
144+ "OVP80\1\1", 7, 26,
145 "video/x-vp8",
146 setup_vp8_mapper,
147 setup_vp8_mapper_from_caps,
148@@ -2601,7 +2585,7 @@ const GstOggMap mappers[] = {
149 update_stats_vp8
150 },
151 {
152- "OpusHead", 8, 0,
153+ "OpusHead", 8, 19,
154 "audio/x-opus",
155 setup_opus_mapper,
156 NULL,
157@@ -2649,7 +2633,7 @@ const GstOggMap mappers[] = {
158 NULL
159 },
160 {
161- "\001text\0\0\0", 9, 9,
162+ "\001text\0\0\0", 9, 25,
163 "application/x-ogm-text",
164 setup_ogmtext_mapper,
165 NULL,
166--
167GitLab
168
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47835.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47835.patch
new file mode 100644
index 0000000000..e5ee5d9d1d
--- /dev/null
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/CVE-2024-47835.patch
@@ -0,0 +1,39 @@
1From 1a5fdba14a1ccfe473bc4429f22ee5bbaee034eb Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
3Date: Wed, 9 Oct 2024 11:23:47 -0400
4Subject: [PATCH] subparse: Check for NULL return of strchr() when parsing LRC
5 subtitles
6
7Thanks to Antonio Morales for finding and reporting the issue.
8
9Fixes GHSL-2024-263
10Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3892
11
12Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8051>
13
14Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/1a5fdba14a1ccfe473bc4429f22ee5bbaee034eb]
15CVE: CVE-2024-47835
16Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
17---
18 subprojects/gst-plugins-base/gst/subparse/gstsubparse.c | 5 +++++
19 1 file changed, 5 insertions(+)
20
21diff --git a/subprojects/gst-plugins-base/gst/subparse/gstsubparse.c b/subprojects/gst-plugins-base/gst/subparse/gstsubparse.c
22index 994cf62d1acc..4fe43d91003f 100644
23--- a/gst/subparse/gstsubparse.c
24+++ b/gst/subparse/gstsubparse.c
25@@ -1066,6 +1066,11 @@ parse_lrc (ParserState * state, const gchar * line)
26 return NULL;
27
28 start = strchr (line, ']');
29+ // sscanf() does not check for the trailing ] but only up to the last
30+ // placeholder, so there might be no ] at the end.
31+ if (!start)
32+ return NULL;
33+
34 if (start - line == 9)
35 milli = 10;
36 else
37--
38GitLab
39
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.7.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.7.bb
index 368698b58b..fc9afff628 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.7.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.7.bb
@@ -11,6 +11,15 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-ba
11 file://0003-viv-fb-Make-sure-config.h-is-included.patch \ 11 file://0003-viv-fb-Make-sure-config.h-is-included.patch \
12 file://0002-ssaparse-enhance-SSA-text-lines-parsing.patch \ 12 file://0002-ssaparse-enhance-SSA-text-lines-parsing.patch \
13 file://CVE-2024-4453.patch \ 13 file://CVE-2024-4453.patch \
14 file://CVE-2024-47538.patch \
15 file://CVE-2024-47541-1.patch \
16 file://CVE-2024-47541-2.patch \
17 file://CVE-2024-47542.patch \
18 file://CVE-2024-47600.patch \
19 file://CVE-2024-47607.patch \
20 file://CVE-2024-47615-1.patch \
21 file://CVE-2024-47615-2.patch \
22 file://CVE-2024-47835.patch \
14 " 23 "
15SRC_URI[sha256sum] = "fde6696a91875095d82c1012b5777c28ba926047ffce08508e12c1d2c66f0057" 24SRC_URI[sha256sum] = "fde6696a91875095d82c1012b5777c28ba926047ffce08508e12c1d2c66f0057"
16 25
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-22 21:02:32 +0000