Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package gstreamer-plugins-bad for
openSUSE:Factory checked in at 2026-06-22 18:05:06
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/gstreamer-plugins-bad (Old)
and /work/SRC/openSUSE:Factory/.gstreamer-plugins-bad.new.1956 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gstreamer-plugins-bad"
Mon Jun 22 18:05:06 2026 rev:201 rq:1360596 version:1.28.4+24
Changes:
--------
---
/work/SRC/openSUSE:Factory/gstreamer-plugins-bad/gstreamer-plugins-bad.changes
2026-06-13 18:47:07.464898329 +0200
+++
/work/SRC/openSUSE:Factory/.gstreamer-plugins-bad.new.1956/gstreamer-plugins-bad.changes
2026-06-22 18:05:25.049194931 +0200
@@ -1,0 +2,18 @@
+Fri Jun 19 09:07:53 UTC 2026 - Bjørn Lie <[email protected]>
+
+- Update to version 1.28.4+24 (boo#1268406, boo#1268408,
+ boo#1268410, CVE-2026-52720, CVE-2026-52721, CVE-2026-52722):
+ + mxfdemux: fix remaining offsets index entry insertion call site
+ + mxfdemux: fix essence track offsets array population
+ + mxdemux: index entry: use intialized
+ + rtmp2: Remove socket timeout after handshake completes
+ + rtmp2: Don't retry on G_IO_ERROR_TIMED_OUT
+ + vnmdec: Avoid integer overflows when rectangle positions and
+ sizes
+ + pcapparse: Add missing bounds checks to ensure packets are
+ large enough
+ + mpegpsdemux: Release stream lock when seeking fails
+ + librfb: Validate framebuffer update rectangles against the
+ framebuffer size
+
+-------------------------------------------------------------------
@@ -4 +22,2 @@
-- Update to version 1.28.4:
+- Update to version 1.28.4 (boo#1268394, boo#1268401,
+ CVE-2026-52718, CVE-2026-52719):
Old:
----
gst-plugins-bad-1.28.4.obscpio
New:
----
gst-plugins-bad-1.28.4+24.obscpio
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ gstreamer-plugins-bad.spec ++++++
--- /var/tmp/diff_new_pack.kKdGXj/_old 2026-06-22 18:05:26.637250339 +0200
+++ /var/tmp/diff_new_pack.kKdGXj/_new 2026-06-22 18:05:26.641250479 +0200
@@ -81,7 +81,7 @@
%endif
Name: gstreamer-plugins-bad
-Version: 1.28.4
+Version: 1.28.4+24
Release: 0
Summary: GStreamer Streaming-Media Framework Plug-Ins
License: LGPL-2.1-or-later
++++++ _service ++++++
--- /var/tmp/diff_new_pack.kKdGXj/_old 2026-06-22 18:05:26.673251596 +0200
+++ /var/tmp/diff_new_pack.kKdGXj/_new 2026-06-22 18:05:26.677251735 +0200
@@ -5,7 +5,7 @@
<param
name="url">https://gitlab.freedesktop.org/gstreamer/gstreamer.git</param>
<param name="subdir">subprojects/gst-plugins-bad</param>
<param name="filename">gst-plugins-bad</param>
- <param name="revision">1.28.4</param>
+ <param name="revision">6a394d8d</param>
<param name="versionformat">@PARENT_TAG@+@TAG_OFFSET@</param>
<param name="versionrewrite-pattern">v?(.*)\+0</param>
<param name="versionrewrite-replacement">\1</param>
++++++ gst-plugins-bad-1.28.4.obscpio -> gst-plugins-bad-1.28.4+24.obscpio
++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/gst-plugins-bad-1.28.4/gst/librfb/rfbdecoder.c
new/gst-plugins-bad-1.28.4+24/gst/librfb/rfbdecoder.c
--- old/gst-plugins-bad-1.28.4/gst/librfb/rfbdecoder.c 2026-06-12
14:19:43.000000000 +0200
+++ new/gst-plugins-bad-1.28.4+24/gst/librfb/rfbdecoder.c 2026-06-19
10:13:39.000000000 +0200
@@ -45,6 +45,10 @@
gint start_y, gint rect_w, gint rect_h);
static gboolean rfb_decoder_hextile_encoding (RfbDecoder * decoder,
gint start_x, gint start_y, gint rect_w, gint rect_h);
+static gboolean rfb_decoder_clip_rectangle (RfbDecoder * decoder, gint * x,
+ gint * y, gint * w, gint * h, gint * skip_x, gint * skip_y);
+static gboolean rfb_decoder_clip_copyrect (RfbDecoder * decoder, gint * dst_x,
+ gint * dst_y, gint * src_x, gint * src_y, gint * w, gint * h);
RfbDecoder *
rfb_decoder_new (void)
@@ -802,23 +806,20 @@
if (!rfb_decoder_read (decoder, 12))
return FALSE;
- x = RFB_GET_UINT16 (decoder->data + 0) - decoder->offset_x;
- y = RFB_GET_UINT16 (decoder->data + 2) - decoder->offset_y;
+ x = RFB_GET_UINT16 (decoder->data + 0);
+ y = RFB_GET_UINT16 (decoder->data + 2);
w = RFB_GET_UINT16 (decoder->data + 4);
h = RFB_GET_UINT16 (decoder->data + 6);
encoding = RFB_GET_UINT32 (decoder->data + 8);
+ x -= (gint) decoder->offset_x;
+ y -= (gint) decoder->offset_y;
+
GST_DEBUG ("update received");
GST_DEBUG ("x:%d y:%d", x, y);
GST_DEBUG ("w:%d h:%d", w, h);
GST_DEBUG ("encoding: %d", encoding);
- if (((w * h) + (x * y)) > (decoder->width * decoder->height)) {
- GST_ERROR ("Desktop resize is unsupported.");
- decoder->state = NULL;
- return TRUE;
- }
-
switch (encoding) {
case ENCODING_TYPE_RAW:
ret = rfb_decoder_raw_encoding (decoder, x, y, w, h);
@@ -857,11 +858,20 @@
rfb_decoder_raw_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
gint rect_w, gint rect_h)
{
- gint size;
+ gint copy_x, copy_y, copy_w, copy_h;
+ gint skip_x = 0, skip_y = 0;
+ guint32 size;
guint8 *frame, *p;
guint32 raw_line_size;
+ guint32 copy_line_size;
+
+ if (rect_w <= 0 || rect_h <= 0)
+ return TRUE;
raw_line_size = rect_w * decoder->bytespp;
+ if (rect_h > 0 && raw_line_size > G_MAXUINT32 / rect_h)
+ return FALSE;
+
size = rect_h * raw_line_size;
GST_DEBUG ("Reading %d bytes (%dx%d)", size, rect_w, rect_h);
@@ -869,13 +879,23 @@
if (!rfb_decoder_read (decoder, size))
return FALSE;
+ copy_x = start_x;
+ copy_y = start_y;
+ copy_w = rect_w;
+ copy_h = rect_h;
+
+ if (!rfb_decoder_clip_rectangle (decoder, ©_x, ©_y, ©_w, ©_h,
+ &skip_x, &skip_y))
+ return TRUE;
+
frame =
- decoder->frame + (((start_y * decoder->rect_width) +
- start_x) * decoder->bytespp);
- p = decoder->data;
+ decoder->frame + (((copy_y * decoder->rect_width) +
+ copy_x) * decoder->bytespp);
+ p = decoder->data + (skip_y * raw_line_size) + (skip_x * decoder->bytespp);
+ copy_line_size = copy_w * decoder->bytespp;
- while (rect_h--) {
- memcpy (frame, p, raw_line_size);
+ while (copy_h--) {
+ memcpy (frame, p, copy_line_size);
p += raw_line_size;
frame += decoder->line_size;
}
@@ -887,7 +907,8 @@
rfb_decoder_copyrect_encoding (RfbDecoder * decoder, gint start_x, gint
start_y,
gint rect_w, gint rect_h)
{
- guint16 src_x, src_y;
+ gint src_x, src_y;
+ gint copy_x, copy_y, copy_w, copy_h;
gint line_width, copyrect_width;
guint8 *src, *dst;
@@ -895,20 +916,28 @@
return FALSE;
/* don't forget the offset */
- src_x = RFB_GET_UINT16 (decoder->data) - decoder->offset_x;
- src_y = RFB_GET_UINT16 (decoder->data + 2) - decoder->offset_y;
+ src_x = RFB_GET_UINT16 (decoder->data) - (gint) decoder->offset_x;
+ src_y = RFB_GET_UINT16 (decoder->data + 2) - (gint) decoder->offset_y;
GST_DEBUG ("Copyrect from %d %d", src_x, src_y);
- copyrect_width = rect_w * decoder->bytespp;
+ copy_x = start_x;
+ copy_y = start_y;
+ copy_w = rect_w;
+ copy_h = rect_h;
+ if (!rfb_decoder_clip_copyrect (decoder, ©_x, ©_y, &src_x, &src_y,
+ ©_w, ©_h))
+ return TRUE;
+
+ copyrect_width = copy_w * decoder->bytespp;
line_width = decoder->line_size;
src =
decoder->prev_frame + ((src_y * decoder->rect_width) +
src_x) * decoder->bytespp;
dst =
- decoder->frame + ((start_y * decoder->rect_width) +
- start_x) * decoder->bytespp;
+ decoder->frame + ((copy_y * decoder->rect_width) +
+ copy_x) * decoder->bytespp;
- while (rect_h--) {
+ while (copy_h--) {
memcpy (dst, src, copyrect_width);
src += line_width;
dst += line_width;
@@ -926,6 +955,9 @@
guint32 *offset;
gint i, j;
+ if (!rfb_decoder_clip_rectangle (decoder, &x, &y, &w, &h, NULL, NULL))
+ return;
+
for (i = 0; i < h; i++) {
offset =
(guint32 *) (decoder->frame + ((x + (y +
@@ -1100,6 +1132,68 @@
return TRUE;
}
+
+static gboolean
+rfb_decoder_clip_rectangle (RfbDecoder * decoder, gint * x, gint * y, gint * w,
+ gint * h, gint * skip_x, gint * skip_y)
+{
+ gint x1, y1, x2, y2;
+ gint orig_x, orig_y;
+
+ if (*w <= 0 || *h <= 0)
+ return FALSE;
+
+ orig_x = *x;
+ orig_y = *y;
+ x1 = MAX (orig_x, 0);
+ y1 = MAX (orig_y, 0);
+ x2 = MIN (orig_x + *w, (gint) decoder->rect_width);
+ y2 = MIN (orig_y + *h, (gint) decoder->rect_height);
+
+ if (x2 <= x1 || y2 <= y1)
+ return FALSE;
+
+ *x = x1;
+ *y = y1;
+ *w = x2 - x1;
+ *h = y2 - y1;
+
+ if (skip_x)
+ *skip_x = x1 - orig_x;
+ if (skip_y)
+ *skip_y = y1 - orig_y;
+
+ return TRUE;
+}
+
+static gboolean
+rfb_decoder_clip_copyrect (RfbDecoder * decoder, gint * dst_x, gint * dst_y,
+ gint * src_x, gint * src_y, gint * w, gint * h)
+{
+ gint left, top, right, bottom;
+
+ if (*w <= 0 || *h <= 0)
+ return FALSE;
+
+ left = MAX (0, MAX (-*dst_x, -*src_x));
+ top = MAX (0, MAX (-*dst_y, -*src_y));
+ right = MIN (*w, MIN ((gint) decoder->rect_width - *dst_x,
+ (gint) decoder->rect_width - *src_x));
+ bottom = MIN (*h, MIN ((gint) decoder->rect_height - *dst_y,
+ (gint) decoder->rect_height - *src_y));
+
+ if (right <= left || bottom <= top)
+ return FALSE;
+
+ *dst_x += left;
+ *dst_y += top;
+ *src_x += left;
+ *src_y += top;
+ *w = right - left;
+ *h = bottom - top;
+
+ return TRUE;
+}
static gboolean
rfb_decoder_state_set_colour_map_entries (RfbDecoder * decoder)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/gst-plugins-bad-1.28.4/gst/mpegdemux/gstmpegdemux.c
new/gst-plugins-bad-1.28.4+24/gst/mpegdemux/gstmpegdemux.c
--- old/gst-plugins-bad-1.28.4/gst/mpegdemux/gstmpegdemux.c 2026-06-12
14:19:43.000000000 +0200
+++ new/gst-plugins-bad-1.28.4+24/gst/mpegdemux/gstmpegdemux.c 2026-06-19
10:13:39.000000000 +0200
@@ -1370,7 +1370,7 @@
if (flush || seeksegment.position != demux->src_segment.position) {
/* Do the actual seeking */
if (!gst_ps_demux_do_seek (demux, &seeksegment)) {
- return FALSE;
+ goto seek_error;
}
}
@@ -1440,6 +1440,7 @@
seek_error:
{
GST_WARNING_OBJECT (demux, "couldn't perform seek");
+ GST_PAD_STREAM_UNLOCK (demux->sinkpad);
gst_event_unref (event);
return FALSE;
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/gst-plugins-bad-1.28.4/gst/mxf/mxfdemux.c
new/gst-plugins-bad-1.28.4+24/gst/mxf/mxfdemux.c
--- old/gst-plugins-bad-1.28.4/gst/mxf/mxfdemux.c 2026-06-12
14:19:43.000000000 +0200
+++ new/gst-plugins-bad-1.28.4+24/gst/mxf/mxfdemux.c 2026-06-19
10:13:39.000000000 +0200
@@ -925,6 +925,7 @@
tmp->track_number = track->parent.track_number;
tmp->track_id = track->parent.track_id;
memcpy (&tmp->source_package_uid, &package->parent.package_uid, 32);
+ tmp->offsets = g_array_new (FALSE, TRUE, sizeof (GstMXFDemuxIndex));
if (demux->current_partition->partition.body_sid == edata->body_sid &&
demux->current_partition->partition.body_offset == 0)
@@ -2153,16 +2154,17 @@
return -1;
idx = &g_array_index (offsets, GstMXFDemuxIndex, *position);
- if (idx->offset != 0 && (!keyframe || idx->keyframe)) {
+ if (idx->initialized && (!keyframe || idx->keyframe)) {
current_offset = idx->offset;
- } else if (idx->offset != 0 && current_position > 0) {
+ } else if (keyframe && current_position > 0) {
current_position--;
while (TRUE) {
GST_LOG ("current_position %" G_GUINT64_FORMAT, current_position);
idx = &g_array_index (offsets, GstMXFDemuxIndex, current_position);
- if (idx->offset == 0) {
- GST_LOG ("breaking offset 0");
- break;
+ if (!idx->initialized) {
+ /* don't search for a keyframe in an uninitialized gap */
+ GST_LOG ("breaking on uninitialized offset");
+ return -1;
} else if (!idx->keyframe && current_position > 0) {
current_position--;
continue;
@@ -2181,6 +2183,40 @@
return current_offset;
}
+static void
+have_new_essence_track_index_entry (GstMXFDemux * demux,
+ GstMXFDemuxEssenceTrack * etrack, guint64 position,
+ GstMXFDemuxIndex * entry)
+{
+ if (etrack->offsets->len > position) {
+ GstMXFDemuxIndex *cur_entry =
+ &g_array_index (etrack->offsets, GstMXFDemuxIndex, position);
+ if (cur_entry->initialized) {
+ GST_TRACE_OBJECT (demux,
+ "track %u body_sid:%u index_sid:%u delta_id:%d found initialized
entry at position:%"
+ G_GUINT64_FORMAT, etrack->track_id, etrack->body_sid,
+ etrack->index_sid, etrack->delta_id, position);
+
+ return;
+ }
+
+ GST_LOG_OBJECT (demux,
+ "track %u body_sid:%u index_sid:%u delta_id:%d initializing entry at
position:%"
+ G_GUINT64_FORMAT, etrack->track_id, etrack->body_sid,
+ etrack->index_sid, etrack->delta_id, position);
+ *cur_entry = *entry;
+
+ return;
+ }
+
+ GST_LOG_OBJECT (demux,
+ "track %u body_sid:%u index_sid:%u delta_id:%d appending entry at
position:%"
+ G_GUINT64_FORMAT, etrack->track_id, etrack->body_sid,
+ etrack->index_sid, etrack->delta_id, position);
+
+ g_array_insert_val (etrack->offsets, position, *entry);
+}
+
/**
* find_edit_entry:
* @demux: The demuxer
@@ -2220,21 +2256,20 @@
G_GUINT64_FORMAT " keyframe:%d", etrack->track_id, etrack->body_sid,
etrack->index_sid, etrack->delta_id, position, keyframe);
+ /* Look in the track offsets */
+ if (find_offset (etrack->offsets, &position, keyframe) != -1) {
+ *entry = g_array_index (etrack->offsets, GstMXFDemuxIndex, position);
+ GST_LOG_OBJECT (demux, "Found entry in track offsets");
+ return TRUE;
+ } else {
+ GST_LOG_OBJECT (demux, "Didn't find entry in track offsets");
+ }
+
/* Default values */
entry->duration = 1;
/* By default every entry is a keyframe unless specified otherwise */
entry->keyframe = TRUE;
- /* Look in the track offsets */
- if (etrack->offsets && etrack->offsets->len > position) {
- if (find_offset (etrack->offsets, &position, keyframe) != -1) {
- *entry = g_array_index (etrack->offsets, GstMXFDemuxIndex, position);
- GST_LOG_OBJECT (demux, "Found entry in track offsets");
- return TRUE;
- } else
- GST_LOG_OBJECT (demux, "Didn't find entry in track offsets");
- }
-
/* Look in the indextables */
index_table = get_track_index_table (demux, etrack);
@@ -2454,6 +2489,8 @@
entry->offset = absolute_offset;
entry->dts = position;
+ have_new_essence_track_index_entry (demux, etrack, position, entry);
+
return TRUE;
}
@@ -2494,17 +2531,16 @@
retentry->keyframe = TRUE;
/* Index-less search */
- if (etrack->offsets) {
- for (i = 0; i < etrack->offsets->len; i++) {
- GstMXFDemuxIndex *idx =
- &g_array_index (etrack->offsets, GstMXFDemuxIndex, i);
-
- if (idx->initialized && idx->offset != 0 && idx->offset == offset) {
- *retentry = *idx;
- GST_DEBUG_OBJECT (demux,
- "Found in track index. Position:%" G_GUINT64_FORMAT, idx->dts);
- return TRUE;
- }
+ for (i = 0; i < etrack->offsets->len; i++) {
+ GstMXFDemuxIndex *idx =
+ &g_array_index (etrack->offsets, GstMXFDemuxIndex, i);
+
+ if (idx->initialized && idx->offset == offset) {
+ g_assert (offset != 0);
+ *retentry = *idx;
+ GST_DEBUG_OBJECT (demux,
+ "Found in track offsets. Position:%" G_GUINT64_FORMAT, idx->dts);
+ return TRUE;
}
}
@@ -2706,6 +2742,8 @@
retentry->offset = original_offset;
retentry->dts = position;
+ have_new_essence_track_index_entry (demux, etrack, position, retentry);
+
return TRUE;
}
@@ -2935,9 +2973,6 @@
return ret;
}
- if (!etrack->offsets)
- etrack->offsets = g_array_new (FALSE, TRUE, sizeof (GstMXFDemuxIndex));
-
if (!index_entry.initialized) {
/* This can happen when doing scanning without entry tables */
index_entry.duration = 1;
@@ -2953,11 +2988,8 @@
etrack->track_id, index_entry.dts, index_entry.offset,
index_entry.keyframe);
- /* We only ever append to the track offset entry. */
- g_assert (etrack->position <= etrack->offsets->len);
- g_array_insert_val (etrack->offsets, etrack->position, index_entry);
- } else if (etrack->position == etrack->offsets->len) {
- g_array_insert_val (etrack->offsets, etrack->position, index_entry);
+ have_new_essence_track_index_entry (demux, etrack, etrack->position,
+ &index_entry);
}
if (peek)
@@ -3881,13 +3913,13 @@
current_position = MIN (current_position, offsets->len - 1);
idx = &g_array_index (offsets, GstMXFDemuxIndex, current_position);
- while ((idx->offset == 0 || (keyframe && !idx->keyframe))
+ while ((!idx->initialized || (keyframe && !idx->keyframe))
&& current_position > 0) {
current_position--;
idx = &g_array_index (offsets, GstMXFDemuxIndex, current_position);
}
- if (idx->offset != 0 && (!keyframe || idx->keyframe)) {
+ if (idx->initialized && (!keyframe || idx->keyframe)) {
*position = current_position;
return idx->offset;
}
@@ -4024,9 +4056,9 @@
/* If we found the position read it from the index again */
if (((ret == GST_FLOW_OK && etrack->position == *position + 1) ||
(ret == GST_FLOW_EOS && etrack->position == *position + 1))
- && etrack->offsets && etrack->offsets->len > *position
+ && etrack->offsets->len > *position
&& g_array_index (etrack->offsets, GstMXFDemuxIndex,
- *position).offset != 0) {
+ *position).initialized) {
GST_DEBUG_OBJECT (demux, "Found at offset %" G_GUINT64_FORMAT,
demux->offset);
demux->offset = old_offset;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/gst-plugins-bad-1.28.4/gst/mxf/mxfdemux.h
new/gst-plugins-bad-1.28.4+24/gst/mxf/mxfdemux.h
--- old/gst-plugins-bad-1.28.4/gst/mxf/mxfdemux.h 2026-06-12
14:19:43.000000000 +0200
+++ new/gst-plugins-bad-1.28.4+24/gst/mxf/mxfdemux.h 2026-06-19
10:13:39.000000000 +0200
@@ -146,7 +146,7 @@
typedef struct
{
- /* absolute byte offset excluding run_in, 0 if uninitialized */
+ /* absolute byte offset excluding run_in */
guint64 offset;
/* PTS edit unit number or G_MAXUINT64 */
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/gst-plugins-bad-1.28.4/gst/pcapparse/gstpcapparse.c
new/gst-plugins-bad-1.28.4+24/gst/pcapparse/gstpcapparse.c
--- old/gst-plugins-bad-1.28.4/gst/pcapparse/gstpcapparse.c 2026-06-12
14:19:43.000000000 +0200
+++ new/gst-plugins-bad-1.28.4+24/gst/pcapparse/gstpcapparse.c 2026-06-19
10:13:39.000000000 +0200
@@ -354,6 +354,7 @@
#define SLL2_HEADER_LEN 20
#define IP_HEADER_MIN_LEN 20
#define UDP_HEADER_LEN 8
+#define TCP_HEADER_MIN_LEN 20
#define IP_PROTO_UDP 17
#define IP_PROTO_TCP 6
@@ -438,7 +439,8 @@
return FALSE;
ip_header_size = (b & 0x0f) * 4;
- if (buf_ip + ip_header_size > buf + buf_size)
+ if (ip_header_size < IP_HEADER_MIN_LEN ||
+ buf_ip + ip_header_size > buf + buf_size)
return FALSE;
flags = buf_ip[6] >> 5;
@@ -460,6 +462,11 @@
memcpy (&ip_dst_addr, buf_ip + 16, sizeof (ip_dst_addr));
buf_proto = buf_ip + ip_header_size;
ip_packet_len = GUINT16_FROM_BE (*(guint16 *) (buf_ip + 2));
+ if (ip_packet_len < ip_header_size)
+ return FALSE;
+
+ if (buf_proto + 4 > buf + buf_size)
+ return FALSE;
/* ok for tcp and udp */
src_port = GUINT16_FROM_BE (*((guint16 *) (buf_proto + 0)));
@@ -467,6 +474,8 @@
/* extract some params and data according to protocol */
if (ip_protocol == IP_PROTO_UDP) {
+ if (buf_proto + 6 > buf + buf_size)
+ return FALSE;
len = GUINT16_FROM_BE (*((guint16 *) (buf_proto + 4)));
if (len < UDP_HEADER_LEN || buf_proto + len > buf + buf_size)
return FALSE;
@@ -474,10 +483,13 @@
*payload = buf_proto + UDP_HEADER_LEN;
*payload_size = len - UDP_HEADER_LEN;
} else {
- if (buf_proto + 12 >= buf + buf_size)
+ if (buf_proto + 13 > buf + buf_size)
return FALSE;
len = (buf_proto[12] >> 4) * 4;
- if (buf_proto + len > buf + buf_size)
+ if (len < TCP_HEADER_MIN_LEN || buf_proto + len > buf + buf_size)
+ return FALSE;
+ if (ip_packet_len < ip_header_size + len ||
+ buf_ip + ip_packet_len > buf + buf_size)
return FALSE;
/* all remaining data following tcp header is payload */
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/gst-plugins-bad-1.28.4/gst/rtmp2/rtmp/rtmpclient.c
new/gst-plugins-bad-1.28.4+24/gst/rtmp2/rtmp/rtmpclient.c
--- old/gst-plugins-bad-1.28.4/gst/rtmp2/rtmp/rtmpclient.c 2026-06-12
14:19:43.000000000 +0200
+++ new/gst-plugins-bad-1.28.4+24/gst/rtmp2/rtmp/rtmpclient.c 2026-06-19
10:13:39.000000000 +0200
@@ -510,6 +510,7 @@
ConnectTaskData *data = g_task_get_task_data (task);
GError *error = NULL;
gboolean res;
+ GSocket *socket;
res = gst_rtmp_client_handshake_finish (stream, result, &error);
if (!res) {
@@ -519,6 +520,9 @@
return;
}
+ socket = g_socket_connection_get_socket (socket_connection);
+ g_socket_set_timeout (socket, 0);
+
data->connection = gst_rtmp_connection_new (socket_connection,
g_task_get_cancellable (task));
data->error_handler_id = g_signal_connect (data->connection,
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/gst-plugins-bad-1.28.4/gst/rtmp2/rtmp/rtmpconnection.c
new/gst-plugins-bad-1.28.4+24/gst/rtmp2/rtmp/rtmpconnection.c
--- old/gst-plugins-bad-1.28.4/gst/rtmp2/rtmp/rtmpconnection.c 2026-06-12
14:19:43.000000000 +0200
+++ new/gst-plugins-bad-1.28.4+24/gst/rtmp2/rtmp/rtmpconnection.c
2026-06-19 10:13:39.000000000 +0200
@@ -484,8 +484,8 @@
if (ret < 0) {
gint code = error->code;
- if (error->domain == G_IO_ERROR && (code == G_IO_ERROR_WOULD_BLOCK ||
- code == G_IO_ERROR_TIMED_OUT || code == G_IO_ERROR_AGAIN)) {
+ if (error->domain == G_IO_ERROR &&
+ (code == G_IO_ERROR_WOULD_BLOCK || code == G_IO_ERROR_AGAIN)) {
/* should retry */
GST_DEBUG_OBJECT (sc, "read IO error %d %s, continuing",
code, error->message);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/gst-plugins-bad-1.28.4/gst/vmnc/vmncdec.c
new/gst-plugins-bad-1.28.4+24/gst/vmnc/vmncdec.c
--- old/gst-plugins-bad-1.28.4/gst/vmnc/vmncdec.c 2026-06-12
14:19:43.000000000 +0200
+++ new/gst-plugins-bad-1.28.4+24/gst/vmnc/vmncdec.c 2026-06-19
10:13:39.000000000 +0200
@@ -155,6 +155,20 @@
typedef int (*rectangle_handler) (GstVMncDec * dec, struct RfbRectangle * rect,
const guint8 * data, int len, gboolean decode);
+static gboolean
+vmnc_rect_payload_size (struct RfbRectangle *rect, guint bytes_per_pixel,
+ gsize * size)
+{
+ gsize pixels;
+
+ if (!g_size_checked_mul (&pixels, rect->width, rect->height))
+ return FALSE;
+ if (!g_size_checked_mul (size, pixels, bytes_per_pixel))
+ return FALSE;
+
+ return TRUE;
+}
+
static int
vmnc_handle_wmvi_rectangle (GstVMncDec * dec, struct RfbRectangle *rect,
const guint8 * data, int len, gboolean decode)
@@ -395,7 +409,8 @@
{
/* Cursor data. */
int datalen = 2;
- int type, size;
+ int type;
+ gsize size;
if (len < datalen) {
GST_LOG_OBJECT (dec, "Cursor data too short");
@@ -405,9 +420,19 @@
type = RFB_GET_UINT8 (data);
if (type == CURSOR_COLOUR) {
- datalen += rect->width * rect->height * dec->format.bytes_per_pixel * 2;
+ if (!vmnc_rect_payload_size (rect, dec->format.bytes_per_pixel, &size) ||
+ size > ((gsize) G_MAXINT - datalen) / 2) {
+ GST_WARNING_OBJECT (dec, "Cursor data size overflow");
+ return ERROR_INVALID;
+ }
+ datalen += size * 2;
} else if (type == CURSOR_ALPHA) {
- datalen += rect->width * rect->height * 4;
+ if (!vmnc_rect_payload_size (rect, 4, &size) ||
+ size > (gsize) G_MAXINT - datalen) {
+ GST_WARNING_OBJECT (dec, "Cursor data size overflow");
+ return ERROR_INVALID;
+ }
+ datalen += size;
} else {
GST_WARNING_OBJECT (dec, "Unknown cursor type: %d", type);
return ERROR_INVALID;
@@ -422,22 +447,20 @@
dec->cursor.type = type;
dec->cursor.width = rect->width;
dec->cursor.height = rect->height;
- dec->cursor.type = type;
dec->cursor.hot_x = rect->x;
dec->cursor.hot_y = rect->y;
g_free (dec->cursor.cursordata);
g_free (dec->cursor.cursormask);
- if (type == 0) {
- size = rect->width * rect->height * dec->format.bytes_per_pixel;
+ if (type == CURSOR_COLOUR) {
dec->cursor.cursordata = g_malloc (size);
dec->cursor.cursormask = g_malloc (size);
memcpy (dec->cursor.cursordata, data + 2, size);
memcpy (dec->cursor.cursormask, data + 2 + size, size);
} else {
- dec->cursor.cursordata = g_malloc (rect->width * rect->height * 4);
- memcpy (dec->cursor.cursordata, data + 2, rect->width * rect->height * 4);
+ dec->cursor.cursordata = g_malloc (size);
+ memcpy (dec->cursor.cursordata, data + 2, size);
dec->cursor.cursormask = NULL;
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/gst-plugins-bad-1.28.4/meson.build
new/gst-plugins-bad-1.28.4+24/meson.build
--- old/gst-plugins-bad-1.28.4/meson.build 2026-06-12 14:19:43.000000000
+0200
+++ new/gst-plugins-bad-1.28.4+24/meson.build 2026-06-19 10:13:39.000000000
+0200
@@ -1,5 +1,5 @@
project('gst-plugins-bad', 'c', 'cpp',
- version : '1.28.4',
+ version : '1.28.4.1',
meson_version : '>= 1.4',
default_options : [ 'warning_level=1',
'buildtype=debugoptimized',
++++++ gst-plugins-bad.obsinfo ++++++
--- /var/tmp/diff_new_pack.kKdGXj/_old 2026-06-22 18:05:32.685461365 +0200
+++ /var/tmp/diff_new_pack.kKdGXj/_new 2026-06-22 18:05:32.705462064 +0200
@@ -1,5 +1,5 @@
name: gst-plugins-bad
-version: 1.28.4
-mtime: 1781266783
-commit: b46f881eaa8126eddfd21b5ae5512f8d4ff36255
+version: 1.28.4+24
+mtime: 1781856819
+commit: 6a394d8df25c2440430b1d3ce6cdfb6434fd9b76
