Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package gstreamer-plugins-ugly for
openSUSE:Factory checked in at 2026-08-06 16:19:45
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/gstreamer-plugins-ugly (Old)
and /work/SRC/openSUSE:Factory/.gstreamer-plugins-ugly.new.16738 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gstreamer-plugins-ugly"
Thu Aug 6 16:19:45 2026 rev:113 rq:1369822 version:1.28.6
Changes:
--------
---
/work/SRC/openSUSE:Factory/gstreamer-plugins-ugly/gstreamer-plugins-ugly.changes
2026-07-12 16:21:34.500854262 +0200
+++
/work/SRC/openSUSE:Factory/.gstreamer-plugins-ugly.new.16738/gstreamer-plugins-ugly.changes
2026-08-06 16:20:02.327917229 +0200
@@ -1,0 +2,9 @@
+Wed Aug 5 15:59:59 UTC 2026 - Bjørn Lie <[email protected]>
+
+- Update to version 1.28.6:
+ + asfdemux: Avoid integer overflows during bounds checks
+ + dvdsubdec: Clip subpicture rectangle to the frame size
+ + rtpasfdepay: Drop packets that are larger than the negotiated
+ maximum packet size and various other fixes
+
+-------------------------------------------------------------------
Old:
----
gst-plugins-ugly-1.28.5.obscpio
New:
----
gst-plugins-ugly-1.28.6.obscpio
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ gstreamer-plugins-ugly.spec ++++++
--- /var/tmp/diff_new_pack.9YLxwz/_old 2026-08-06 16:20:03.243949187 +0200
+++ /var/tmp/diff_new_pack.9YLxwz/_new 2026-08-06 16:20:03.243949187 +0200
@@ -25,7 +25,7 @@
%define gstreamer_req_version %(echo %{version} | sed -e "s/+.*//")
Name: gstreamer-plugins-ugly
-Version: 1.28.5
+Version: 1.28.6
Release: 0
Summary: GStreamer Streaming-Media Framework Plug-Ins
License: LGPL-2.1-or-later
++++++ _service ++++++
--- /var/tmp/diff_new_pack.9YLxwz/_old 2026-08-06 16:20:03.295951001 +0200
+++ /var/tmp/diff_new_pack.9YLxwz/_new 2026-08-06 16:20:03.307951420 +0200
@@ -5,7 +5,7 @@
<param
name="url">https://gitlab.freedesktop.org/gstreamer/gstreamer.git</param>
<param name="subdir">subprojects/gst-plugins-ugly</param>
<param name="filename">gst-plugins-ugly</param>
- <param name="revision">1.28.5</param>
+ <param name="revision">1.28.6</param>
<param name="versionformat">@PARENT_TAG@+@TAG_OFFSET@</param>
<param name="versionrewrite-pattern">v?(.*)\+0</param>
<param name="versionrewrite-replacement">\1</param>
++++++ gst-plugins-ugly-1.28.5.obscpio -> gst-plugins-ugly-1.28.6.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/gst-plugins-ugly-1.28.5/gst/asfdemux/gstasfdemux.c
new/gst-plugins-ugly-1.28.6/gst/asfdemux/gstasfdemux.c
--- old/gst-plugins-ugly-1.28.5/gst/asfdemux/gstasfdemux.c 2026-07-08
23:42:39.000000000 +0200
+++ new/gst-plugins-ugly-1.28.6/gst/asfdemux/gstasfdemux.c 2026-08-05
13:59:39.000000000 +0200
@@ -2381,7 +2381,7 @@
}
static inline gboolean
-gst_asf_demux_skip_bytes (guint num_bytes, guint8 ** p_data, guint64 * p_size)
+gst_asf_demux_skip_bytes (guint64 num_bytes, guint8 ** p_data, guint64 *
p_size)
{
if (*p_size < num_bytes)
return FALSE;
@@ -3167,6 +3167,9 @@
if (!gst_asf_demux_get_stream_video (&video_object, &data, &size))
goto not_enough_data;
+ if (video_object.size < 40)
+ goto not_enough_data;
+
vsize = video_object.size - 40; /* Byte order gets offset by single
byte */
GST_INFO ("object is a video stream with %u bytes of "
@@ -3648,8 +3651,9 @@
for (i = 0; i < blockcount; ++i) {
GstStructure *s;
- guint16 stream_num, name_len, data_type, lang_idx G_GNUC_UNUSED;
- guint32 data_len, ival;
+ guint16 stream_num, data_type, lang_idx G_GNUC_UNUSED;
+ guint32 ival;
+ guint64 name_len, data_len;
gchar *name_utf8;
if (size < (2 + 2 + 2 + 2 + 4))
@@ -3690,6 +3694,8 @@
ival = gst_asf_demux_get_uint32 (&data, &size);
/* skip anything else there may be, just in case */
+ if (data_len < 4)
+ goto not_enough_data;
gst_asf_demux_skip_bytes (data_len - 4, &data, &size);
s = gst_asf_demux_get_metadata_for_stream (demux, stream_num);
@@ -4506,6 +4512,9 @@
return GST_FLOW_ERROR;
gst_asf_demux_skip_bytes (ASF_OBJECT_HEADER_SIZE, p_data, p_size);
+ if (obj.size < ASF_OBJECT_HEADER_SIZE)
+ return GST_FLOW_ERROR;
+
obj_data_size = obj.size - ASF_OBJECT_HEADER_SIZE;
if (*p_size < obj_data_size)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/gst-plugins-ugly-1.28.5/gst/asfdemux/gstrtpasfdepay.c
new/gst-plugins-ugly-1.28.6/gst/asfdemux/gstrtpasfdepay.c
--- old/gst-plugins-ugly-1.28.5/gst/asfdemux/gstrtpasfdepay.c 2026-07-08
23:42:39.000000000 +0200
+++ new/gst-plugins-ugly-1.28.6/gst/asfdemux/gstrtpasfdepay.c 2026-08-05
13:59:39.000000000 +0200
@@ -245,16 +245,18 @@
}
}
-/* Set the padding field to te correct value as the spec
- * says it should be se to 0 in the rtp packets
- */
+/* Update the packet with the required amount of padding. For RTP packets the
+ * padding is stripped off and here we need to add it back to create valid
+ * ASF packets again. This requires allocating a packet_size large buffer,
+ * adding zero padding and rewriting the padding length field with the correct
+ * value. */
static GstBuffer *
gst_rtp_asf_depay_update_padding (GstRtpAsfDepay * depayload, GstBuffer * buf)
{
GstBuffer *result;
GstMapInfo map;
guint8 *data;
- gint offset = 0;
+ guint offset = 0;
guint8 aux;
guint8 seq_type;
guint8 pad_type;
@@ -268,18 +270,20 @@
padding = depayload->packet_size - plen;
GST_LOG_OBJECT (depayload,
- "padding buffer size %" G_GSIZE_FORMAT " to packet size %d", plen,
+ "padding buffer size %" G_GSIZE_FORMAT " to packet size %u", plen,
depayload->packet_size);
result = gst_buffer_new_and_alloc (depayload->packet_size);
- gst_buffer_map (result, &map, GST_MAP_READ);
+ gst_buffer_map (result, &map, GST_MAP_READWRITE);
data = map.data;
memset (data + plen, 0, padding);
gst_buffer_extract (buf, 0, data, plen);
gst_buffer_unref (buf);
+ if (offset + 1 > depayload->packet_size)
+ goto malformed;
aux = data[offset++];
if (aux & 0x80) {
guint8 err_len = 0;
@@ -293,6 +297,8 @@
err_len = aux & 0x0F;
offset += err_len;
+ if (offset + 1 > depayload->packet_size)
+ goto malformed;
aux = data[offset++];
}
seq_type = (aux >> 1) & 0x3;
@@ -307,16 +313,22 @@
switch (pad_type) {
/* DWORD */
case 3:
+ if (offset + 4 > depayload->packet_size)
+ goto malformed;
GST_WRITE_UINT32_LE (&(data[offset]), padding);
break;
/* WORD */
case 2:
+ if (offset + 2 > depayload->packet_size)
+ goto malformed;
GST_WRITE_UINT16_LE (&(data[offset]), padding);
break;
/* BYTE */
case 1:
+ if (offset + 1 > depayload->packet_size)
+ goto malformed;
data[offset] = (guint8) padding;
break;
@@ -328,6 +340,14 @@
gst_buffer_unmap (result, &map);
return result;
+
+malformed:
+ {
+ GST_WARNING_OBJECT (depayload, "ASF packet too small to contain header");
+ gst_buffer_unmap (result, &map);
+ gst_buffer_unref (result);
+ return NULL;
+ }
}
/* Docs: 'RTSP Protocol PDF' document from http://sdp.ppona.com/ (page 8) */
@@ -344,6 +364,7 @@
guint len_offs;
GstClockTime timestamp;
GstRTPBuffer rtpbuf = { NULL };
+ guint packet_len = 0;
depay = GST_RTP_ASF_DEPAY (depayload);
@@ -365,14 +386,14 @@
outbufs = gst_buffer_list_new ();
do {
- guint packet_len;
+ hdr_len = 4;
/* packet header is at least 4 bytes */
- if (payload_len < 4)
+ if (payload_len < hdr_len)
goto too_small;
/* 1 2 3
- * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* |S|L|R|D|I|RES | Length/Offset |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
@@ -398,33 +419,34 @@
D = ((payload[0] & 0x10) != 0);
I = ((payload[0] & 0x08) != 0);
- hdr_len = 4;
-
len_offs = (payload[1] << 16) | (payload[2] << 8) | payload[3];
if (R) {
- GST_DEBUG ("Relative timestamp field present : %u",
- GST_READ_UINT32_BE (payload + hdr_len));
hdr_len += 4;
+ if (payload_len < hdr_len)
+ goto too_small;
+ GST_DEBUG ("Relative timestamp field present : %u",
+ GST_READ_UINT32_BE (payload + hdr_len - 4));
}
if (D) {
- GST_DEBUG ("Duration field present : %u",
- GST_READ_UINT32_BE (payload + hdr_len));
hdr_len += 4;
+ if (payload_len < hdr_len)
+ goto too_small;
+ GST_DEBUG ("Duration field present : %u",
+ GST_READ_UINT32_BE (payload + hdr_len - 4));
}
if (I) {
- GST_DEBUG ("LocationId field present : %u",
- GST_READ_UINT32_BE (payload + hdr_len));
hdr_len += 4;
+ if (payload_len < hdr_len)
+ goto too_small;
+ GST_DEBUG ("LocationId field present : %u",
+ GST_READ_UINT32_BE (payload + hdr_len - 4));
}
GST_LOG_OBJECT (depay, "S %d, L %d, R %d, D %d, I %d", S, L, R, D, I);
- GST_LOG_OBJECT (depay, "payload_len:%d, hdr_len:%d, len_offs:%d",
+ GST_LOG_OBJECT (depay, "payload_len:%u, hdr_len:%u, len_offs:%u",
payload_len, hdr_len, len_offs);
- if (payload_len < hdr_len)
- goto too_small;
-
/* skip headers */
payload_len -= hdr_len;
payload += hdr_len;
@@ -442,6 +464,9 @@
if (packet_len > payload_len)
packet_len = payload_len;
+ if (packet_len > depay->packet_size)
+ goto too_big;
+
GST_LOG_OBJECT (depay, "packet len %u, payload len %u, packet_size:%u",
packet_len, payload_len, depay->packet_size);
@@ -460,6 +485,12 @@
gst_adapter_push (depay->adapter, sub);
/* RTP marker bit M is set if this is last fragment */
if (gst_rtp_buffer_get_marker (&rtpbuf)) {
+ if (available + packet_len > depay->packet_size) {
+ /* Update packet_len for the debug log further below */
+ packet_len = available + packet_len;
+ gst_adapter_clear (depay->adapter);
+ goto too_big;
+ }
GST_LOG_OBJECT (depay, "last fragment, assembling packet");
outbuf =
gst_adapter_take_buffer (depay->adapter, available + packet_len);
@@ -481,11 +512,17 @@
/* If we haven't completed a full ASF packet, return but first
push what we have so far */
if (!outbuf) {
+ gst_rtp_buffer_unmap (&rtpbuf);
gst_rtp_base_depayload_push_list (depayload, outbufs);
return NULL;
}
outbuf = gst_rtp_asf_depay_update_padding (depay, outbuf);
+ if (!outbuf) {
+ gst_rtp_buffer_unmap (&rtpbuf);
+ gst_rtp_base_depayload_push_list (depayload, outbufs);
+ return NULL;
+ }
if (!S)
GST_BUFFER_FLAG_SET (outbuf, GST_BUFFER_FLAG_DELTA_UNIT);
@@ -519,8 +556,21 @@
too_small:
{
gst_rtp_buffer_unmap (&rtpbuf);
- GST_WARNING_OBJECT (depayload, "Payload too small, expected at least 4 "
- "bytes for header, but got only %d bytes", payload_len);
+ GST_WARNING_OBJECT (depayload, "Payload too small, expected at least %u "
+ "bytes for header, but got only %u bytes", hdr_len, payload_len);
+ if (gst_buffer_list_length (outbufs) == 0) {
+ gst_rtp_base_depayload_dropped (depayload);
+ gst_buffer_list_unref (outbufs);
+ } else {
+ gst_rtp_base_depayload_push_list (depayload, outbufs);
+ }
+ return NULL;
+ }
+too_big:
+ {
+ gst_rtp_buffer_unmap (&rtpbuf);
+ GST_WARNING_OBJECT (depayload, "Payload too big, expected at most %u "
+ "bytes, but got %u bytes", depay->packet_size, packet_len);
if (gst_buffer_list_length (outbufs) == 0) {
gst_rtp_base_depayload_dropped (depayload);
gst_buffer_list_unref (outbufs);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/gst-plugins-ugly-1.28.5/gst/dvdsub/gstdvdsubdec.c
new/gst-plugins-ugly-1.28.6/gst/dvdsub/gstdvdsubdec.c
--- old/gst-plugins-ugly-1.28.5/gst/dvdsub/gstdvdsubdec.c 2026-07-08
23:42:39.000000000 +0200
+++ new/gst-plugins-ugly-1.28.6/gst/dvdsub/gstdvdsubdec.c 2026-08-05
13:59:39.000000000 +0200
@@ -342,6 +342,8 @@
GST_WARNING_OBJECT (dec, "SPU_WIPE not yet implemented");
length = (buf[1] << 8) | (buf[2]);
+
+ PARSE_BYTES_NEEDED (1 + length);
buf += 1 + length;
dec->buf_dirty = TRUE;
@@ -501,8 +503,9 @@
target = state->target;
- x = dec->left;
- right = dec->right + 1;
+ /* If left/right is still outside the frame, clip it off */
+ x = CLAMP (dec->left, 0, dec->in_width - 1);
+ right = MIN (dec->right + 1, dec->in_width);
while (x < right) {
gboolean in_hl;
@@ -636,13 +639,15 @@
hl_top = -1;
hl_bottom = -1;
}
- last_y = MIN (dec->bottom, dec->in_height);
- y = dec->top;
+ /* If top/bottom is still outside the frame, clip it off */
+ last_y = MIN (dec->bottom, dec->in_height - 1);
+ y = CLAMP (dec->top, 0, dec->in_height - 1);
+
state.target = Y_data + 4 * dec->left + (y * Y_stride);
/* Now draw scanlines until we hit last_y or end of RLE data */
- for (; ((state.offset[1] < dec->data_size + 2) && (y <= last_y)); y++) {
+ for (; ((state.offset[state.id] < dec->data_size + 2) && (y <= last_y));
y++) {
/* Set up to draw the highlight if we're in the right scanlines */
if (y > hl_bottom || y < hl_top) {
state.hl_left = -1;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/gst-plugins-ugly-1.28.5/gst-plugins-ugly.doap
new/gst-plugins-ugly-1.28.6/gst-plugins-ugly.doap
--- old/gst-plugins-ugly-1.28.5/gst-plugins-ugly.doap 2026-07-08
23:42:39.000000000 +0200
+++ new/gst-plugins-ugly-1.28.6/gst-plugins-ugly.doap 2026-08-05
13:59:39.000000000 +0200
@@ -35,6 +35,16 @@
<release>
<Version>
+ <revision>1.28.6</revision>
+ <branch>1.28</branch>
+ <name></name>
+ <created>2026-08-05</created>
+ <file-release
rdf:resource="https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-1.28.6.tar.xz";
/>
+ </Version>
+ </release>
+
+ <release>
+ <Version>
<revision>1.28.5</revision>
<branch>1.28</branch>
<name></name>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/gst-plugins-ugly-1.28.5/meson.build
new/gst-plugins-ugly-1.28.6/meson.build
--- old/gst-plugins-ugly-1.28.5/meson.build 2026-07-08 23:42:39.000000000
+0200
+++ new/gst-plugins-ugly-1.28.6/meson.build 2026-08-05 13:59:39.000000000
+0200
@@ -1,5 +1,5 @@
project('gst-plugins-ugly', 'c',
- version : '1.28.5',
+ version : '1.28.6',
meson_version : '>= 1.4',
default_options : [ 'warning_level=1',
'buildtype=debugoptimized',
++++++ gst-plugins-ugly.obsinfo ++++++
--- /var/tmp/diff_new_pack.9YLxwz/_old 2026-08-06 16:20:03.751966911 +0200
+++ /var/tmp/diff_new_pack.9YLxwz/_new 2026-08-06 16:20:03.755967050 +0200
@@ -1,5 +1,5 @@
name: gst-plugins-ugly
-version: 1.28.5
-mtime: 1783546959
-commit: 727ceb91886862d200f423baf36cde2bb7ce5b4d
+version: 1.28.6
+mtime: 1785931179
+commit: 2d3e05cbdad68e47d645f548899b432dc9fb4473
