Compare commits

2 Commits
1.1 ... main

7 changed files with 450 additions and 57 deletions

View File

@@ -1,45 +0,0 @@
From f1cdc6f24340f6cce4cc7020628002f5c70dd6c7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 26 Sep 2024 22:07:22 +0300
Subject: [PATCH 1/2] allocator: Avoid integer overflow when allocating sysmem
Thanks to Antonio Morales for finding and reporting the issue.
Fixes GHSL-2024-166
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3851
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032>
---
diff -urp gstreamer-1.24.7.orig/gst/gstallocator.c gstreamer-1.24.7/gst/gstallocator.c
--- gstreamer-1.24.7.orig/gst/gstallocator.c 2024-08-21 07:25:15.000000000 -0400
+++ gstreamer-1.24.7/gst/gstallocator.c 2024-12-16 03:03:33.735196509 -0500
@@ -427,8 +427,20 @@ _sysmem_new_block (GstMemoryFlags flags,
/* ensure configured alignment */
align |= gst_memory_alignment;
/* allocate more to compensate for alignment */
+ if (align > G_MAXSIZE || maxsize > G_MAXSIZE - align) {
+ GST_CAT_WARNING (GST_CAT_MEMORY,
+ "Allocating %" G_GSIZE_FORMAT " bytes with alignment %" G_GSIZE_FORMAT
+ "x overflows", maxsize, align);
+ return NULL;
+ }
maxsize += align;
/* alloc header and data in one block */
+ if (maxsize > G_MAXSIZE - sizeof (GstMemorySystem)) {
+ GST_CAT_WARNING (GST_CAT_MEMORY,
+ "Allocating %" G_GSIZE_FORMAT " bytes with alignment %" G_GSIZE_FORMAT
+ "x overflows", maxsize, align);
+ return NULL;
+ }
slice_size = sizeof (GstMemorySystem) + maxsize;
mem = g_malloc (slice_size);
@@ -478,6 +490,8 @@ _sysmem_copy (GstMemorySystem * mem, gss
size = mem->mem.size > offset ? mem->mem.size - offset : 0;
copy = _sysmem_new_block (0, size, mem->mem.align, 0, size);
+ if (!copy)
+ return NULL;
GST_CAT_DEBUG (GST_CAT_PERFORMANCE,
"memcpy %" G_GSIZE_FORMAT " memory %p -> %p", size, mem, copy);
memcpy (copy->data, mem->data + mem->mem.offset + offset, size);

21
_service Normal file
View File

@@ -0,0 +1,21 @@
<?xml version="1.0"?>
<services>
<service name="obs_scm" mode="manual">
<param name="scm">git</param>
<param name="url">https://gitlab.freedesktop.org/gstreamer/gstreamer.git</param>
<param name="subdir">subprojects/gstreamer</param>
<param name="filename">gstreamer</param>
<param name="revision">1.26.2</param>
<param name="versionformat">@PARENT_TAG@+@TAG_OFFSET@</param>
<param name="versionrewrite-pattern">v?(.*)\+0</param>
<param name="versionrewrite-replacement">\1</param>
<!-- <param name="changesgenerate">enable</param> -->
</service>
<service name="tar" mode="buildtime"/>
<service name="recompress" mode="buildtime">
<param name="file">*.tar</param>
<param name="compression">zst</param>
</service>
<service name="set_version" mode="manual" />
</services>

BIN
gstreamer-1.24.7.tar.xz (Stored with Git LFS)

Binary file not shown.

BIN
gstreamer-1.26.2.obscpio (Stored with Git LFS) Normal file

Binary file not shown.

View File

@@ -1,8 +1,421 @@
-------------------------------------------------------------------
Mon Jan 6 16:32:36 UTC 2025 - Michael Gorse <mgorse@suse.com>
Sat May 31 22:31:25 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
- Add CVE-2024-47606.patch: avoid integer overflow when allocating
sysmem (boo#1234449 CVE-2024-47606).
- Update to version 1.26.2:
+ Highlighted bugfixes:
- Various security fixes and playback fixes
- aggregator base class fixes to not produce buffers too early
in live mode
- AWS translate element improvements
- D3D12 video decoder workarounds for crashes on NVIDIA cards
on resolution changes
- dav1d AV1-decoder performance improvements
- fmp4mux: tfdt and composition time offset fixes, plus AC-3 /
EAC-3 audio support
- GStreamer editing services fixes for sources with non-1:1
aspect ratios
- MIDI parser improvements for tempo changes
- MP4 demuxer atom parsing improvements and security fixes
- New skia-based video compositor element
- Subtitle parser security fixes
- Subtitle rendering and seeking fixes
- Playbin3 and uridecodebin3 stability fixes
- GstPlay stream selection improvements
- WAV playback regression fix
- GTK4 paintable sink colorimetry support and other
improvements
- WebRTC: allow webrtcsrc to wait for a webrtcsink producer to
initiate the connection
- WebRTC: new Janus Video Room WebRTC source element
- vah264enc profile decision making logic fixes
- Python bindings gained support for handling mini object
writability (buffers, caps, etc.)
- Various bug fixes, build fixes, memory leak fixes, and other
stability and reliability improvements
+ gstreamer:
- aggregator: Various state related fixes
- element: ref-sink the correct pad template when replacing an
existing one
- pipeline: Store the actual latency even if no static latency
was configured
- structure: Add gst_structure_is_writable() API to allow
python bindings to be able to handle writability of
MiniObjects
- tracerutils: Do not warn on empty string as tracername
- tracerutils: Fix leak in gst_tracer_utils_create_tracer()
- Ensure properties are freed before (re)setting with
g_value_dup_object() or g_value_dup_boxed() and during
cleanup
- Fix new warnings on Fedora 42, various meson warnings, and
other small meson build/wrap fixes
-------------------------------------------------------------------
Wed Apr 30 08:08:12 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
- Update to version 1.26.1:
+ Highlighted bugfixes:
- awstranslate and speechmatics plugin improvements
- decodebin3 fixes and urisourcebin/playbin3 stability
improvements
- Closed captions: CEA-708 generation and muxing fixes, and
H.264/H.265 caption extractor fixes
- dav1d AV1 decoder: RGB support, plus colorimetry,
renegotiation and buffer pool handling fixes
- Fix regression when rendering VP9 with alpha
- H.265 decoder base class and caption inserter SPS/PPS
handling fixes
- hlssink3 and hlsmultivariantsink feature enhancements
- Matroska v4 support in muxer, seeking fixes in demuxer
- macOS: framerate guessing for cameras or capture devices
where the OS reports silly framerates
- MP4 demuxer uncompressed video handling improvements and
sample table handling fixes
- oggdemux: seeking improvements in streaming mode
- unixfdsrc: fix gst_memory_resize warnings
- Plugin loader fixes, especially for Windows
- QML6 GL source renegotiation fixes
- RTP and RTSP stability fixes
- Thread-safety improvements for the Media Source Extension
(MSE) library
- v4l2videodec: fix A/V sync issues after decoding errors
- Various improvements and fixes for the fragmented and
non-fragmented MP4 muxers
- Video encoder base class segment and buffer timestamp
handling fixes
- Video time code support for 119.88 fps and
drop-frames-related conversion fixes
- WebRTC: Retransmission entry creation fixes and better audio
level header extension compatibility
- YUV4MPEG encoder improvments
- dots-viewer: make work locally without network access
- gst-python: fix compatibility with PyGObject >= 3.52.0
- Cerbero: recipe updates, compatibility fixes for Python <
3.10; Windows Android cross-build improvements
- Various bug fixes, build fixes, memory leak fixes, and other
stability and reliability improvements
+ gstreamer:
- Correctly handle whitespace paths when executing
gst-plugin-scanner
- Ensure properties are freed before (re)setting with
g_value_dup_string() and during cleanup
- cmake: Fix PKG_CONFIG_PATH formatting for Windows
cross-builds
- macos: Move macos function documentation to the .h so the
introspection has the information
- meson.build: test for and link against libatomic if it exists
- pluginloader-win32: Fix helper executable path under devenv
- pluginloader: fix pending_plugins Glist use-after-free issue
- unixfdsrc: Complains about resize of memory area
- tracers: dots: fix debug log
-------------------------------------------------------------------
Wed Mar 12 06:55:24 UTC 2025 - Antonio Larrosa <alarrosa@suse.com>
- Update to version 1.26.0:
+ Highlights
- H.266 Versatile Video Coding (VVC) codec support
- Low Complexity Enhancement Video Coding (LCEVC) support
- Closed captions: H.264/H.265 extractor/inserter,
cea708overlay, cea708mux, tttocea708 and more
- New hlscmafsink, hlssink3, and hlsmultivariantsink; HLS/DASH
client and dashsink improvements
- New AWS and Speechmatics transcription, translation and TTS
services elements, plus translationbin
- Splitmux lazy loading and dynamic fragment addition support
- Matroska: H.266 video and rotation tag support, defined
latency muxing
- MPEG-TS: support for H.266, JPEG XS, AV1, VP9 codecs and
SMPTE ST-2038 and ID3 meta; mpegtslivesrc
- ISO MP4: support for H.266, Hap, Lagarith lossless codecs;
raw video support; rotation tags
- SMPTE 2038 ancillary data streams support
- JPEG XS image codec support
- Analytics: New TensorMeta; N-to-N relationships; Mtd to carry
segmentation masks
- ONVIF metadata extractor and conversion to/from relation
metas
- New originalbuffer element that can restore buffers again
after transformation steps for analytics
- Improved Python bindings for analytics API
- Lots of Vulkan integration and Vulkan Video decoder/encoder
improvements
- OpenGL integration improvements, esp. in glcolorconvert,
gldownload, glupload
- Qt5/Qt6 QML GL sinks now support direct DMABuf import from
hardware decoders
- CUDA: New compositor, Jetson NVMM memory support,
stream-ordered allocator
- NVCODEC AV1 video encoder element, and nvdsdewarp
- New Direct3D12 integration support library
- New d3d12swapchainsink and d3d12deinterlace elements and
D3D12 sink/source for zero-copy IPC
- Decklink HDR support (PQ + HLG) and frame scheduling
enhancements
- AJA capture source clock handling and signal loss recovery
improvements
- RTP and RTSP: New rtpbin sync modes, client-side MIKEY
support in rtspsrc
- New Rust rtpbin2, rtprecv, rtpsend, and many new Rust RTP
payloaders and depayloaders
- webrtcbin support for basic rollbacks and other improvements
- webrtcsink: support for more encoders, SDP munging, and a
built-in web/signalling server
- webrtcsrc/sink: support for uncompressed audio/video and NTP
& PTP clock signalling and synchronization
- rtmp2: server authentication improvements incl. Limelight
CDN (llnw) authentication
- New Microsoft WebView2 based web browser source element
- The GTK3 plugin has gained support for OpenGL/WGL on Windows
- Many GTK4 paintable sink improvements
- GstPlay: id-based stream selection and message API
improvements
- Real-time pipeline visualization in a browser using a new
dots tracer and viewer
- New tracers for tracking memory usage, pad push timings, and
buffer flow as pcap files
- VA hardware-acclerated H.266/VVC decoder, VP8 and JPEG
encoders, VP9/VP8 alpha decodebins
- Video4Linux2 elements support DMA_DRM caps negotiation now
- V4L2 stateless decoders implement inter-frame resolution
changes for AV1 and VP9
- Editing services: support for reverse playback and audio
channel reordering
- New QUIC-based elements for working with raw QUIC streams,
RTP-over-QUIC (RoQ) and WebTransport
- Apple AAC audio encoder and multi-channel support for the
Apple audio decoders
- cerbero: Python bindings and introspection support; improved
Windows installer based on WiX5
- Lots of new plugins, features, performance improvements and
bug fixes
+ Possibly Breaking Changes
- qroverlay: the "pixel-size" property has been removed in
favour of a new "size" property with slightly different
semantics, where the size of the square is expressed in
percent of the smallest of width and height.
- svtav1enc: The SVT-AV1 3.0.0 API exposes a different
mechanism to configure the level of parallelism when
encoding, which has been exposed as a new
"level-of-parallelism" property. The old "logical-processors"
property is no longer functional if the plugin has been
compiled against the new API, which might affect encoder
performance if application code setting it is not updated.
- udpsrc: now disables allocated port reuse for unicast to
avoid unexpected side-effects of SO_REUSEADDR where the
kernel allocates the same listening port for multiple udpsrc.
- uridecodebin3 remove non-functional "source" property that
doesn't make sense and always returned NULL anyway.
+ Known Issues
- GstBuffer now uses C11 atomics for 64 bit atomic operations
if available, which may require linking to libatomic on some
systems, but this is not done automatically yet, see issue
glfo#gstreamer/gstreamer#4177.
+ For more detailed information on this update, please see
https://gstreamer.freedesktop.org/releases/1.26/
-------------------------------------------------------------------
Sun Feb 2 18:20:27 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
- Update to version 1.24.12:
+ Highlighted bugfixes:
- d3d12: Fix shaders failing to compile with newer dxc versions
- decklinkvideosink: Fix handling of caps framerate in auto
mode; also a decklinkaudiosink fix
- devicemonitor: Fix potential crash macOS when a device is
unplugged
- gst-libav: Fix crash in audio encoders like avenc_ac3 if
input data has insufficient alignment
- gst-libav: Fix build against FFmpeg 4.2 as in Ubuntu 20.04
- gst-editing-services: Fix Python library name fetching on
Windows
- netclientclock: Don't store failed internal clocks in the
cache, so applications can re-try later
- oggdemux: Seeking and duration fixes
- osxaudiosrc: Fixes for failing init/no output on recent iOS
versions
- qtdemux: Use mvhd transform matrix and support for flipping
- rtpvp9pay: Fix profile parsing
- splitmuxsrc: Fix use with decodebin3 which would occasionally
fail with an assertion when seeking
- tsdemux: Fix backwards PTS wraparound detection with
ignore-pcr=true
- video-overlay-composition: Declare the video/size/orientation
tags for the meta and implement scale transformations
- vtdec: Fix seeks occasionally hanging on macOS due to a race
condition when draining
- webrtc: Fix duplicate payload types with RTX and multiple
video codecs
- win32-pluginoader: Make sure not to create any windows when
inspecting plugins
- wpe: Various fixes for re-negotiation, latency reporting,
progress messages on startup
- x264enc: Add missing data to AvcDecoderConfigurationRecord in
codec_data for high profile variants
- cerbero: Support using ccache with cmake if enabled
- Various bug fixes, build fixes, memory leak fixes, and other
stability and reliability improvements
+ gstreamer:
- device: Fix racy nullptr deref on macOS when a device is
unplugged
- iterator: Added error handling to filtered iterators
- netclientclock: Don't ever store failed internal clocks in
the cache
- netclock-replay: use gst_c_args when building, fixing build
failure on Solaris
- pluginloader-win32: create no window
- pluginloader-win32: fix use after free in
find_helper_bin_location
- sparsefile: ensure error is set when read_buffer() returns 0
- basetransform: fix incorrect logging inside
gst_base_transform_query_caps
-------------------------------------------------------------------
Tue Jan 7 21:37:06 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
- Update to version 1.24.11:
+ Highlighted bugfixes:
- playback: Fix SSA/ASS subtitles with embedded fonts
- decklink: add missing video modes and fix 8K video modes
- matroskamux: spec compliance fixes for audio-only files
- onnx: disable onnxruntime telemetry
- qtdemux: Fix base offset update when doing segment seeks
- srtpdec: Fix a use-after-free issue
- (uri)decodebin3: Fix stream change scenarios, possible
deadlock on shutdown
- video: fix missing alpha flag in AV12 format description
- avcodecmap: Add some more channel position mappings
- cerbero bootstrap fixes for Windows 11
- Various bug fixes, build fixes, memory leak fixes, and other
stability and reliability improvements
+ gstreamer:
- No changes.
-------------------------------------------------------------------
Mon Dec 9 11:49:13 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
- Update to version 1.24.10:
+ Highlighted bugfixes:
- More than 40 security fixes across a wide range of elements
following an audit by the GitHub Security Lab, including the
MP4, Matroska, Ogg and WAV demuxers, subtitle parsers, image
decoders, audio decoders and the id3v2 tag parser.
- avviddec: Fix regression that could trigger assertions about
width/height mismatches.
- appsink and appsrc fixes.
- closed caption handling fixes.
- decodebin3 and urisourcebin fixes.
- glupload: dmabuf: Fix emulated tiled import.
- level: fix LevelMeta values outside of the stated range.
- mpegtsmux, flvmux: fix potential busy looping with high cpu
usage in live mode.
- pipeline dot file graph generation improvements.
- qt(6): fix criticals with multiple qml(6)gl{src,sink}.
- rtspsrc: Optionally timestamp RTP packets with their receive
times in TCP/HTTP mode to enable clock drift handling.
- splitmuxsrc: reduce number of file descriptors used.
- systemclock: locking order fixes.
- v4l2: fix possible v4l2videodec deadlock on shutdown; 8-bit
bayer format fixes.
- x265: Fix build with libx265 version >= 4.1 after
masteringDisplayColorVolume API change.
- macOS: fix rendering artifacts in retina displays, plus ptp
clock fixes.
- cargo: Default to thin lto for the release profile (for
faster builds with lower memory requirements).
- Various bug fixes, build fixes, memory leak fixes, and other
stability and reliability improvements.
- Updated translations.
+ gstreamer:
- allocator: Avoid integer overflow when allocating sysmem and
avoid integer overflow in qtdemux theora extension parsing
(boo#1234449 CVE-2024-47606).
- deviceprovider: fix leaking hidden providers.
- gstreamer: prefix debug dot node names to prevent splitting.
- pad: Never push sticky events in response to a FLUSH_STOP.
- systemclock: Fix lock order violation and some cleanup.
- utils: improve gst_util_ceil_log2().
- ptp: use ip_mreq instead of ip_mreqn for macos.
- tracers: unlock leaks tracer if already tracking.
-------------------------------------------------------------------
Tue Nov 5 09:33:25 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
- Update to version 1.24.9:
+ Highlighted bugfixes:
- gst-rtsp-server security fix
- GstAggregator start time selection and latency query fixes
for force-live mode
- audioconvert: fix dynamic handling of mix matrix, and accept
custom upstream event for setting one
- encodebin: fix parser selection for encoders that support
multiple codecs
- flvmux improvments for pipelines where timestamps don't start
at 0
- glcontext: egl: Unrestrict the support base DRM formats
- kms: Add IMX-DCSS auto-detection in sink and fix stride with
planar formats in allocator
- macOS main application event loop fixes
- mpegtsdemux: Handle PTS/DTS wraparound with ignore-pcr=true
- playbin3, decodebin3, parsebin, urisourcebin: fix races, and
improve stability and stream-collection handling
- rtpmanager: fix early RTCP SR generation for sparse streams
like metadata
- qml6glsrc: Reduce capture delay
- qtdemux: fix parsing of rotation matrix with 180 degree
rotation
- rtpav1depay: added wait-for-keyframe and request-keyframe
properties
- srt: make work with newer libsrt versions and don't
re-connect on authentication failure
- v4l2 fixes and improvement
- webrtcsink, webrtcbin and whepsrc fixes
- cerbero: fix Python 3.13 compatibility, g-i with newer
setuptools, bootstrap on Arch Linux; iOS build fixes
- Ship qroverlay plugin in binary packages
- Various bug fixes, memory leak fixes, and other stability and
reliability improvements
+ Gstreamer:
- aggregator:
. Fix start time selection first with force-live
. Fix live query when force-live is TRUE
- parse-launch: Make sure children are bins before recursing in
- macos: Fix race conditions in cocoa/application main event
loop
- multiqueue: Do not unref the query we get in pad->query
-------------------------------------------------------------------
Mon Sep 23 13:03:47 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>
- Update to version 1.24.8:
+ Highlighted bugfixes:
- decodebin3: collection handling fixes
- encodebin: Fix pad removal (and smart rendering in
gst-editing-services)
- glimagesink: Fix cannot resize viewport when video size
changed in caps
- matroskamux, webmmux: fix firefox compatibility issue with
Opus audio streams
- mpegtsmux: Wait for data on all pads before deciding on a
best pad unless timing out
- splitmuxsink: Override LATENCY query to pretend to downstream
that we're not live
- video: QoS event handling improvements
- voamrwbenc: fix list of bitrates
- vtenc: Restart encoding session when certain errors are
detected
- wayland: Fix ABI break in WL context type name
- webrtcbin: Prevent crash when attempting to set answer on
invalid SDP
- cerbero: ship vp8/vp9 software encoders again, which went
missing in 1.24.7; ship transcode plugin
- Various bug fixes, memory leak fixes, and other stability and
reliability improvements
+ gstreamer:
- clock: Fix unchecked overflows in linear regression code
- meta: Add missing include of gststructure.h
- pad: Check data NULL-ness when probes are stopped
- aggregator: Immediately return NONE from
simple_get_next_time() on non-TIME segments
-------------------------------------------------------------------
Fri Aug 23 07:10:20 UTC 2024 - Bjørn Lie <bjorn.lie@gmail.com>

4
gstreamer.obsinfo Normal file
View File

@@ -0,0 +1,4 @@
name: gstreamer
version: 1.26.2
mtime: 1748559403
commit: 100c21e1faf68efe7f3830b6e9f856760697ab48

View File

@@ -1,7 +1,7 @@
#
# spec file for package gstreamer
#
# Copyright (c) 2024 SUSE LLC
# Copyright (c) 2025 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -19,17 +19,16 @@
%define gst_branch 1.0
Name: gstreamer
Version: 1.24.7
Version: 1.26.2
Release: 0
Summary: Streaming-Media Framework Runtime
License: LGPL-2.1-or-later
Group: Productivity/Multimedia/Other
URL: https://gstreamer.freedesktop.org
Source0: %{url}/src/%{name}/%{name}-%{version}.tar.xz
Source0: %{name}-%{version}.tar.zst
Source1: gstreamer.macros
Source2: gstreamer.prov
Source99: baselibs.conf
Patch0: CVE-2024-47606.patch
# PATCH-FEATURE-UPSTREAM gstreamer-rpm-prov.patch bgo#588784 dimstar@opensuse.org -- Add --rpm parameter to allow creation of rpm provides, patch from fedora
Patch1: gstreamer-rpm-prov.patch
@@ -42,7 +41,7 @@ BuildRequires: flex >= 2.5.31
BuildRequires: gobject-introspection-devel >= 1.31.1
BuildRequires: libcap-devel
BuildRequires: libcap-progs
BuildRequires: meson >= 1.1
BuildRequires: meson >= 1.4
BuildRequires: pkgconfig
BuildRequires: python3-base
BuildRequires: python3-xml
@@ -221,7 +220,7 @@ install -m755 -D %{SOURCE2} %{buildroot}%{_rpmconfigdir}/gstreamer-provides
%{_mandir}/man?/*-%{gst_branch}*%{ext_man}
%files devel
%doc AUTHORS ChangeLog NEWS README.md RELEASE
%doc AUTHORS README.md
%{_datadir}/aclocal/*.m4
# Own these directories to avoid build requirement on gdb
# only for directories ownership
@@ -236,6 +235,7 @@ install -m755 -D %{SOURCE2} %{buildroot}%{_rpmconfigdir}/gstreamer-provides
%{_includedir}/*
%{_libdir}/*.so
%{_libdir}/pkgconfig/*.pc
%{_datadir}/cmake/FindGStreamer.cmake
%{_libexecdir}/gstreamer-%{gst_branch}/gst-plugins-doc-cache-generator
%{_rpmconfigdir}/gstreamer-provides
%{_fileattrsdir}/gstreamer.attr