All these CVEs were fixed in recent commits.
(From OE-Core rev: 86f48cdb1b26b6e234dde10b1e636e54e8a7e71f)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Incorrect Access Control in GStreamer RTSP server 1.25.0 in gst-rtsp-server/rtsp-media.c
allows remote attackers to cause a denial of service via a series of specially crafted
hexstream requests.
(From OE-Core rev: ce328462a12eeaa59994e2236071aa17a083c263)
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
These were fixed in previous commits.
(From OE-Core rev: 09f0b16877ab207cba91f13d036bc6f4cd6bdf70)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
These CVEs are patched in gstreamer1.0-plugins-bad.
CPE for gstreamer-plugins-bad mostly hits original gstreamer recipe.
(From OE-Core rev: a2339d124c2561bf157f3e14af0b3152d257d937)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
First, libcheck has the ability to increase all test timeouts by an arbitrary
multiplier. Because we run our tests on loaded build machines,
increase all timeouts by 10x to reduce the chance of load causing failures.
Second, use GST_CHECKS_IGNORE to list test cases that should be skipped.
Drop skip-aggregator-test.patch as this is now redundant, and also skip
gstnetclientclock.c:test_functioning as this is very sensitive to load.
[ YOCTO #14808 ]
(From OE-Core rev: 13b13b81b91f618c13cf972067c47bd810de852f)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 669d0df81f651f7c033c8cb7872cac5bfe670a4f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This CVE is patched in gstreamer1.0-plugins-bad.
cpe product is set to gstreamer, they share source git repository.
(From OE-Core rev: e64d90d4c52f2e236dbe3b24b7deffce10452671)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability.
This vulnerability allows remote attackers to execute arbitrary code on affected
installations of GStreamer. Interaction with this library is required to exploit this
vulnerability but attack vectors may vary depending on the implementation. The specific
flaw exists within the parsing of EXIF metadata. The issue results from the lack of
proper validation of user-supplied data, which can result in an integer overflow before
allocating a buffer. An attacker can leverage this vulnerability to execute code in the
context of the current process. . Was ZDI-CAN-23896.
(From OE-Core rev: 6708631c89d1cb0d7e0e1b888c51826b3939f8af)
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This is required by latest webkit when built with x11 support.
(From OE-Core rev: 024edebf6f722ae4d05411be348730d9eeb3bd7c)
(From OE-Core rev: 9fc0f0a15388af175bd53de5190801750064e60c)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
gst-plugins-bad: Heap-based buffer overflow in the MXF file demuxer when handling
malformed files with uncompressed video in GStreamer versions before 1.22.6
(From OE-Core rev: d0c8e2f78c8003ad383cc63cff32147156412650)
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This release only contains bugfixes.
Highlighted bugfixes in 1.20.7:
Security fixes for flacparse, dvdspu, and subparse, and the RealMedia demuxer
h265parse: Fix framerate handling
filesink: Fix buffered mode writing of buffer lists and buffers with multiple memories
asfmux, rtpbin_buffer_list test: fix possible unaligned write/read on 32-bit ARM
ptp clock: Work around bug in ptpd in default configuration
qtdemux: fix reverse playback regression with edit lists
rtspsrc: various control path handling server compatibility improvements
avviddec: fix potential deadlock on seeking with FFmpeg 6.x
cerbero: Fix pango crash on 32bit Windows; move libass into non-GPL codecs
Miscellaneous bug fixes, memory leak fixes, and other stability and reliability improvements
https://nvd.nist.gov/vuln/detail/CVE-2023-37327https://nvd.nist.gov/vuln/detail/CVE-2023-37328https://nvd.nist.gov/vuln/detail/CVE-2023-37329https://gstreamer.freedesktop.org/releases/1.20/#1.20.7
(From OE-Core rev: c6b7492406540aca60dfd8c9913c7ac14fcc750f)
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Changelog:
===========
audio: channel-mix: allow up to 64 channels instead of up to 63 channels
AOM AV1 encoder timestamp handling improvements
AV1 video codec caps handling improvements in aom plugin, isomp4 and matroska muxers/demuxers.
avvidenc: fix bitrate control and timestamps off FFmpeg-based video encoders
h264parse: fix missing timestamps on outputs when splitting a frame
rtspsrc: more workarounds for servers with broken control uri handling
playbin3: fix issue with UDP streams, making sure there's enough buffering
qmlglsrc: Fix deadlock when stopping and some other fixes
qtmux: fix default timescale unit for N/1001 framerates
v4l2h264dec: Fix Raspberry Pi4 will not play video in application
vtdec: Fix non-deterministic frame output after seeks
wasapi2src: Fix loopback capture on Windows 10 Anniversary Update
macOS, iOS: Fix Xcode 14 ABI breakage with older Xcode
cerbero: Fix some regressions for CentOS in the 1.20 branch
cerbero: Fix setuptools site.py breakage in Python 3.11
Fix gst-libav build against FFmpeg from git
gobject-introspection annotation fixes for bindings
Miscellaneous bug fixes, memory leak fixes, and other stability and reliability improvements
Performance improvements
(From OE-Core rev: 102c453668f71dd30c3f0f13502f0993a051d7fe)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Changelog:
===========
systemclock waiting fixes for certain 32-bit platforms/libcs
alphacombine: robustness improvements for corner case scenarios
avfvideosrc: Report latency when doing screen capture
d3d11videosink: various thread-safety and stability fixes
decklink: fix performance issue when HDMI signal has been lost for a long time
flacparse: Fix handling of headers advertising 32 bits per sample
mpegts: Handle when iconv doesn't support ISO 6937 (e.g. musl libc)
opengl: fix automatic dispmanx detection for rpi4 and fix usage of eglCreate/DestroyImage
opusdec: Various channel-related fixes
textrender: event handling fixes, esp. for GAP event
subparse: Fix non-closed tag handling
videoscale: fix handling of unknown buffer metas
videosink: reverse playback handling fixes
qtmux: Prefill mode fixes, especially for raw audio
multiudpsink: allow binding to IPv6 address
rtspsrc: Fix usage of IPv6 connections in SETUP
rtspsrc: Only EOS on timeout if all streams are timed out/EOS
splitmuxsrc: fix playback stall if there are unlinked pads
v4l2: Fix SIGSEGV on state change during format changes
wavparse robustness fixes
Fix static linking on macOS (opengl, vulkan)
gstreamer-vaapi: fix headless build against mesa >= 22.3.0
GStreamer Editing Services library: Fix build with tools disabled
webrtc example/demo fixes
unit test fixes for aesdec and rtpjitterbuffer
Cerbero: Fix ios cross-compile with cmake on M1; some recipe updates and other build fixes
Binary packages: pkg-config file fixes for various recipes (ffmpeg, taglib, gstreamer)
Binary packages: Enable high bitdepth support for libvpx (VP8/VP9 encoding/decoding)
Binary packages: ship aes plugin
Miscellaneous bug fixes, memory leak fixes, and other stability and reliability improvements
Performance improvements
(From OE-Core rev: e9a05c026c6b1f39c4413abea9912542aa608cbe)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit fd8ab6052d88120c58cf84ad7d77d60c12ef3b8a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The fourth 1.20 bug-fix release (1.20.4) was released on 12 October 2022.
This release only contains bugfixes and it should be safe to upgrade from 1.20.x.
Highlighted bugfixes in 1.20.4
- avaudiodec: fix playback issue with WMA files, would throw an error at EOS with FFmpeg 5.x
- Fix deadlock when loading gst-editing-services plugin
- Fix input buffering capacity in live mode for aggregator, video/audio aggregator subclasses, muxers
- glimagesink: fix crash on Android
- subtitle handling and subtitle overlay fixes
- matroska-mux: allow width + height changes for avc3|hev1|vp8|vp9
- rtspsrc: fix control url handling for spec compliant servers and add fallback for incompliant servers
- WebRTC fixes
- RTP retransmission fixes
- video: fixes for formats with 4x subsampling and horizontal co-sited chroma (Y41B, YUV9, YVU9 and IYU9)
- macOS build and packaging fixes, in particular fix finding of gio modules on macOS for https/TLS support
- Fix consuming of the macOS package as a framework in XCode
- Performance improvements
- Miscellaneous bug fixes, memory leak fixes, and other stability and reliability improvements
(From OE-Core rev: cb8842b09959f4eefdc7d638a435db4361fd2441)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 58e4825328dafd7f593d9eb42be5506408627a31)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport of patch already present upstream to fix issues with invalid
characters for GLIB when combining gstreamer1.0-libav with ffmpeg 5.x.
Remove when gstreamer1.0-libav is upgraded to 1.21.1 or above
(From OE-Core rev: d142cc8e6faf42c0a495c28c177061ffb9b1f793)
Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 703ff945557ad307bbe4ba0b0b7f1a2e5b4b847e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes from version 1.20.2
vaapi: Do not disable the whole vpp when some va operations not available
vaapidecode, vaapipostproc: Disable DMAbuf from caps negotiation
scrambled video with some Intel graphics cards
(From OE-Core rev: e0086979006dafbbc21f062e5fcb10c4908b1309)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c363ae6f797460654a7884402f7f98181a7d688f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes from version 1.20.2
aacparse: Avoid mismatch between src_caps and output_header_type
avidemux: Fix integer overflow resulting in heap corruption in DIB buffer inversion code (Security fix)
deinterlace: Clean up error handling code
flvdemux: Actually make use of the debug category
gtkglsink: Fix double-free when OpenGL can't be initialised
jack: Add support for detecting libjack on Windows
matroskademux: Avoid integer-overflow resulting in heap corruption in WavPack header handling code (Security fix)
matroskademux, qtdemux: Fix integer overflows in zlib/bz2/etc decompression code (Security fix)
qtdemux: Don't use tfdt for parsing subsequent trun boxes
rtpbin: Avoid holding GST_RTP_BIN_LOCK when emitting pad-added signal (to avoid deadlocks)
rtpptdemux: Don't GST_FLOW_ERROR when ignoring invalid packets
smpte: Fix integer overflow with possible heap corruption in GstMask creation. (Security fix)
smpte: integer overflow with possible heap corruption in GstMask creation (Security fix)
soup: fix soup debug category initialisation
soup: Fix plugin/element init
v4l2: Reset transfer in gst_v4l2_object_acquire_format()
vpxenc: fix crash if encoder produces unmatching timestamp
wavparse: ensure that any pending segment is sent before an EOS event is sent
(From OE-Core rev: 4aee173335f8d0d0723d629a0dd16a0d1c4ce463)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 66ba273c10b7d738f18620b5a2883d735fff3162)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes from version 1.20.2
audioconvert: If no channel-mask can be fixated then use a NONE channel layout
playbin3: Configure combiner on pad-added if needed
parsebin: Fix assertions/regression when dealing with un-handled streams (fixes regression in 1.20.2)
appsink: Fix race condition on caps handling
oggdemux: Protect against invalid framerates
rtcpbuffer: Allow padding on first reduced size packets
gl: check for xlib-xcb.h header to fix build of tests on macOS with homebrew
videoaggregator: unref temporary caps
v4l2videoenc: Setup crop rectangle if needed
(From OE-Core rev: c827ede3d6b9859b46e487ef60aa3259a45bd45e)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e9d5f5f88947efb8fbdfaa90676db82526e22093)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes from version 1.20.2:
androidmedia: Add H.265 encoder mapping
avfvideosrc: fix wrong framerate selected for caps
d3d11decoder: Fix for alternate interlacing signalling
d3d11decoder: Do not preallocate texture using downstream d3d11 buffer pool
d3d11decoder: Copy HDR10 related caps field manually
d3d11decoder: Work around Intel DXVA driver crash
d3d11screencapture: Set viewport when drawing mouse cursor
d3d11screencapture: Fix missing/outdated cursor shape
d3d11screencapturesrc: Fix crash when d3d11 device is different from owned one
h264decoder: Fix for unhandled low-delay decoding case
matroskademux, qtdemux: Fix integer overflows in zlib/bz2/etc decompression code (Security fix)
mpegtsmux: Make sure to set srcpad caps under all conditions before outputting the first buffer
mpegtsmux: sends segment before caps
mxfdemux: Handle files produced by legacy FFmpeg
nvh264dec,nvh265dec: Don't realloc bitstream buffer per slice
nvcodec: cuda-converter: fix nvrtc compilation on non-English locale systems
opencv: Allow building against 4.6.x
pcapparse: Set timestamp in DTS, not PTS
rtmp2: fix allocation of GstRtmpMeta which caused crashes on 32-bit platforms
rtmp2sink crash on Android arm 32 - cerbero 1.20.2.0
sdpdemux: Release request pads from rtpbin when freeing a stream
va: Add O_CLOEXEC flag at opening drm device (so subprocesses won't have access to it)
webrtcbin: Reject answers that don't contain the same number of m-line as offer
webrtc: datachannel: Notify low buffered amount according to spec
(From OE-Core rev: 0ead6c03c2594158200ee2c490ec683570310036)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 200c8b77e86e6bd23954c3b4e48d4d069cb16f37)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The third 1.20 bug-fix release (1.20.3) was released on 15 June 2022.
This release only contains bugfixes and it should be safe to upgrade from 1.20.x.
(From OE-Core rev: 84b2d193fa4d22c012a8032b4de6f581406a2720)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 74bc037120fa9f00def7e8df6b3a77bba9c9031e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The third 1.20 bug-fix release (1.20.3) was released on 15 June 2022.
This release only contains bugfixes and it should be safe to upgrade from 1.20.x.
gstreamer
clock: Avoid creating a weakref with every entry (performance improvement)
plugin: add Apache 2 license to list of known licenses to avoid warning
gst_plugin_load_file: force plugin reload if filename differs
Add support for LoongArch
Base Libraries
aggregator: Only send events up to CAPS event from gst_aggregator_set_src_caps(), don't send multiple caps events with the same caps and fix negotiation in muxers
basetransform: handle gst_base_transform_query_caps() returning NULL
basetransform: fix critical if transform_caps() returned NULL
queuearray: Fix potential heap overflow when expanding GstQueueArray
Core Elements
multiqueue: fix potential crash on shutdown
multiqueue: fix warning: ‘is_query’ may be used uninitialized in this function
multiqueue: SegFault during flushing with gcc11
(From OE-Core rev: 2c177d00e1e839593757da5985b411f2770da009)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1b1e4ad9b31f9f6e34dae1d0b73d36adca58eb59)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Bug fix release:
devicemonitor: clean up signal handlers and hidden providers list
Leaks tracer: fix pthread_atfork return value check leading to bogus warning in log
Rust plugins: Not picked up by the plugin loader on macOS
Failed to use plugins of latest GStreamer version 1.20.x installed by brew on macOS
ptpclock: Allow at least 100ms delay between Sync/Follow_Up and Delay_Req/Delay_Resp messages. Fixes problems acquiring initial sync with certain devices
meson: Add -Wl,-rpath,${libdir} on macOS
registry: skip Rust dep builddirs when searching for plugins recursively
(From OE-Core rev: e779fb1773b2b6e63739e668cd892e196be224e8)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bb113caee72db30124f6cf8aa12fbaa14277fab5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
