deepin-ci-robot · Sep 11, 2026 · Oct 31, 2026 · Oct 31, 2026 · Oct 31, 2026
diff --git a/debian/changelog b/debian/changelog
@@ -1,3 +1,26 @@
+gst-plugins-bad1.0 (1.24.6-1deepin15) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-12892 (medium) - h264parse: Check for enough
+    slice header data being available   Upstream:
+    https://gitlab.freedesktop.org/gstreamer/gstreamer/-
+    /commit/8c6d4df57b531c7b41a5f3bce28d2c7bc98a1d3d
+  * fix(cve): CVE-2026-119729 (medium) - av1parse: Avoid signed 32 bit
+    integer overflow when parsing LEB128 values   Upstream:
+    https://gitlab.freedesktop.org/gstreamer/gstreamer/-
+    /merge_requests/11245
+  * fix(cve): CVE-2026-119728 (medium) - h264parse: Avoid NULL pointer
+    dereferences when freeing partially parsed SPS/MVC data   Upstream:
+    https://gitlab.freedesktop.org/gstreamer/gstreamer/-
+    /commit/ad02aae2caabda639b80a87d5609d66e9b968df5,https://gitlab.free
+    desktop.org/gstreamer/gstreamer/-
+    /commit/43a89cd28f9b9f30c5e715825e0a06ae4d2d788d
+  * fix(cve): CVE-2026-119727 (unknown) - h265parser: Validate
+    num_decoding_units_minus1 in pic_timing SEI   Upstream:
+    https://gitlab.freedesktop.org/gstreamer/gstreamer/-
+    /commit/0846ed1364c9b1d83e52ed09cdc3de4cdc7ec50d
+
+ -- deepin-ci-robot <packages@deepin.org>  Sat, 12 Sep 2026 05:43:28 +0800
+
 gst-plugins-bad1.0 (1.24.6-1deepin14) unstable; urgency=medium
 
   * fix(cve): CVE-2026-19387

diff --git a/debian/patches/CVE-2026-119727.patch b/debian/patches/CVE-2026-119727.patch
@@ -0,0 +1,30 @@
+Description: CVE-2026-119727 (unknown) - h265parser: 在 pic_timing SEI 中校验 num_decoding_units_minus1，避免因未校验的指数哥伦布编码值导致内存分配与越界访问问题（GST-SA-2026-0012）。
+Author: Carlos Bentzen <cadubentzen@igalia.com>
+Origin: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/0846ed1364c9b1d83e52ed09cdc3de4cdc7ec50d
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-119727
+Last-Update: Mon, 23 Feb 2026 13:21:25 +0100
+---
+diff --git a/gst-libs/gst/codecparsers/gsth265parser.c b/gst-libs/gst/codecparsers/gsth265parser.c
+index 9833ad6..f873036 100644
+--- a/gst-libs/gst/codecparsers/gsth265parser.c
++++ b/gst-libs/gst/codecparsers/gsth265parser.c
+@@ -72,6 +72,9 @@
+ #include <string.h>
+ #include <math.h>
+
++/* ITU-T H.265 (V10) (07/2024) A.4.2, Table A.8: MaxSliceSegmentsPerPicture */
++#define GST_H265_MAX_SLICE_SEGMENTS_PER_PICTURE 1800
++
+ #ifndef GST_DISABLE_GST_DEBUG
+ #define GST_CAT_DEFAULT gst_h265_debug_category_get()
+ static GstDebugCategory *
+@@ -1135,7 +1138,8 @@ gst_h265_parser_parse_pic_timing (GstH265Parser * parser,
+
+       if (hrd->sub_pic_hrd_params_present_flag
+           && hrd->sub_pic_cpb_params_in_pic_timing_sei_flag) {
+-        READ_UE (nr, tim->num_decoding_units_minus1);
++        READ_UE_MAX (nr, tim->num_decoding_units_minus1,
++            GST_H265_MAX_SLICE_SEGMENTS_PER_PICTURE - 1);
+
+         READ_UINT8 (nr, tim->du_common_cpb_removal_delay_flag, 1);
+         if (tim->du_common_cpb_removal_delay_flag)
diff --git a/debian/patches/CVE-2026-119728.patch b/debian/patches/CVE-2026-119728.patch
@@ -0,0 +1,85 @@
+Description: CVE-2026-119728 (medium) - H.264 video parser NULL pointer dereference when freeing SPS/MVC data (GStreamer-SA-2026-0013)
+Author: Sebastian Dröge <sebastian@centricular.com>
+Origin: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/ad02aae2caabda639b80a87d5609d66e9b968df5,https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/43a89cd28f9b9f30c5e715825e0a06ae4d2d788d
+Bug: https://gstreamer.freedesktop.org/security/sa-2026-0013/
+Last-Update: 2026-03-26
+---
+diff --git a/gst-libs/gst/codecparsers/gsth264parser.c b/gst-libs/gst/codecparsers/gsth264parser.c
+index 8511971..7b4b30e 100644
+--- a/gst-libs/gst/codecparsers/gsth264parser.c
++++ b/gst-libs/gst/codecparsers/gsth264parser.c
+@@ -2044,8 +2044,6 @@ gst_h264_parse_sps_mvc_data (NalReader * nr, GstH264SPS * sps)
+   READ_UE_MAX (nr, mvc->num_views_minus1, GST_H264_MAX_VIEW_COUNT - 1);
+
+   mvc->view = g_new0 (GstH264SPSExtMVCView, mvc->num_views_minus1 + 1);
+-  if (!mvc->view)
+-    goto error_allocation_failed;
+
+   for (i = 0; i <= mvc->num_views_minus1; i++)
+     READ_UE_MAX (nr, mvc->view[i].view_id, GST_H264_MAX_VIEW_ID);
+@@ -2083,8 +2081,6 @@ gst_h264_parse_sps_mvc_data (NalReader * nr, GstH264SPS * sps)
+   mvc->level_value =
+       g_new0 (GstH264SPSExtMVCLevelValue,
+       mvc->num_level_values_signalled_minus1 + 1);
+-  if (!mvc->level_value)
+-    goto error_allocation_failed;
+
+   for (i = 0; i <= mvc->num_level_values_signalled_minus1; i++) {
+     GstH264SPSExtMVCLevelValue *const level_value = &mvc->level_value[i];
+@@ -2095,8 +2091,6 @@ gst_h264_parse_sps_mvc_data (NalReader * nr, GstH264SPS * sps)
+     level_value->applicable_op =
+         g_new0 (GstH264SPSExtMVCLevelValueOp,
+         level_value->num_applicable_ops_minus1 + 1);
+-    if (!level_value->applicable_op)
+-      goto error_allocation_failed;
+
+     for (j = 0; j <= level_value->num_applicable_ops_minus1; j++) {
+       GstH264SPSExtMVCLevelValueOp *const op = &level_value->applicable_op[j];
+@@ -2105,8 +2099,6 @@ gst_h264_parse_sps_mvc_data (NalReader * nr, GstH264SPS * sps)
+
+       READ_UE_MAX (nr, op->num_target_views_minus1, 1023);
+       op->target_view_id = g_new (guint16, op->num_target_views_minus1 + 1);
+-      if (!op->target_view_id)
+-        goto error_allocation_failed;
+
+       for (k = 0; k <= op->num_target_views_minus1; k++)
+         READ_UE_MAX (nr, op->target_view_id[k], GST_H264_MAX_VIEW_ID);
+@@ -2115,11 +2107,6 @@ gst_h264_parse_sps_mvc_data (NalReader * nr, GstH264SPS * sps)
+   }
+   return TRUE;
+
+-error_allocation_failed:
+-  GST_WARNING ("failed to allocate memory");
+-  gst_h264_sps_clear (sps);
+-  return FALSE;
+-
+ error:
+   gst_h264_sps_clear (sps);
+   return FALSE;
+@@ -2632,15 +2619,19 @@ gst_h264_sps_mvc_clear (GstH264SPS * sps)
+   g_free (mvc->view);
+   mvc->view = NULL;
+
+-  for (i = 0; i <= mvc->num_level_values_signalled_minus1; i++) {
+-    GstH264SPSExtMVCLevelValue *const level_value = &mvc->level_value[i];
++  if (mvc->level_value) {
++    for (i = 0; i <= mvc->num_level_values_signalled_minus1; i++) {
++      GstH264SPSExtMVCLevelValue *const level_value = &mvc->level_value[i];
+
+-    for (j = 0; j <= level_value->num_applicable_ops_minus1; j++) {
+-      g_free (level_value->applicable_op[j].target_view_id);
+-      level_value->applicable_op[j].target_view_id = NULL;
++      if (level_value->applicable_op) {
++        for (j = 0; j <= level_value->num_applicable_ops_minus1; j++) {
++          g_free (level_value->applicable_op[j].target_view_id);
++          level_value->applicable_op[j].target_view_id = NULL;
++        }
++      }
++      g_free (level_value->applicable_op);
++      level_value->applicable_op = NULL;
+     }
+-    g_free (level_value->applicable_op);
+-    level_value->applicable_op = NULL;
+   }
+   g_free (mvc->level_value);
+   mvc->level_value = NULL;
diff --git a/debian/patches/CVE-2026-119729.patch b/debian/patches/CVE-2026-119729.patch
@@ -0,0 +1,85 @@
+Description: CVE-2026-119729 (medium) - GStreamer 的 AV1 解析代码在解析 LEB128 编码值时存在有符号 32 位整数溢出与边界检查缺陷，可导致越界读取或拒绝服务。
+Author: Sebastian Dröge <sebastian@centricular.com>
+Origin: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11245
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-119729
+Last-Update: 2026-03-26
+---
+diff --git a/gst-libs/gst/codecparsers/gstav1parser.c b/gst-libs/gst/codecparsers/gstav1parser.c
+index 5a5d495..ed13efa 100644
+--- a/gst-libs/gst/codecparsers/gstav1parser.c
++++ b/gst-libs/gst/codecparsers/gstav1parser.c
+@@ -294,13 +294,18 @@ av1_bitstreamfn_leb128 (GstBitReader * br, GstAV1ParserResult * retval)
+     if (*retval != GST_AV1_PARSER_OK)
+       return 0;
+
+-    value |= (((gint) leb128_byte & 0x7f) << (i * 7));
++    value |= (((guint64) leb128_byte & 0x7f) << (i * 7));
+     if (!(leb128_byte & 0x80))
+       break;
++
++    if (i == 7 && leb128_byte & 0x80) {
++      *retval = GST_AV1_PARSER_BITSTREAM_ERROR;
++      return 0;
++    }
+   }
+
+   /* check for bitstream conformance see chapter4.10.5 */
+-  if (value < G_MAXUINT32) {
++  if (value <= G_MAXUINT32) {
+     return (guint32) value;
+   } else {
+     GST_WARNING ("invalid leb128");
+diff --git a/gst/videoparsers/gstav1parse.c b/gst/videoparsers/gstav1parse.c
+index 3d38289..eeed012 100644
+--- a/gst/videoparsers/gstav1parse.c
++++ b/gst/videoparsers/gstav1parse.c
+@@ -202,7 +202,8 @@ _obu_name (GstAV1OBUType type)
+ }
+
+ static guint32
+-_read_leb128 (guint8 * data, GstAV1ParserResult * retval, guint32 * comsumed)
++_read_leb128 (guint8 * data, gsize size, GstAV1ParserResult * retval,
++    guint32 * comsumed)
+ {
+   guint8 leb128_byte = 0;
+   guint64 value = 0;
+@@ -211,7 +212,7 @@ _read_leb128 (guint8 * data, GstAV1ParserResult * retval, guint32 * comsumed)
+   GstBitReader br;
+   guint32 cur_pos;
+
+-  gst_bit_reader_init (&br, data, 8);
++  gst_bit_reader_init (&br, data, size);
+
+   cur_pos = gst_bit_reader_get_pos (&br);
+   for (i = 0; i < 8; i++) {
+@@ -222,14 +223,19 @@ _read_leb128 (guint8 * data, GstAV1ParserResult * retval, guint32 * comsumed)
+       return 0;
+     }
+
+-    value |= (((gint) leb128_byte & 0x7f) << (i * 7));
++    value |= (((guint64) leb128_byte & 0x7f) << (i * 7));
+     if (!(leb128_byte & 0x80))
+       break;
++
++    if (i == 7 && leb128_byte & 0x80) {
++      *retval = GST_AV1_PARSER_BITSTREAM_ERROR;
++      return 0;
++    }
+   }
+
+   *comsumed = (gst_bit_reader_get_pos (&br) - cur_pos) / 8;
+   /* check for bitstream conformance see chapter4.10.5 */
+-  if (value < G_MAXUINT32) {
++  if (value <= G_MAXUINT32) {
+     *retval = GST_AV1_PARSER_OK;
+     return (guint32) value;
+   } else {
+@@ -1987,7 +1993,7 @@ again:
+     goto out;
+   }
+
+-  tu_sz = _read_leb128 (map_info.data, &res, &consumed);
++  tu_sz = _read_leb128 (map_info.data, map_info.size, &res, &consumed);
+   if (tu_sz == 0 || res != GST_AV1_PARSER_OK) {
+     /* error to get the TU size, should not be annex b. */
+     goto out;
diff --git a/debian/patches/CVE-2026-12892.patch b/debian/patches/CVE-2026-12892.patch
@@ -0,0 +1,20 @@
+Description: CVE-2026-12892 (medium) - h264parse: Check for enough slice header data being available
+Author: Sebastian Dr鰃e <sebastian@centricular.com>
+Origin: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8c6d4df57b531c7b41a5f3bce28d2c7bc98a1d3d
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-12892
+Last-Update: 2026-09-12
+---
+diff --git a/gst/videoparsers/gsth264parse.c b/gst/videoparsers/gsth264parse.c
+index d7fea7c..c27ce74 100644
+--- a/gst/videoparsers/gsth264parse.c
++++ b/gst/videoparsers/gsth264parse.c
+@@ -1084,7 +1084,8 @@ gst_h264_parse_process_nal (GstH264Parse * h264parse, GstH264NalUnit * nalu)
+       h264parse->picture_start = TRUE;
+
+       /* don't need to parse the whole slice (header) here */
+-      if (*(nalu->data + nalu->offset + nalu->header_bytes) & 0x80) {
++      if (nalu->size > nalu->header_bytes &&
++          *(nalu->data + nalu->offset + nalu->header_bytes) & 0x80) {
+         /* means first_mb_in_slice == 0 */
+         /* real frame data */
+         GST_DEBUG_OBJECT (h264parse, "first_mb_in_slice = 0");
diff --git a/debian/patches/series b/debian/patches/series
@@ -15,3 +15,7 @@ CVE-2026-52722.patch
 CVE-2026-52721.patch
 CVE-2026-14935.patch
 CVE-2026-19387.patch
+CVE-2026-12892.patch
+CVE-2026-119729.patch
+CVE-2026-119728.patch
+CVE-2026-119727.patch