Star0
15
代码
代码
Issues12
Pull Requests1
项目讨论
Wiki
分析
Star0
15
已关闭
Fix CVE-2026-59691: heap buffer overflow in RFB source when decoding framebuffer updates #110
hanjinpeng创建于 7月13日关闭于 4 天前
Fix CVE-2026-59691: heap buffer overflow in RFB source when decoding framebuffer updates #110
已关闭
hanjinpeng创建于 7月13日关闭于 4 天前
从protkhn/gstreamer1-plugins-bad-freefix-CVE-2026-59691合入到src-openeuler/gstreamer1-plugins-bad-freeopenEuler-24.03-LTS-SP3
共 2 个文件变更+135-1
ACVE-2026-59691.patch+127-0
@@ -0,0 +1,127 @@
1+diff --git a/gst/librfb/rfbdecoder.c b/gst/librfb/rfbdecoder.c
2+index fa76331..af9c291 100644
3+--- a/gst/librfb/rfbdecoder.c
4++++ b/gst/librfb/rfbdecoder.c
5+@@ -918,35 +918,36 @@ rfb_decoder_copyrect_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
6+
7+ static void
8+ rfb_decoder_fill_rectangle (RfbDecoder * decoder, gint x, gint y, gint w,
9+- gint h, guint32 color)
10++ gint h, const guint8 * color)
11+ {
12+- /* fill the whole region with the same color */
13+-
14+- guint32 *offset;
15++ guint8 *offset;
16+ gint i, j;
17++ gint bytespp = decoder->bytespp;
18+
19+ for (i = 0; i < h; i++) {
20+- offset =
21+- (guint32 *) (decoder->frame + ((x + (y +
22+- i) * decoder->rect_width)) * decoder->bytespp);
23++ offset = decoder->frame + ((x + (y + i) * decoder->rect_width)) * bytespp;
24+ for (j = 0; j < w; j++) {
25+- *(offset++) = color;
26++ memcpy (offset, color, bytespp);
27++ offset += bytespp;
28+ }
29+ }
30+ }
31+
32++static const guint8 zero_color[4] = { 0, 0, 0, 0 };
33++
34+ static gboolean
35+ rfb_decoder_rre_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
36+ gint rect_w, gint rect_h)
37+ {
38+- guint32 number_of_rectangles, color;
39++ guint32 number_of_rectangles;
40++ const guint8 *color;
41+ guint16 x, y, w, h;
42+
43+ if (!rfb_decoder_read (decoder, 4 + decoder->bytespp))
44+ return FALSE;
45+
46+ number_of_rectangles = RFB_GET_UINT32 (decoder->data);
47+- color = GUINT32_SWAP_LE_BE ((RFB_GET_UINT32 (decoder->data + 4)));
48++ color = decoder->data + 4;
49+
50+ GST_DEBUG ("number of rectangles :%d", number_of_rectangles);
51+
52+@@ -958,7 +959,7 @@ rfb_decoder_rre_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
53+ if (!rfb_decoder_read (decoder, decoder->bytespp + 8))
54+ return FALSE;
55+
56+- color = GUINT32_SWAP_LE_BE ((RFB_GET_UINT32 (decoder->data)));
57++ color = decoder->data;
58+ x = RFB_GET_UINT16 (decoder->data + decoder->bytespp);
59+ y = RFB_GET_UINT16 (decoder->data + decoder->bytespp + 2);
60+ w = RFB_GET_UINT16 (decoder->data + decoder->bytespp + 4);
61+@@ -975,14 +976,15 @@ static gboolean
62+ rfb_decoder_corre_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
63+ gint rect_w, gint rect_h)
64+ {
65+- guint32 number_of_rectangles, color;
66++ guint32 number_of_rectangles;
67++ const guint8 *color;
68+ guint8 x, y, w, h;
69+
70+ if (!rfb_decoder_read (decoder, 4 + decoder->bytespp))
71+ return FALSE;
72+
73+ number_of_rectangles = RFB_GET_UINT32 (decoder->data);
74+- color = GUINT32_SWAP_LE_BE ((RFB_GET_UINT32 (decoder->data + 4)));
75++ color = decoder->data + 4;
76+
77+ GST_DEBUG ("number of rectangles :%d", number_of_rectangles);
78+
79+@@ -994,7 +996,7 @@ rfb_decoder_corre_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
80+ if (!rfb_decoder_read (decoder, decoder->bytespp + 4))
81+ return FALSE;
82+
83+- color = GUINT32_SWAP_LE_BE ((RFB_GET_UINT32 (decoder->data)));
84++ color = decoder->data;
85+ x = RFB_GET_UINT8 (decoder->data + decoder->bytespp);
86+ y = RFB_GET_UINT8 (decoder->data + decoder->bytespp + 1);
87+ w = RFB_GET_UINT8 (decoder->data + decoder->bytespp + 2);
88+@@ -1014,9 +1016,9 @@ rfb_decoder_hextile_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
89+ gint32 x, x_count G_GNUC_UNUSED, x_end, x_max, x_max_16;
90+ gint32 y, y_count G_GNUC_UNUSED, y_end, y_max, y_max_16;
91+ guint8 subencoding, nr_subrect, xy, wh;
92+- guint32 background, foreground;
93++ const guint8 *background, *foreground;
94+
95+- foreground = background = 0;
96++ foreground = background = zero_color;
97+ x_end = rect_w % 16;
98+ x_count = rect_w / 16 + (x_end > 0 ? 1 : 0);
99+ y_end = rect_h % 16;
100+@@ -1044,7 +1046,7 @@ rfb_decoder_hextile_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
101+ if (!rfb_decoder_read (decoder, decoder->bytespp))
102+ return FALSE;
103+
104+- background = GUINT32_SWAP_LE_BE ((RFB_GET_UINT32 (decoder->data)));
105++ background = decoder->data;
106+ }
107+ rfb_decoder_fill_rectangle (decoder, x, y,
108+ (x <= x_max_16 ? 16 : x_end), (y <= y_max_16 ? 16 : y_end),
109+@@ -1054,7 +1056,7 @@ rfb_decoder_hextile_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
110+ if (!rfb_decoder_read (decoder, decoder->bytespp))
111+ return FALSE;
112+
113+- foreground = GUINT32_SWAP_LE_BE ((RFB_GET_UINT32 (decoder->data)));
114++ foreground = decoder->data;
115+ }
116+
117+ if (subencoding & SUBENCODING_ANYSUBRECTS) {
118+@@ -1073,8 +1075,7 @@ rfb_decoder_hextile_encoding (RfbDecoder * decoder, gint start_x, gint start_y,
119+ return FALSE;
120+
121+ while (nr_subrect--) {
122+- foreground =
123+- GUINT32_SWAP_LE_BE ((RFB_GET_UINT32 (decoder->data + offset)));
124++ foreground = decoder->data + offset;
125+ offset += decoder->bytespp;
126+ xy = RFB_GET_UINT8 (decoder->data + offset++);
127+ wh = RFB_GET_UINT8 (decoder->data + offset++);
Mgstreamer1-plugins-bad-free.spec+8-1
@@ -3,7 +3,7 @@
3 3 
4Name: gstreamer1-plugins-bad-free4Name: gstreamer1-plugins-bad-free
5Version: 1.16.25Version: 1.16.2
6-Release: 166+Release: 17
7Summary: Not well tested plugins for GStreamer framework7Summary: Not well tested plugins for GStreamer framework
8License: LGPLv2+ and LGPLv28License: LGPLv2+ and LGPLv2
9URL: http://gstreamer.freedesktop.org/9URL: http://gstreamer.freedesktop.org/
@@ -32,6 +32,7 @@ Patch0013: CVE-2026-2923.patch
32# GStreamer-SA-2026-0043 / CVE-2026-5272032# GStreamer-SA-2026-0043 / CVE-2026-52720
33# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f3b66928a194b32b27fac3c3379d3d20e596644233# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/f3b66928a194b32b27fac3c3379d3d20e5966442
34Patch0014: CVE-2026-52720.patch34Patch0014: CVE-2026-52720.patch
35+Patch0015: CVE-2026-59691.patch
35 36 
36BuildRequires: gstreamer1-devel >= %{version} autoconf37BuildRequires: gstreamer1-devel >= %{version} autoconf
37BuildRequires: gstreamer1-plugins-base-devel >= %{version}38BuildRequires: gstreamer1-plugins-base-devel >= %{version}
@@ -283,6 +284,12 @@ EOF
283%{_libdir}/pkgconfig/gstreamer*-%{majorminor}.pc284%{_libdir}/pkgconfig/gstreamer*-%{majorminor}.pc
284%{_includedir}/gstreamer-%{majorminor}/gst/*285%{_includedir}/gstreamer-%{majorminor}/gst/*
285%changelog286%changelog
287+* Wed Jul 13 2026 hanjinpeng <hanjinpeng@kylinos.cn> - 1.16.2-17
288+- Type:CVE
289+- CVE:CVE-2026-59691
290+- SUG:NA
291+- DESC:Fix heap buffer overflow in RFB source when decoding framebuffer updates
292+ 
286* Sat Jul 11 2026 Liu Hui <2224621664@qq.com> - 1.16.2-16293* Sat Jul 11 2026 Liu Hui <2224621664@qq.com> - 1.16.2-16
287- Type:CVE294- Type:CVE
288- CVE:CVE-2026-52720295- CVE:CVE-2026-52720