Skip to content

fix(gst-plugins-good1.0): CVE-2026-39043#10

Open
deepin-ci-robot wants to merge 2 commits into
masterfrom
fix/CVE-2026-39043
Open

fix(gst-plugins-good1.0): CVE-2026-39043#10
deepin-ci-robot wants to merge 2 commits into
masterfrom
fix/CVE-2026-39043

Conversation

@deepin-ci-robot

@deepin-ci-robot deepin-ci-robot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Fix heap buffer overflow in Matroska demuxer bz2 decompression buffer size calculation.

CVE-2026-39043

(gstreamer MR !11248)

@deepin-ci-robot

deepin-ci-robot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor Author

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hudeng-go for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@github-actions

github-actions Bot commented Jun 17, 2026

Copy link
Copy Markdown

TAG Bot

TAG: 1.24.13-0deepin5
EXISTED: no
DISTRIBUTION: unstable

@deepin-ci-robot
deepin-ci-robot force-pushed the fix/CVE-2026-39043 branch 4 times, most recently from 4b3ae45 to fee4926 Compare June 18, 2026 05:34
@deepin-ci-robot @hudeng-go
fix(gst-plugins-good1.0): CVE-2026-39044
4ffd46c 
Fix integer overflow in WAV parser cue chunk parsing.
Use g_uint_checked_mul for safe overflow check instead of cast.

Upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/83becc83eac4
Generated-By: deepin-ci-robot

Co-Authored-By: hudeng <hudeng@deepin.org>
@deepin-ci-robot @hudeng-go
fix(gst-plugins-good1.0): CVE-2026-39043
6546253 
Fix CVE-2026-39043: Add missing parentheses in Matroska demuxer bz2 buffer size calculation

3 hunks fixed to match upstream commit 8647118624fd:
- bzstream.next_out assignment
- g_assert buffer size check
- bzstream.avail_out assignment

Upstream: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8647118624fd14983507edbb509d0e534a0353a9
Generated-By: deepin-ci-robot

Co-Authored-By: hudeng <hudeng@deepin.org>
@deepin-community-ci-bot

deepin-community-ci-bot Bot commented Jun 25, 2026

Copy link
Copy Markdown

TAG Bot

New tag: 1.24.13-0deepin4
DISTRIBUTION: unstable
Suggest: synchronizing this PR through rebase #14

@deepin-ci-robot

deepin-ci-robot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

/integrate

@github-actions

github-actions Bot commented Jul 8, 2026

Copy link
Copy Markdown

AutoIntegrationPr Bot
auto integrate with pr url: deepin-community/Repository-Integration#4278
PrNumber: 4278
PrBranch: auto-integration-28914593612

@deepin-community-ci-bot deepin-community-ci-bot Bot mentioned this pull request Jul 8, 2026
Open
@deepin-community-ci-bot

deepin-community-ci-bot Bot commented Jul 22, 2026

Copy link
Copy Markdown

TAG Bot

New tag: 1.26.2-1deepin2
DISTRIBUTION: unstable
Suggest: synchronizing this PR through rebase #15

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BLumia BLumia Awaiting requested review from BLumia
@chenchongbiao chenchongbiao Awaiting requested review from chenchongbiao

Assignees

No one assigned

Labels

cve CVE fix generated-by-ai

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@deepin-ci-robot