fix(gst-plugins-good1.0): CVE-2026-39043

debian/changelog

@@ -1,3 +1,17 @@
+gst-plugins-good1.0 (1.24.13-0deepin5) unstable; urgency=medium
+
+  * Fix CVE-2026-39043: heap buffer overflow in Matroska demuxer bz2
+    decompression buffer size calculation (gstreamer MR !11248)
+
+ -- deepin-ci-robot <packages@deepin.org>  Thu, 18 Jun 2026 02:30:00 +0800
+
+gst-plugins-good1.0 (1.24.13-0deepin4) unstable; urgency=medium
+
+  * Fix CVE-2026-39044: integer overflow in WAV parser cue chunk parsing
+    (gstreamer MR !11247)
+
+ -- deepin-ci-robot <packages@deepin.org>  Thu, 18 Jun 2026 02:30:00 +0800
+
 gst-plugins-good1.0 (1.24.13-0deepin3) unstable; urgency=medium
 
   * Fix CVE-2026-46470: divide by zero in qtdemux_audio_caps

debian/patches/0018-CVE-2026-39044-wavparse-fix-integer-overflow-in-cue.patch

@@ -0,0 +1,39 @@
+Description: Fix integer overflow in WAV parser cue chunk parsing
+ Integer overflow in the WAV parser (wavparse) when handling malformed WAV
+ files with cue chunks.
+CVE: CVE-2026-39044
+Author: deepin-ci-robot <packages@deepin.org>
+Origin: upstream, https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/83becc83eac4
+Forwarded: not-needed
+Last-Update: 2026-06-18
+
+Index: gst-good-fix/gst/wavparse/gstwavparse.c
+===================================================================
+--- gst-good-fix.orig/gst/wavparse/gstwavparse.c
++++ gst-good-fix/gst/wavparse/gstwavparse.c
+@@ -788,6 +788,7 @@ gst_wavparse_cue_chunk (GstWavParse * wa
+   guint32 i, ncues;
+   GList *cues = NULL;
+   GstWavParseCue *cue;
++  guint32 expected_size;
+
+   if (wav->cues) {
+     GST_WARNING_OBJECT (wav, "found another cue's");
+@@ -800,14 +801,15 @@ gst_wavparse_cue_chunk (GstWavParse * wa
+   }
+
+   ncues = GST_READ_UINT32_LE (data);
++  size -= 4;
++  data += 4;
+
+-  if (size < 4 + ncues * 24) {
++  if (!g_uint_checked_mul (&expected_size, ncues, 24) || size < expected_size) {
+     GST_WARNING_OBJECT (wav, "broken file %d %d", size, ncues);
+     return FALSE;
+   }
+
+   /* parse data */
+-  data += 4;
+   for (i = 0; i < ncues; i++) {
+     cue = g_new0 (GstWavParseCue, 1);
+     cue->id = GST_READ_UINT32_LE (data);

debian/patches/0019-CVE-2026-39043-matroska-fix-heap-buffer-overflow-in-b.patch

@@ -0,0 +1,35 @@
+Description: Fix heap buffer overflow in Matroska demuxer bz2 buffer size calculation
+ Heap buffer overflow in the Matroska (MKV) demuxer when calculating decompressed
+ buffer sizes for bz2-compressed tracks. The issue occurs due to missing
+ parentheses in the buffer size calculation, causing incorrect memory allocation
+ and potential out-of-bounds writes.
+CVE: CVE-2026-39043
+Author: deepin-ci-robot <packages@deepin.org>
+Origin: upstream, https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/8647118624fd14983507edbb509d0e534a0353a9
+Forwarded: not-needed
+Last-Update: 2026-06-18
+Index: gst-plugins-good1.0/gst/matroska/matroska-read-common.c
+===================================================================
+--- gst-good-fix.orig/gst/matroska/matroska-read-common.c
++++ gst-good-fix/gst/matroska/matroska-read-common.c
+@@ -190,14 +190,14 @@ gst_matroska_decompress_data (GstMatrosk
+       new_size += 4096;
+       new_data = g_realloc (new_data, new_size);
+       bzstream.next_out =
+-          (char *) (new_data + ((guint64) bzstream.total_out_hi32 << 32) +
+-          bzstream.total_out_lo32);
++          (char *) (new_data + (((guint64) bzstream.total_out_hi32 << 32) +
++              bzstream.total_out_lo32));
+       /* avail_out is an unsigned int */
+-      g_assert (new_size - ((guint64) bzstream.total_out_hi32 << 32) +
+-          bzstream.total_out_lo32 <= G_MAXUINT);
++      g_assert (new_size - (((guint64) bzstream.total_out_hi32 << 32) +
++              bzstream.total_out_lo32 <= G_MAXUINT));
+       bzstream.avail_out =
+-          new_size - ((guint64) bzstream.total_out_hi32 << 32) +
+-          bzstream.total_out_lo32;
++          new_size - (((guint64) bzstream.total_out_hi32 << 32) +
++          bzstream.total_out_lo32);
+     } while (bzstream.avail_in > 0);
+
+     if (result != BZ_STREAM_END) {