diff options
Diffstat (limited to 'meta/recipes-multimedia/gstreamer')
19 files changed, 712 insertions, 314 deletions
diff --git a/meta/recipes-multimedia/gstreamer/gst-devtools_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gst-devtools_1.20.7.bb index 9db31c18e4..2409ea25e1 100644 --- a/meta/recipes-multimedia/gstreamer/gst-devtools_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gst-devtools_1.20.7.bb @@ -12,7 +12,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${PV} file://0001-connect-has-a-different-signature-on-musl.patch \ " -SRC_URI[sha256sum] = "5684436121b8bae07fd00b74395f95e44b5f26323dce4fa045fa665676807bba" +SRC_URI[sha256sum] = "2df2ddfee05f6ce978207de9086ca22f00fc36e04f74a11869074da178585e35" DEPENDS = "json-glib glib-2.0 glib-2.0-native gstreamer1.0 gstreamer1.0-plugins-base" RRECOMMENDS:${PN} = "git" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.20.7.bb index e5925c6510..f3f53893b6 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-libav_1.20.7.bb @@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=69333daa044cb77e486cc36129f7a770 \ " SRC_URI = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${PV}.tar.xz" -SRC_URI[sha256sum] = "b152e3cc49d014899f53c39d8a6224a44e1399b4cf76aa5f9a903fdf9793c3cc" +SRC_URI[sha256sum] = "65e776e366f7f3549a9a829418817f464dcc5dc9845220c64a886683d8841b56" S = "${WORKDIR}/gst-libav-${PV}" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-omx_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-omx_1.20.7.bb index ec5efcd408..bcbe0206d7 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-omx_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-omx_1.20.7.bb @@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c \ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-omx/gst-omx-${PV}.tar.xz" -SRC_URI[sha256sum] = "bcccbc02548cdc123fd49944dd44a4f1adc5d107e36f010d320eb526e2107806" +SRC_URI[sha256sum] = "e3dd418e3235db044104c1cb024f609e57035251fd1718e4e3e5d64780af1805" S = "${WORKDIR}/gst-omx-${PV}" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40474.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40474.patch new file mode 100644 index 0000000000..dd5886863d --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40474.patch @@ -0,0 +1,118 @@ +From ce17e968e4cf900d28ca5b46f6e095febc42b4f0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com> +Date: Thu, 10 Aug 2023 15:45:01 +0300 +Subject: [PATCH] mxfdemux: Fix integer overflow causing out of bounds writes + when handling invalid uncompressed video + +Check ahead of time when parsing the track information whether +width, height and bpp are valid and usable without overflows. + +Fixes ZDI-CAN-21660, CVE-2023-40474 + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2896 + +Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5362> + +Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/ce17e968e4cf900d28ca5b46f6e095febc42b4f0] +CVE: CVE-2023-40474 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + gst/mxf/mxfup.c | 51 +++++++++++++++++---- + 1 file changed, 43 insertions(+), 8 deletions(-) + +diff --git a/gst/mxf/mxfup.c b/gst/mxf/mxfup.c +index d72ed22cb7..0c0178c1c9 100644 +--- a/gst/mxf/mxfup.c ++++ b/gst/mxf/mxfup.c +@@ -118,6 +118,8 @@ mxf_up_handle_essence_element (const MXFUL * key, GstBuffer * buffer, + gpointer mapping_data, GstBuffer ** outbuf) + { + MXFUPMappingData *data = mapping_data; ++ gsize expected_in_stride = 0, out_stride = 0; ++ gsize expected_in_size = 0, out_size = 0; + + /* SMPTE 384M 7.1 */ + if (key->u[12] != 0x15 || (key->u[14] != 0x01 && key->u[14] != 0x02 +@@ -146,22 +148,25 @@ mxf_up_handle_essence_element (const MXFUL * key, GstBuffer * buffer, + } + } + +- if (gst_buffer_get_size (buffer) != data->bpp * data->width * data->height) { ++ // Checked for overflows when parsing the descriptor ++ expected_in_stride = data->bpp * data->width; ++ out_stride = GST_ROUND_UP_4 (expected_in_stride); ++ expected_in_size = expected_in_stride * data->height; ++ out_size = out_stride * data->height; ++ ++ if (gst_buffer_get_size (buffer) != expected_in_size) { + GST_ERROR ("Invalid buffer size"); + gst_buffer_unref (buffer); + return GST_FLOW_ERROR; + } + +- if (data->bpp != 4 +- || GST_ROUND_UP_4 (data->width * data->bpp) != data->width * data->bpp) { ++ if (data->bpp != 4 || out_stride != expected_in_stride) { + guint y; + GstBuffer *ret; + GstMapInfo inmap, outmap; + guint8 *indata, *outdata; + +- ret = +- gst_buffer_new_and_alloc (GST_ROUND_UP_4 (data->width * data->bpp) * +- data->height); ++ ret = gst_buffer_new_and_alloc (out_size); + gst_buffer_map (buffer, &inmap, GST_MAP_READ); + gst_buffer_map (ret, &outmap, GST_MAP_WRITE); + indata = inmap.data; +@@ -169,8 +174,8 @@ mxf_up_handle_essence_element (const MXFUL * key, GstBuffer * buffer, + + for (y = 0; y < data->height; y++) { + memcpy (outdata, indata, data->width * data->bpp); +- outdata += GST_ROUND_UP_4 (data->width * data->bpp); +- indata += data->width * data->bpp; ++ outdata += out_stride; ++ indata += expected_in_stride; + } + + gst_buffer_unmap (buffer, &inmap); +@@ -378,6 +383,36 @@ mxf_up_create_caps (MXFMetadataTimelineTrack * track, GstTagList ** tags, + return NULL; + } + ++ if (caps) { ++ MXFUPMappingData *data = *mapping_data; ++ gsize expected_in_stride = 0, out_stride = 0; ++ gsize expected_in_size = 0, out_size = 0; ++ ++ // Do some checking of the parameters to see if they're valid and ++ // we can actually work with them. ++ if (data->image_start_offset > data->image_end_offset) { ++ GST_WARNING ("Invalid image start/end offset"); ++ g_free (data); ++ *mapping_data = NULL; ++ gst_clear_caps (&caps); ++ ++ return NULL; ++ } ++ ++ if (!g_size_checked_mul (&expected_in_stride, data->bpp, data->width) || ++ (out_stride = GST_ROUND_UP_4 (expected_in_stride)) < expected_in_stride ++ || !g_size_checked_mul (&expected_in_size, expected_in_stride, ++ data->height) ++ || !g_size_checked_mul (&out_size, out_stride, data->height)) { ++ GST_ERROR ("Invalid resolution or bit depth"); ++ g_free (data); ++ *mapping_data = NULL; ++ gst_clear_caps (&caps); ++ ++ return NULL; ++ } ++ } ++ + return caps; + } + +-- +2.40.0 diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40475.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40475.patch new file mode 100644 index 0000000000..ab9ac7afaa --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40475.patch @@ -0,0 +1,49 @@ +From 72742dee30cce7bf909639f82de119871566ce39 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com> +Date: Thu, 10 Aug 2023 15:47:03 +0300 +Subject: [PATCH] mxfdemux: Check number of channels for AES3 audio + +Only up to 8 channels are allowed and using a higher number would cause +integer overflows when copying the data, and lead to out of bound +writes. + +Also check that each buffer is at least 4 bytes long to avoid another +overflow. + +Fixes ZDI-CAN-21661, CVE-2023-40475 + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2897 + +Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5362> + +Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/72742dee30cce7bf909639f82de119871566ce39] +CVE: CVE-2023-40475 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + gst/mxf/mxfd10.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/gst/mxf/mxfd10.c b/gst/mxf/mxfd10.c +index 03854d9303..0ad0d2d283 100644 +--- a/gst/mxf/mxfd10.c ++++ b/gst/mxf/mxfd10.c +@@ -101,7 +101,7 @@ mxf_d10_sound_handle_essence_element (const MXFUL * key, GstBuffer * buffer, + gst_buffer_map (buffer, &map, GST_MAP_READ); + + /* Now transform raw AES3 into raw audio, see SMPTE 331M */ +- if ((map.size - 4) % 32 != 0) { ++ if (map.size < 4 || (map.size - 4) % 32 != 0) { + gst_buffer_unmap (buffer, &map); + GST_ERROR ("Invalid D10 sound essence buffer size"); + return GST_FLOW_ERROR; +@@ -201,6 +201,7 @@ mxf_d10_create_caps (MXFMetadataTimelineTrack * track, GstTagList ** tags, + GstAudioFormat audio_format; + + if (s->channel_count == 0 || ++ s->channel_count > 8 || + s->quantization_bits == 0 || + s->audio_sampling_rate.n == 0 || s->audio_sampling_rate.d == 0) { + GST_ERROR ("Invalid descriptor"); +-- +2.40.0 diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40476.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40476.patch new file mode 100644 index 0000000000..7810e98024 --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-40476.patch @@ -0,0 +1,44 @@ +From 1b51467ea640bcc73c97f3186350d72cbfba5cb4 Mon Sep 17 00:00:00 2001 +From: Nicolas Dufresne <nicolas.dufresne@collabora.com> +Date: Wed, 9 Aug 2023 12:49:19 -0400 +Subject: [PATCH] h265parser: Fix possible overflow using max_sub_layers_minus1 + +This fixes a possible overflow that can be triggered by an invalid value of +max_sub_layers_minus1 being set in the bitstream. The bitstream uses 3 bits, +but the allowed range is 0 to 6 only. + +Fixes ZDI-CAN-21768, CVE-2023-40476 + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2895 + +Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5364> + +Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/ff91a3d8d6f7e2412c44663bf30fad5c7fdbc9d9] +CVE: CVE-2023-40476 + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> + +--- + gst-libs/gst/codecparsers/gsth265parser.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/gst-libs/gst/codecparsers/gsth265parser.c b/gst-libs/gst/codecparsers/gsth265parser.c +index a4e7549..3db1c38 100644 +--- a/gst-libs/gst/codecparsers/gsth265parser.c ++++ b/gst-libs/gst/codecparsers/gsth265parser.c +@@ -1670,6 +1670,7 @@ gst_h265_parse_vps (GstH265NalUnit * nalu, GstH265VPS * vps) + + READ_UINT8 (&nr, vps->max_layers_minus1, 6); + READ_UINT8 (&nr, vps->max_sub_layers_minus1, 3); ++ CHECK_ALLOWED (vps->max_sub_layers_minus1, 0, 6); + READ_UINT8 (&nr, vps->temporal_id_nesting_flag, 1); + + /* skip reserved_0xffff_16bits */ +@@ -1849,6 +1850,7 @@ gst_h265_parse_sps (GstH265Parser * parser, GstH265NalUnit * nalu, + sps->vps = vps; + + READ_UINT8 (&nr, sps->max_sub_layers_minus1, 3); ++ CHECK_ALLOWED (sps->max_sub_layers_minus1, 0, 6); + READ_UINT8 (&nr, sps->temporal_id_nesting_flag, 1); + + if (!gst_h265_parse_profile_tier_level (&sps->profile_tier_level, &nr, diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-44429.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-44429.patch new file mode 100644 index 0000000000..5070d6b865 --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-44429.patch @@ -0,0 +1,38 @@ +From 1db83d3f745332cbda6adf954b2c53a10caa205e Mon Sep 17 00:00:00 2001 +From: Benjamin Gaignard <benjamin.gaignard@collabora.com> +Date: Wed, 4 Oct 2023 11:14:38 +0200 +Subject: [PATCH] codecparsers: av1: Clip max tile rows and cols values + +Clip tile rows and cols to 64 as describe in AV1 specification. + +Fixes ZDI-CAN-22226 / CVE-2023-44429 + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3015 + +Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5634> + +CVE: CVE-2023-44429 + +Upstream-Status: Backport +[https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/1db83d3f745332cbda6adf954b2c53a10caa205e] + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + gst-libs/gst/codecparsers/gstav1parser.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/gst-libs/gst/codecparsers/gstav1parser.c b/gst-libs/gst/codecparsers/gstav1parser.c +index 7b9378c..68f8a76 100644 +--- a/gst-libs/gst/codecparsers/gstav1parser.c ++++ b/gst-libs/gst/codecparsers/gstav1parser.c +@@ -2219,6 +2219,8 @@ gst_av1_parse_tile_info (GstAV1Parser * parser, GstBitReader * br, + ((parser->state.mi_cols + 31) >> 5) : ((parser->state.mi_cols + 15) >> 4); + sb_rows = seq_header->use_128x128_superblock ? ((parser->state.mi_rows + + 31) >> 5) : ((parser->state.mi_rows + 15) >> 4); ++ sb_cols = MIN (GST_AV1_MAX_TILE_COLS, sb_cols); ++ sb_rows = MIN (GST_AV1_MAX_TILE_ROWS, sb_rows); + sb_shift = seq_header->use_128x128_superblock ? 5 : 4; + sb_size = sb_shift + 2; + max_tile_width_sb = GST_AV1_MAX_TILE_WIDTH >> sb_size; +-- +2.40.0 diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-44446.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-44446.patch new file mode 100644 index 0000000000..92fe82d36d --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-44446.patch @@ -0,0 +1,329 @@ +From 7dfaa57b6f9b55f17ffe824bd8988bb71ae11353 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com> +Date: Fri, 20 Oct 2023 00:09:57 +0300 +Subject: [PATCH] mxfdemux: Store GstMXFDemuxEssenceTrack in their own fixed + allocation + +Previously they were stored inline inside a GArray, but as references to +the tracks were stored in various other places although the array could +still be updated (and reallocated!), this could lead to dangling +references in various places. + +Instead now store them in a GPtrArray in their own allocation so each +track's memory position stays fixed. + +Fixes ZDI-CAN-22299 + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3055 + +Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5638> + +CVE: CVE-2023-44446 + +Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/7dfaa57b6f9b55f1] + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + gst/mxf/mxfdemux.c | 117 ++++++++++++++++++++------------------------- + gst/mxf/mxfdemux.h | 2 +- + 2 files changed, 52 insertions(+), 67 deletions(-) + +diff --git a/gst/mxf/mxfdemux.c b/gst/mxf/mxfdemux.c +index b0ccc17..7eb990c 100644 +--- a/gst/mxf/mxfdemux.c ++++ b/gst/mxf/mxfdemux.c +@@ -170,10 +170,25 @@ gst_mxf_demux_partition_free (GstMXFDemuxPartition * partition) + } + + static void +-gst_mxf_demux_reset_mxf_state (GstMXFDemux * demux) ++gst_mxf_demux_essence_track_free (GstMXFDemuxEssenceTrack * t) + { +- guint i; ++ if (t->offsets) ++ g_array_free (t->offsets, TRUE); ++ ++ g_free (t->mapping_data); ++ ++ if (t->tags) ++ gst_tag_list_unref (t->tags); ++ ++ if (t->caps) ++ gst_caps_unref (t->caps); ++ ++ g_free (t); ++} + ++static void ++gst_mxf_demux_reset_mxf_state (GstMXFDemux * demux) ++{ + GST_DEBUG_OBJECT (demux, "Resetting MXF state"); + + g_list_foreach (demux->partitions, (GFunc) gst_mxf_demux_partition_free, +@@ -183,22 +198,7 @@ gst_mxf_demux_reset_mxf_state (GstMXFDemux * demux) + + demux->current_partition = NULL; + +- for (i = 0; i < demux->essence_tracks->len; i++) { +- GstMXFDemuxEssenceTrack *t = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, i); +- +- if (t->offsets) +- g_array_free (t->offsets, TRUE); +- +- g_free (t->mapping_data); +- +- if (t->tags) +- gst_tag_list_unref (t->tags); +- +- if (t->caps) +- gst_caps_unref (t->caps); +- } +- g_array_set_size (demux->essence_tracks, 0); ++ g_ptr_array_set_size (demux->essence_tracks, 0); + } + + static void +@@ -216,7 +216,7 @@ gst_mxf_demux_reset_linked_metadata (GstMXFDemux * demux) + + for (i = 0; i < demux->essence_tracks->len; i++) { + GstMXFDemuxEssenceTrack *track = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, i); ++ g_ptr_array_index (demux->essence_tracks, i); + + track->source_package = NULL; + track->delta_id = -1; +@@ -419,7 +419,7 @@ gst_mxf_demux_partition_postcheck (GstMXFDemux * demux, + + for (i = 0; i < demux->essence_tracks->len; i++) { + GstMXFDemuxEssenceTrack *cand = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, i); ++ g_ptr_array_index (demux->essence_tracks, i); + + if (cand->body_sid != partition->partition.body_sid) + continue; +@@ -866,8 +866,7 @@ gst_mxf_demux_update_essence_tracks (GstMXFDemux * demux) + + for (k = 0; k < demux->essence_tracks->len; k++) { + GstMXFDemuxEssenceTrack *tmp = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, +- k); ++ g_ptr_array_index (demux->essence_tracks, k); + + if (tmp->track_number == track->parent.track_number && + tmp->body_sid == edata->body_sid) { +@@ -885,24 +884,24 @@ gst_mxf_demux_update_essence_tracks (GstMXFDemux * demux) + } + + if (!etrack) { +- GstMXFDemuxEssenceTrack tmp; ++ GstMXFDemuxEssenceTrack *tmp = g_new0 (GstMXFDemuxEssenceTrack, 1); ++ ++ tmp->body_sid = edata->body_sid; ++ tmp->index_sid = edata->index_sid; ++ tmp->track_number = track->parent.track_number; ++ tmp->track_id = track->parent.track_id; ++ memcpy (&tmp->source_package_uid, &package->parent.package_uid, 32); + +- memset (&tmp, 0, sizeof (tmp)); +- tmp.body_sid = edata->body_sid; +- tmp.index_sid = edata->index_sid; +- tmp.track_number = track->parent.track_number; +- tmp.track_id = track->parent.track_id; +- memcpy (&tmp.source_package_uid, &package->parent.package_uid, 32); + + if (demux->current_partition->partition.body_sid == edata->body_sid && + demux->current_partition->partition.body_offset == 0) +- tmp.position = 0; ++ tmp->position = 0; + else +- tmp.position = -1; ++ tmp->position = -1; + +- g_array_append_val (demux->essence_tracks, tmp); ++ g_ptr_array_add (demux->essence_tracks, tmp); + etrack = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, ++ g_ptr_array_index (demux->essence_tracks, + demux->essence_tracks->len - 1); + new = TRUE; + } +@@ -1050,13 +1049,7 @@ gst_mxf_demux_update_essence_tracks (GstMXFDemux * demux) + + next: + if (new) { +- g_free (etrack->mapping_data); +- if (etrack->tags) +- gst_tag_list_unref (etrack->tags); +- if (etrack->caps) +- gst_caps_unref (etrack->caps); +- +- g_array_remove_index (demux->essence_tracks, ++ g_ptr_array_remove_index (demux->essence_tracks, + demux->essence_tracks->len - 1); + } + } +@@ -1069,7 +1062,8 @@ gst_mxf_demux_update_essence_tracks (GstMXFDemux * demux) + + for (i = 0; i < demux->essence_tracks->len; i++) { + GstMXFDemuxEssenceTrack *etrack = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, i); ++ g_ptr_array_index (demux->essence_tracks, i); ++ + + if (!etrack->source_package || !etrack->source_track || !etrack->caps) { + GST_ERROR_OBJECT (demux, "Failed to update essence track %u", i); +@@ -1438,7 +1432,7 @@ gst_mxf_demux_update_tracks (GstMXFDemux * demux) + + for (k = 0; k < demux->essence_tracks->len; k++) { + GstMXFDemuxEssenceTrack *tmp = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, k); ++ g_ptr_array_index (demux->essence_tracks, k); + + if (tmp->source_package == source_package && + tmp->source_track == source_track) { +@@ -1927,8 +1921,7 @@ gst_mxf_demux_pad_set_component (GstMXFDemux * demux, GstMXFDemuxPad * pad, + pad->current_essence_track = NULL; + + for (k = 0; k < demux->essence_tracks->len; k++) { +- GstMXFDemuxEssenceTrack *tmp = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, k); ++ GstMXFDemuxEssenceTrack *tmp = g_ptr_array_index (demux->essence_tracks, k); + + if (tmp->source_package == source_package && + tmp->source_track == source_track) { +@@ -2712,7 +2705,7 @@ gst_mxf_demux_handle_generic_container_essence_element (GstMXFDemux * demux, + if (!etrack) { + for (i = 0; i < demux->essence_tracks->len; i++) { + GstMXFDemuxEssenceTrack *tmp = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, i); ++ g_ptr_array_index (demux->essence_tracks, i); + + if (tmp->body_sid == demux->current_partition->partition.body_sid && + (tmp->track_number == track_number || tmp->track_number == 0)) { +@@ -3933,8 +3926,7 @@ from_track_offset: + gst_mxf_demux_set_partition_for_offset (demux, demux->offset); + + for (i = 0; i < demux->essence_tracks->len; i++) { +- GstMXFDemuxEssenceTrack *t = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, i); ++ GstMXFDemuxEssenceTrack *t = g_ptr_array_index (demux->essence_tracks, i); + + if (index_start_position != -1 && t == etrack) + t->position = index_start_position; +@@ -3958,8 +3950,7 @@ from_track_offset: + /* Handle EOS */ + for (i = 0; i < demux->essence_tracks->len; i++) { + GstMXFDemuxEssenceTrack *t = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, +- i); ++ g_ptr_array_index (demux->essence_tracks, i); + + if (t->position > 0) + t->duration = t->position; +@@ -4197,8 +4188,7 @@ gst_mxf_demux_pull_and_handle_klv_packet (GstMXFDemux * demux) + guint i; + for (i = 0; i < demux->essence_tracks->len; i++) { + GstMXFDemuxEssenceTrack *etrack = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, +- i); ++ g_ptr_array_index (demux->essence_tracks, i); + + if (etrack->body_sid != partition->partition.body_sid) + continue; +@@ -4669,9 +4659,8 @@ gst_mxf_demux_pad_to_track_and_position (GstMXFDemux * demux, + /* Get the corresponding essence track for the given source package and stream id */ + for (i = 0; i < demux->essence_tracks->len; i++) { + GstMXFDemuxEssenceTrack *track = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, i); +- GST_LOG_OBJECT (pad, +- "Looking at essence track body_sid:%d index_sid:%d", ++ g_ptr_array_index (demux->essence_tracks, i); ++ GST_LOG_OBJECT (pad, "Looking at essence track body_sid:%d index_sid:%d", + track->body_sid, track->index_sid); + if (clip->source_track_id == 0 || (track->track_id == clip->source_track_id + && mxf_umid_is_equal (&clip->source_package_id, +@@ -4920,8 +4909,7 @@ gst_mxf_demux_seek_push (GstMXFDemux * demux, GstEvent * event) + } + + for (i = 0; i < demux->essence_tracks->len; i++) { +- GstMXFDemuxEssenceTrack *t = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, i); ++ GstMXFDemuxEssenceTrack *t = g_ptr_array_index (demux->essence_tracks, i); + t->position = -1; + } + +@@ -5359,8 +5347,7 @@ gst_mxf_demux_seek_pull (GstMXFDemux * demux, GstEvent * event) + } + + for (i = 0; i < demux->essence_tracks->len; i++) { +- GstMXFDemuxEssenceTrack *t = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, i); ++ GstMXFDemuxEssenceTrack *t = g_ptr_array_index (demux->essence_tracks, i); + t->position = -1; + } + +@@ -5659,7 +5646,7 @@ gst_mxf_demux_sink_event (GstPad * pad, GstObject * parent, GstEvent * event) + + for (i = 0; i < demux->essence_tracks->len; i++) { + GstMXFDemuxEssenceTrack *t = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, i); ++ g_ptr_array_index (demux->essence_tracks, i); + + if (t->position > 0) + t->duration = t->position; +@@ -5700,8 +5687,7 @@ gst_mxf_demux_sink_event (GstPad * pad, GstObject * parent, GstEvent * event) + + for (i = 0; i < demux->essence_tracks->len; i++) { + GstMXFDemuxEssenceTrack *etrack = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, +- i); ++ g_ptr_array_index (demux->essence_tracks, i); + etrack->position = -1; + } + ret = TRUE; +@@ -5725,8 +5711,7 @@ gst_mxf_demux_sink_event (GstPad * pad, GstObject * parent, GstEvent * event) + + for (i = 0; i < demux->essence_tracks->len; i++) { + GstMXFDemuxEssenceTrack *t = +- &g_array_index (demux->essence_tracks, GstMXFDemuxEssenceTrack, +- i); ++ g_ptr_array_index (demux->essence_tracks, i); + t->position = -1; + } + demux->current_partition = NULL; +@@ -5999,7 +5984,7 @@ gst_mxf_demux_finalize (GObject * object) + + g_ptr_array_free (demux->src, TRUE); + demux->src = NULL; +- g_array_free (demux->essence_tracks, TRUE); ++ g_ptr_array_free (demux->essence_tracks, TRUE); + demux->essence_tracks = NULL; + + g_hash_table_destroy (demux->metadata); +@@ -6076,8 +6061,8 @@ gst_mxf_demux_init (GstMXFDemux * demux) + g_rw_lock_init (&demux->metadata_lock); + + demux->src = g_ptr_array_new (); +- demux->essence_tracks = +- g_array_new (FALSE, FALSE, sizeof (GstMXFDemuxEssenceTrack)); ++ demux->essence_tracks = g_ptr_array_new_with_free_func ((GDestroyNotify) ++ gst_mxf_demux_essence_track_free); + + gst_segment_init (&demux->segment, GST_FORMAT_TIME); + +diff --git a/gst/mxf/mxfdemux.h b/gst/mxf/mxfdemux.h +index d079a1d..1dc8a4e 100644 +--- a/gst/mxf/mxfdemux.h ++++ b/gst/mxf/mxfdemux.h +@@ -266,7 +266,7 @@ struct _GstMXFDemux + GList *partitions; + GstMXFDemuxPartition *current_partition; + +- GArray *essence_tracks; ++ GPtrArray *essence_tracks; + + GList *pending_index_table_segments; + GList *index_tables; /* one per BodySID / IndexSID */ +-- +2.40.0 diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-50186.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-50186.patch new file mode 100644 index 0000000000..86bae8fcaa --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-50186.patch @@ -0,0 +1,70 @@ +From a46737a73155fe1c19fa5115df40da35426f9fb5 Mon Sep 17 00:00:00 2001 +From: Seungha Yang <seungha@centricular.com> +Date: Thu, 23 Nov 2023 20:24:42 +0900 +Subject: [PATCH] av1parser: Fix array sizes in scalability structure + +Since the AV1 specification is not explicitly mentioning about +the array size bounds, array sizes in scalability structure +should be defined as possible maximum sizes that can have. + +Also, this commit removes GST_AV1_MAX_SPATIAL_LAYERS define from +public header which is API break but the define is misleading +and this patch is introducing ABI break already + +ZDI-CAN-22300 + +Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5824> + +Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/a46737a73155fe1c19fa5115df40da35426f9fb5] +CVE: CVE-2023-50186 +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> +--- + gst-libs/gst/codecparsers/gstav1parser.h | 11 +++++------ + gst/videoparsers/gstav1parse.c | 2 +- + 2 files changed, 6 insertions(+), 7 deletions(-) + +diff --git a/gst-libs/gst/codecparsers/gstav1parser.h b/gst-libs/gst/codecparsers/gstav1parser.h +index 31f5945..ef6ce9e 100644 +--- a/gst-libs/gst/codecparsers/gstav1parser.h ++++ b/gst-libs/gst/codecparsers/gstav1parser.h +@@ -71,9 +71,8 @@ G_BEGIN_DECLS + #define GST_AV1_MAX_TILE_COUNT 512 + #define GST_AV1_MAX_OPERATING_POINTS \ + (GST_AV1_MAX_NUM_TEMPORAL_LAYERS * GST_AV1_MAX_NUM_SPATIAL_LAYERS) +-#define GST_AV1_MAX_SPATIAL_LAYERS 2 /* correct? */ +-#define GST_AV1_MAX_TEMPORAL_GROUP_SIZE 8 /* correct? */ +-#define GST_AV1_MAX_TEMPORAL_GROUP_REFERENCES 8 /* correct? */ ++#define GST_AV1_MAX_TEMPORAL_GROUP_SIZE 255 ++#define GST_AV1_MAX_TEMPORAL_GROUP_REFERENCES 7 + #define GST_AV1_MAX_NUM_Y_POINTS 16 + #define GST_AV1_MAX_NUM_CB_POINTS 16 + #define GST_AV1_MAX_NUM_CR_POINTS 16 +@@ -968,9 +967,9 @@ struct _GstAV1MetadataScalability { + gboolean spatial_layer_dimensions_present_flag; + gboolean spatial_layer_description_present_flag; + gboolean temporal_group_description_present_flag; +- guint16 spatial_layer_max_width[GST_AV1_MAX_SPATIAL_LAYERS]; +- guint16 spatial_layer_max_height[GST_AV1_MAX_SPATIAL_LAYERS]; +- guint8 spatial_layer_ref_id[GST_AV1_MAX_SPATIAL_LAYERS]; ++ guint16 spatial_layer_max_width[GST_AV1_MAX_NUM_SPATIAL_LAYERS]; ++ guint16 spatial_layer_max_height[GST_AV1_MAX_NUM_SPATIAL_LAYERS]; ++ guint8 spatial_layer_ref_id[GST_AV1_MAX_NUM_SPATIAL_LAYERS]; + guint8 temporal_group_size; + + guint8 temporal_group_temporal_id[GST_AV1_MAX_TEMPORAL_GROUP_SIZE]; +diff --git a/gst/videoparsers/gstav1parse.c b/gst/videoparsers/gstav1parse.c +index f127856..ef1bc74 100644 +--- a/gst/videoparsers/gstav1parse.c ++++ b/gst/videoparsers/gstav1parse.c +@@ -1229,7 +1229,7 @@ gst_av1_parse_handle_sequence_obu (GstAV1Parse * self, GstAV1OBU * obu) + } + + val = (self->parser->state.operating_point_idc >> 8) & 0x0f; +- for (i = 0; i < (1 << GST_AV1_MAX_SPATIAL_LAYERS); i++) { ++ for (i = 0; i < GST_AV1_MAX_NUM_SPATIAL_LAYERS; i++) { + if (val & (1 << i)) + self->highest_spatial_id = i; + } +-- +2.25.1 + diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2024-0444.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2024-0444.patch new file mode 100644 index 0000000000..6265f4293e --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2024-0444.patch @@ -0,0 +1,42 @@ +From 394d5066f8a7b728df02fe9084e955b2f7d7f6fe Mon Sep 17 00:00:00 2001 +From: Seungha Yang <seungha@centricular.com> +Date: Wed, 10 Jan 2024 03:33:59 +0900 +Subject: [PATCH] av1parser: Fix potential stack overflow during tile list + parsing + +The tile_count_minus_1 must be less than or equal to 511 as specified +in spec "6.11.1 General tile list OBU semantics" + +Fixes #3214 / CVE-2024-0444 / ZDI-CAN-22873 + +Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5971> + +CVE: CVE-2024-0444 + +Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/394d5066f8a7b728] + +Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> +--- + gst-libs/gst/codecparsers/gstav1parser.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/gst-libs/gst/codecparsers/gstav1parser.c b/gst-libs/gst/codecparsers/gstav1parser.c +index 68f8a76..bab404e 100644 +--- a/gst-libs/gst/codecparsers/gstav1parser.c ++++ b/gst-libs/gst/codecparsers/gstav1parser.c +@@ -4352,6 +4352,13 @@ gst_av1_parser_parse_tile_list_obu (GstAV1Parser * parser, + tile_list->output_frame_width_in_tiles_minus_1 = AV1_READ_BITS (br, 8); + tile_list->output_frame_height_in_tiles_minus_1 = AV1_READ_BITS (br, 8); + tile_list->tile_count_minus_1 = AV1_READ_BITS (br, 16); ++ if (tile_list->tile_count_minus_1 + 1 > GST_AV1_MAX_TILE_COUNT) { ++ GST_WARNING ("Invalid tile_count_minus_1 %d", ++ tile_list->tile_count_minus_1); ++ retval = GST_AV1_PARSER_BITSTREAM_ERROR; ++ goto error; ++ } ++ + for (tile = 0; tile <= tile_list->tile_count_minus_1; tile++) { + if (AV1_REMAINING_BITS (br) < 8 + 8 + 8 + 16) { + retval = GST_AV1_PARSER_NO_MORE_DATA; +-- +2.40.0 diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.7.bb index 80766b9166..dbe2b64c32 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.20.7.bb @@ -10,8 +10,15 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad file://0002-avoid-including-sys-poll.h-directly.patch \ file://0003-ensure-valid-sentinals-for-gst_structure_get-etc.patch \ file://0004-opencv-resolve-missing-opencv-data-dir-in-yocto-buil.patch \ + file://CVE-2023-40474.patch \ + file://CVE-2023-40475.patch \ + file://CVE-2023-40476.patch \ + file://CVE-2023-44429.patch \ + file://CVE-2024-0444.patch \ + file://CVE-2023-44446.patch \ + file://CVE-2023-50186.patch \ " -SRC_URI[sha256sum] = "f431214b0754d7037adcde93c3195106196588973e5b32dcb24938805f866363" +SRC_URI[sha256sum] = "87251beebfd1325e5118cc67774061f6e8971761ca65a9e5957919610080d195" S = "${WORKDIR}/gst-plugins-bad-${PV}" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.7.bb index c37b542c57..8dfa70aea3 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base_1.20.7.bb @@ -11,7 +11,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-ba file://0003-viv-fb-Make-sure-config.h-is-included.patch \ file://0002-ssaparse-enhance-SSA-text-lines-parsing.patch \ " -SRC_URI[sha256sum] = "11f911ef65f3095d7cf698a1ad1fc5242ac3ad6c9270465fb5c9e7f4f9c19b35" +SRC_URI[sha256sum] = "fde6696a91875095d82c1012b5777c28ba926047ffce08508e12c1d2c66f0057" S = "${WORKDIR}/gst-plugins-base-${PV}" @@ -21,7 +21,8 @@ inherit gobject-introspection # opengl packageconfig factored out to make it easy for distros # and BSP layers to choose OpenGL APIs/platforms/window systems -PACKAGECONFIG_GL ?= "${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'gles2 egl', '', d)}" +PACKAGECONFIG_X11 = "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'opengl glx', '', d)}" +PACKAGECONFIG_GL ?= "${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'gles2 egl ${PACKAGECONFIG_X11}', '', d)}" PACKAGECONFIG ??= " \ ${GSTREAMER_ORC} \ @@ -32,7 +33,7 @@ PACKAGECONFIG ??= " \ " OPENGL_APIS = 'opengl gles2' -OPENGL_PLATFORMS = 'egl' +OPENGL_PLATFORMS = 'egl glx' X11DEPENDS = "virtual/libx11 libsm libxrender libxv" X11ENABLEOPTS = "-Dx11=enabled -Dxvideo=enabled -Dxshm=enabled" @@ -61,6 +62,7 @@ PACKAGECONFIG[gles2] = ",,virtual/libgles2" # OpenGL platform packageconfigs PACKAGECONFIG[egl] = ",,virtual/egl" +PACKAGECONFIG[glx] = ",,virtual/libgl" # OpenGL window systems (except for X11) PACKAGECONFIG[gbm] = ",,virtual/libgbm libgudev libdrm" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.20.7.bb index 80aed01973..dfb0c0f342 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good_1.20.7.bb @@ -8,7 +8,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-go file://0001-qt-include-ext-qt-gstqtgl.h-instead-of-gst-gl-gstglf.patch \ " -SRC_URI[sha256sum] = "e83ab4d12ca24959489bbb0ec4fac9b90e32f741d49cda357cb554b2cb8b97f9" +SRC_URI[sha256sum] = "599f093cc833a1e346939ab6e78a3f8046855b6da13520aae80dd385434f4ab2" S = "${WORKDIR}/gst-plugins-good-${PV}" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.20.7.bb index f765e626c9..1068bb4d80 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-ugly_1.20.7.bb @@ -14,7 +14,7 @@ LICENSE_FLAGS = "commercial" SRC_URI = " \ https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${PV}.tar.xz \ " -SRC_URI[sha256sum] = "af67d8ba7cab230f64d0594352112c2c443e2aa36a87c35f9f98a43d11430b87" +SRC_URI[sha256sum] = "e761665bb3c66fb35ff3567a283b3763b494acf0fe1df8f4abeda047b22dbc55" S = "${WORKDIR}/gst-plugins-ugly-${PV}" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.20.7.bb index 05e9ace276..83445fab09 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-python_1.20.7.bb @@ -8,7 +8,7 @@ LICENSE = "LGPL-2.1-or-later" LIC_FILES_CHKSUM = "file://COPYING;md5=c34deae4e395ca07e725ab0076a5f740" SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz" -SRC_URI[sha256sum] = "27487652318659cfd7dc42784b713c78d29cc7a7df4fb397134c8c125f65e3b2" +SRC_URI[sha256sum] = "a63db0cb502308446db3d3b0a23772f1966f9f2b98fddc22fca49560a0575adc" DEPENDS = "gstreamer1.0 gstreamer1.0-plugins-base python3-pygobject" RDEPENDS:${PN} += "gstreamer1.0 gstreamer1.0-plugins-base python3-pygobject" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.20.7.bb index c9cf42903d..2901be69d2 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-rtsp-server_1.20.7.bb @@ -10,7 +10,7 @@ PNREAL = "gst-rtsp-server" SRC_URI = "https://gstreamer.freedesktop.org/src/${PNREAL}/${PNREAL}-${PV}.tar.xz" -SRC_URI[sha256sum] = "ba398a7ddd559cce56ef4b91f448d174e0dccad98a493563d2d59c41a2ef39c5" +SRC_URI[sha256sum] = "2c8f46aa9df2245e5b39a2082be8e9d3edc0f61bc34f667803d7a21da1b51987" S = "${WORKDIR}/${PNREAL}-${PV}" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.20.7.bb index 716f50ebe1..21676bddde 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-vaapi_1.20.7.bb @@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING.LIB;md5=4fbd65380cdd255951079008b364516c" SRC_URI = "https://gstreamer.freedesktop.org/src/${REALPN}/${REALPN}-${PV}.tar.xz" -SRC_URI[sha256sum] = "510c6fb4ff3f676d7946ce1800e04ccf5aabe5a586d4e164d1961808fab8c94b" +SRC_URI[sha256sum] = "40b9747408c7066a1344adae001d2d53203adda012814944a1c0a5cff3f33dd6" S = "${WORKDIR}/${REALPN}-${PV}" DEPENDS = "libva gstreamer1.0 gstreamer1.0-plugins-base gstreamer1.0-plugins-bad" diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0005-bin-Fix-race-conditions-in-tests.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0/0005-bin-Fix-race-conditions-in-tests.patch deleted file mode 100644 index f1fac2df57..0000000000 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0/0005-bin-Fix-race-conditions-in-tests.patch +++ /dev/null @@ -1,300 +0,0 @@ -From e1e2d8d58c1e09e065849cdb1f6466c0537a7c51 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com> -Date: Tue, 21 Jun 2022 11:51:35 +0300 -Subject: [PATCH] bin: Fix race conditions in tests - -The latency messages are non-deterministic and can arrive before/after -async-done or during state-changes as they are posted by e.g. sinks from -their streaming thread but bins are finishing asynchronous state changes -from a secondary helper thread. - -To solve this, expect latency messages at any time and assert that we -receive one at some point during the test. - -Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2643> - -Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2643] -Signed-off-by: Jose Quaresma <quaresma.jose@gmail.com> ---- - .../gstreamer/tests/check/gst/gstbin.c | 132 ++++++++++++------ - 1 file changed, 92 insertions(+), 40 deletions(-) - -diff --git a/subprojects/gstreamer/tests/check/gst/gstbin.c b/subprojects/gstreamer/tests/check/gst/gstbin.c -index e366d5fe20f..88ff44db0c3 100644 ---- a/subprojects/gstreamer/tests/check/gst/gstbin.c -+++ b/subprojects/gstreamer/tests/check/gst/gstbin.c -@@ -27,50 +27,95 @@ - #include <gst/base/gstbasesrc.h> - - static void --pop_async_done (GstBus * bus) -+pop_async_done (GstBus * bus, gboolean * had_latency) - { - GstMessage *message; -+ GstMessageType types = GST_MESSAGE_ASYNC_DONE; -+ -+ if (!*had_latency) -+ types |= GST_MESSAGE_LATENCY; - - GST_DEBUG ("popping async-done message"); -- message = gst_bus_poll (bus, GST_MESSAGE_ASYNC_DONE, -1); - -- fail_unless (message && GST_MESSAGE_TYPE (message) -- == GST_MESSAGE_ASYNC_DONE, "did not get GST_MESSAGE_ASYNC_DONE"); -+ do { -+ message = gst_bus_poll (bus, types, -1); - -- gst_message_unref (message); -- GST_DEBUG ("popped message"); -+ fail_unless (message); -+ GST_DEBUG ("popped message %s", -+ gst_message_type_get_name (GST_MESSAGE_TYPE (message))); -+ -+ if (GST_MESSAGE_TYPE (message) == GST_MESSAGE_LATENCY) { -+ fail_unless (*had_latency == FALSE); -+ *had_latency = TRUE; -+ gst_clear_message (&message); -+ types &= ~GST_MESSAGE_LATENCY; -+ continue; -+ } -+ -+ fail_unless (GST_MESSAGE_TYPE (message) -+ == GST_MESSAGE_ASYNC_DONE, "did not get GST_MESSAGE_ASYNC_DONE"); -+ -+ gst_clear_message (&message); -+ break; -+ } while (TRUE); - } - - static void --pop_latency (GstBus * bus) -+pop_latency (GstBus * bus, gboolean * had_latency) - { - GstMessage *message; - -- GST_DEBUG ("popping async-done message"); -+ if (*had_latency) -+ return; -+ -+ GST_DEBUG ("popping latency message"); - message = gst_bus_poll (bus, GST_MESSAGE_LATENCY, -1); - -- fail_unless (message && GST_MESSAGE_TYPE (message) -+ fail_unless (message); -+ fail_unless (GST_MESSAGE_TYPE (message) - == GST_MESSAGE_LATENCY, "did not get GST_MESSAGE_LATENCY"); - -- gst_message_unref (message); -- GST_DEBUG ("popped message"); -+ GST_DEBUG ("popped message %s", -+ gst_message_type_get_name (GST_MESSAGE_TYPE (message))); -+ gst_clear_message (&message); -+ -+ *had_latency = TRUE; - } - - static void --pop_state_changed (GstBus * bus, int count) -+pop_state_changed (GstBus * bus, int count, gboolean * had_latency) - { - GstMessage *message; -- -+ GstMessageType types = GST_MESSAGE_STATE_CHANGED; - int i; - -+ if (!*had_latency) -+ types |= GST_MESSAGE_LATENCY; -+ - GST_DEBUG ("popping %d messages", count); - for (i = 0; i < count; ++i) { -- message = gst_bus_poll (bus, GST_MESSAGE_STATE_CHANGED, -1); -- -- fail_unless (message && GST_MESSAGE_TYPE (message) -- == GST_MESSAGE_STATE_CHANGED, "did not get GST_MESSAGE_STATE_CHANGED"); -- -- gst_message_unref (message); -+ do { -+ message = gst_bus_poll (bus, types, -1); -+ -+ fail_unless (message); -+ GST_DEBUG ("popped message %s", -+ gst_message_type_get_name (GST_MESSAGE_TYPE (message))); -+ -+ if (GST_MESSAGE_TYPE (message) == GST_MESSAGE_LATENCY) { -+ fail_unless (*had_latency == FALSE); -+ *had_latency = TRUE; -+ gst_clear_message (&message); -+ types &= ~GST_MESSAGE_LATENCY; -+ continue; -+ } -+ -+ fail_unless (GST_MESSAGE_TYPE (message) -+ == GST_MESSAGE_STATE_CHANGED, -+ "did not get GST_MESSAGE_STATE_CHANGED"); -+ -+ gst_message_unref (message); -+ break; -+ } while (TRUE); - } - GST_DEBUG ("popped %d messages", count); - } -@@ -538,6 +583,7 @@ GST_START_TEST (test_message_state_changed_children) - GstBus *bus; - GstStateChangeReturn ret; - GstState current, pending; -+ gboolean had_latency = FALSE; - - pipeline = GST_PIPELINE (gst_pipeline_new (NULL)); - fail_unless (pipeline != NULL, "Could not create pipeline"); -@@ -576,7 +622,7 @@ GST_START_TEST (test_message_state_changed_children) - ASSERT_OBJECT_REFCOUNT (sink, "sink", 2); - ASSERT_OBJECT_REFCOUNT (pipeline, "pipeline", 2); - -- pop_state_changed (bus, 3); -+ pop_state_changed (bus, 3, &had_latency); - fail_if (gst_bus_have_pending (bus), "unexpected pending messages"); - - ASSERT_OBJECT_REFCOUNT (bus, "bus", 2); -@@ -619,9 +665,9 @@ GST_START_TEST (test_message_state_changed_children) - * its state_change message */ - ASSERT_OBJECT_REFCOUNT_BETWEEN (pipeline, "pipeline", 3, 4); - -- pop_state_changed (bus, 3); -- pop_async_done (bus); -- pop_latency (bus); -+ pop_state_changed (bus, 3, &had_latency); -+ pop_async_done (bus, &had_latency); -+ pop_latency (bus, &had_latency); - fail_if ((gst_bus_pop (bus)) != NULL); - - ASSERT_OBJECT_REFCOUNT_BETWEEN (bus, "bus", 2, 3); -@@ -648,7 +694,7 @@ GST_START_TEST (test_message_state_changed_children) - ASSERT_OBJECT_REFCOUNT_BETWEEN (sink, "sink", 2, 4); - ASSERT_OBJECT_REFCOUNT (pipeline, "pipeline", 3); - -- pop_state_changed (bus, 3); -+ pop_state_changed (bus, 3, &had_latency); - fail_if ((gst_bus_pop (bus)) != NULL); - - ASSERT_OBJECT_REFCOUNT (bus, "bus", 2); -@@ -669,7 +715,7 @@ GST_START_TEST (test_message_state_changed_children) - ASSERT_OBJECT_REFCOUNT_BETWEEN (sink, "sink", 3, 4); - ASSERT_OBJECT_REFCOUNT (pipeline, "pipeline", 3); - -- pop_state_changed (bus, 6); -+ pop_state_changed (bus, 6, &had_latency); - fail_if ((gst_bus_pop (bus)) != NULL); - - ASSERT_OBJECT_REFCOUNT (src, "src", 1); -@@ -696,6 +742,7 @@ GST_START_TEST (test_watch_for_state_change) - GstElement *src, *sink, *bin; - GstBus *bus; - GstStateChangeReturn ret; -+ gboolean had_latency = FALSE; - - bin = gst_element_factory_make ("bin", NULL); - fail_unless (bin != NULL, "Could not create bin"); -@@ -722,9 +769,9 @@ GST_START_TEST (test_watch_for_state_change) - GST_CLOCK_TIME_NONE); - fail_unless (ret == GST_STATE_CHANGE_SUCCESS); - -- pop_state_changed (bus, 6); -- pop_async_done (bus); -- pop_latency (bus); -+ pop_state_changed (bus, 6, &had_latency); -+ pop_async_done (bus, &had_latency); -+ pop_latency (bus, &had_latency); - - fail_unless (gst_bus_have_pending (bus) == FALSE, - "Unexpected messages on bus"); -@@ -732,16 +779,17 @@ GST_START_TEST (test_watch_for_state_change) - ret = gst_element_set_state (GST_ELEMENT (bin), GST_STATE_PLAYING); - fail_unless (ret == GST_STATE_CHANGE_SUCCESS); - -- pop_state_changed (bus, 3); -+ pop_state_changed (bus, 3, &had_latency); - -+ had_latency = FALSE; - /* this one might return either SUCCESS or ASYNC, likely SUCCESS */ - ret = gst_element_set_state (GST_ELEMENT (bin), GST_STATE_PAUSED); - gst_element_get_state (GST_ELEMENT (bin), NULL, NULL, GST_CLOCK_TIME_NONE); - -- pop_state_changed (bus, 3); -+ pop_state_changed (bus, 3, &had_latency); - if (ret == GST_STATE_CHANGE_ASYNC) { -- pop_async_done (bus); -- pop_latency (bus); -+ pop_async_done (bus, &had_latency); -+ pop_latency (bus, &had_latency); - } - - fail_unless (gst_bus_have_pending (bus) == FALSE, -@@ -898,6 +946,7 @@ GST_START_TEST (test_children_state_change_order_flagged_sink) - GstStateChangeReturn ret; - GstState current, pending; - GstBus *bus; -+ gboolean had_latency = FALSE; - - pipeline = gst_pipeline_new (NULL); - fail_unless (pipeline != NULL, "Could not create pipeline"); -@@ -951,10 +1000,11 @@ GST_START_TEST (test_children_state_change_order_flagged_sink) - ASSERT_STATE_CHANGE_MSG (bus, sink, GST_STATE_READY, GST_STATE_PAUSED, 107); - #else - -- pop_state_changed (bus, 2); /* pop remaining ready => paused messages off the bus */ -+ pop_state_changed (bus, 2, &had_latency); /* pop remaining ready => paused messages off the bus */ - ASSERT_STATE_CHANGE_MSG (bus, pipeline, GST_STATE_READY, GST_STATE_PAUSED, - 108); -- pop_async_done (bus); -+ pop_async_done (bus, &had_latency); -+ pop_latency (bus, &had_latency); - #endif - /* PAUSED => PLAYING */ - GST_DEBUG ("popping PAUSED -> PLAYING messages"); -@@ -972,8 +1022,8 @@ GST_START_TEST (test_children_state_change_order_flagged_sink) - fail_if (ret != GST_STATE_CHANGE_SUCCESS, "State change to READY failed"); - - /* TODO: do we need to check downwards state change order as well? */ -- pop_state_changed (bus, 4); /* pop playing => paused messages off the bus */ -- pop_state_changed (bus, 4); /* pop paused => ready messages off the bus */ -+ pop_state_changed (bus, 4, &had_latency); /* pop playing => paused messages off the bus */ -+ pop_state_changed (bus, 4, &had_latency); /* pop paused => ready messages off the bus */ - - while (GST_OBJECT_REFCOUNT_VALUE (pipeline) > 1) - THREAD_SWITCH (); -@@ -1002,6 +1052,7 @@ GST_START_TEST (test_children_state_change_order_semi_sink) - GstStateChangeReturn ret; - GstState current, pending; - GstBus *bus; -+ gboolean had_latency = FALSE; - - /* (2) Now again, but check other code path where we don't have - * a proper sink correctly flagged as such, but a 'semi-sink' */ -@@ -1056,10 +1107,11 @@ GST_START_TEST (test_children_state_change_order_semi_sink) - ASSERT_STATE_CHANGE_MSG (bus, src, GST_STATE_READY, GST_STATE_PAUSED, 206); - ASSERT_STATE_CHANGE_MSG (bus, sink, GST_STATE_READY, GST_STATE_PAUSED, 207); - #else -- pop_state_changed (bus, 2); /* pop remaining ready => paused messages off the bus */ -+ pop_state_changed (bus, 2, &had_latency); /* pop remaining ready => paused messages off the bus */ - ASSERT_STATE_CHANGE_MSG (bus, pipeline, GST_STATE_READY, GST_STATE_PAUSED, - 208); -- pop_async_done (bus); -+ pop_async_done (bus, &had_latency); -+ pop_latency (bus, &had_latency); - - /* PAUSED => PLAYING */ - GST_DEBUG ("popping PAUSED -> PLAYING messages"); -@@ -1076,8 +1128,8 @@ GST_START_TEST (test_children_state_change_order_semi_sink) - fail_if (ret != GST_STATE_CHANGE_SUCCESS, "State change to READY failed"); - - /* TODO: do we need to check downwards state change order as well? */ -- pop_state_changed (bus, 4); /* pop playing => paused messages off the bus */ -- pop_state_changed (bus, 4); /* pop paused => ready messages off the bus */ -+ pop_state_changed (bus, 4, &had_latency); /* pop playing => paused messages off the bus */ -+ pop_state_changed (bus, 4, &had_latency); /* pop paused => ready messages off the bus */ - - GST_DEBUG ("waiting for pipeline to reach refcount 1"); - while (GST_OBJECT_REFCOUNT_VALUE (pipeline) > 1) --- -GitLab - diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.20.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.20.7.bb index ce9c1c116f..6d002198ae 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.20.5.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.20.7.bb @@ -21,9 +21,8 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${PV}.tar.x file://0002-tests-add-support-for-install-the-tests.patch;striplevel=3 \ file://0003-tests-use-a-dictionaries-for-environment.patch;striplevel=3 \ file://0004-tests-add-helper-script-to-run-the-installed_tests.patch;striplevel=3 \ - file://0005-bin-Fix-race-conditions-in-tests.patch;striplevel=3 \ " -SRC_URI[sha256sum] = "5a19083faaf361d21fc391124f78ba6d609be55845a82fa8f658230e5fa03dff" +SRC_URI[sha256sum] = "1757184a07b9703219e8b1961f81cb1dd64320d147fc045ac8eb499efbea79be" PACKAGECONFIG ??= "${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)} \ check \ |