Bug 2511924

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

GStreamer gst-plugins-good contains an unbounded memory growth vulnerability in the rtph264depay and rtph265depay RTP depayloaders. In gstrtph264depay.c, the FU-A/FU-B fragmentation handler (case 28/29 in gst_rtp_h264_depay_process()) accumulates incoming RTP fragment payloads into a GstAdapter via gst_adapter_push() without enforcing any maximum reassembly size. The adapter is only flushed when the E (end) bit is set in the FU header, which triggers gst_rtp_h264_finish_fragmentation_unit(). If an attacker sends a start fragment (S=1, E=0) followed by an unlimited stream of continuation fragments (S=0, E=0) with sequential RTP sequence numbers, the adapter grows without bound until process memory is exhausted. The same flaw exists in gstrtph265depay.c in the FU handler (case 49 in gst_rtp_h265_depay_process()). The GStreamer security team confirmed the vulnerability and that rtph265depay is also affected. A fix is pending in private security Merge Request 113, planned for release in GStreamer 1.28.6 or 1.28.7. Confirmed on GStreamer 1.28.2 and 1.28.5 (dynamic testing). Reported by Yehia Ali Mohamed Ezzat (yehiaezzat710). PSIRT Ticket: PSIRTSUPT-20847.