Merge gst-plugins-bad1.0 (1.26.2-3+deb13u3) import into refs/heads/workingbranch

[PATCH] h266parser: Check aspect ratio index against lookup table length

Gbp-Pq: Name CVE-2026-12891.patch

[PATCH] h264parse: Check for enough slice header data being available

Gbp-Pq: Name CVE-2026-12892.patch

[PATCH] librfb: Validate framebuffer update rectangles against the framebuffer size

Gbp-Pq: Name CVE-2026-52720.patch

[PATCH] vnmdec: Avoid integer overflows when rectangle positions and sizes

Gbp-Pq: Name CVE-2026-52722.patch

[PATCH] adpcmdec: Fail negotiation if block_align is not provided

From dbc19dcbb0d16484ec77e8ba1ec590b71d286570 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Mon, 3 Aug 2026 12:30:45 +0300
Subject: [PATCH] adpcmdec: Fix IMA ADPCM input size check to match with the
 actual code

Gbp-Pq: Name CVE-2026-19387.patch

[PATCH] h266parser: Avoid out-of-bounds write when parsing PPS tile slices

Gbp-Pq: Name CVE-2026-53701.patch

[PATCH] vajpegdecoder: Validate that enough data is available for the current JPEG segment

Gbp-Pq: Name CVE-2026-52719.patch

[PATCH] av1parser: Fix bytes/bits confusion when parsing tile data size

Gbp-Pq: Name CVE-2026-52718.patch

[PATCH] dvbsuboverlay: Mark parsed byte array as const

From 7be5f191f01f3a8e114f4c6e8fb783716f51e98a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Wed, 11 Feb 2026 20:45:12 +0200
Subject: [PATCH] dvbsuboverlay: Add missing bounds checks to the parser
 everywhere

From 504f965a086ab8cf2d223a1a99d03a71b67458bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 12 Feb 2026 09:50:23 +0200
Subject: [PATCH] dvbsuboverlay: Avoid integer overflows and unreasonably large
 displays/regions

Gbp-Pq: Name CVE-2026-2923.patch

[PATCH] libs: jpegparser: boundary checks before copying it

Gbp-Pq: Name CVE-2026-3082.patch

[PATCH] h266parser: Fix APS ID bounds check in APS parsing

Gbp-Pq: Name CVE-2026-3086.patch

[PATCH] h266parser: Fix out of bounds write when parsing pic_timing SEI

Gbp-Pq: Name CVE-2026-3081.patch

[PATCH] h266parser: Validate tile index bounds in picture partition parsing

Gbp-Pq: Name CVE-2026-3084.patch

[PATCH 1/3] h266parser: Fix overflow when parsing subpic_level_info

1. non_subpic_layers_fraction, ref_level_idc and ref_level_fraction_minus1
   fields should not have the GST_H266_MAX_SUBLAYERS limitation.
2. Should check max_sublayers_minus1, no more than GST_H266_MAX_SUBLAYERS-1

Fixes ZDI-CAN-27381, CVE-2025-6663

Closes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4503
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9295>

Gbp-Pq: Name 0001-h266parser-Fix-overflow-when-parsing-subpic_level_in.patch

[PATCH] Skip failing tests

camerabin:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1244

netsim:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3000

Gbp-Pq: Name Skip-failing-tests.patch

opencv data path

Gbp-Pq: Name 02_opencv-data-path.patch

gst-plugins-bad1.0 (1.26.2-3+deb13u3) trixie-security; urgency=medium

  * CVE-2026-19387
  * CVE-2026-52722
  * CVE-2026-52720
  * CVE-2026-12892
  * CVE-2026-12891

[dgit import unpatched gst-plugins-bad1.0 1.26.2-3+deb13u3]

Import gst-plugins-bad1.0_1.26.2-3+deb13u3.debian.tar.xz

[dgit import tarball gst-plugins-bad1.0 1.26.2-3+deb13u3 gst-plugins-bad1.0_1.26.2-3+deb13u3.debian.tar.xz]

Merge gst-plugins-bad1.0 (1.26.2-3+deb13u2) import into refs/heads/workingbranch

[PATCH] h266parser: Avoid out-of-bounds write when parsing PPS tile slices

Gbp-Pq: Name CVE-2026-53701.patch

[PATCH] vajpegdecoder: Validate that enough data is available for the current JPEG segment

Gbp-Pq: Name CVE-2026-52719.patch

[PATCH] av1parser: Fix bytes/bits confusion when parsing tile data size

Gbp-Pq: Name CVE-2026-52718.patch

[PATCH] dvbsuboverlay: Mark parsed byte array as const

From 7be5f191f01f3a8e114f4c6e8fb783716f51e98a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Wed, 11 Feb 2026 20:45:12 +0200
Subject: [PATCH] dvbsuboverlay: Add missing bounds checks to the parser
 everywhere

From 504f965a086ab8cf2d223a1a99d03a71b67458bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 12 Feb 2026 09:50:23 +0200
Subject: [PATCH] dvbsuboverlay: Avoid integer overflows and unreasonably large
 displays/regions

Gbp-Pq: Name CVE-2026-2923.patch

[PATCH] libs: jpegparser: boundary checks before copying it

Gbp-Pq: Name CVE-2026-3082.patch

[PATCH] h266parser: Fix APS ID bounds check in APS parsing

Gbp-Pq: Name CVE-2026-3086.patch

[PATCH] h266parser: Fix out of bounds write when parsing pic_timing SEI

Gbp-Pq: Name CVE-2026-3081.patch

[PATCH] h266parser: Validate tile index bounds in picture partition parsing

Gbp-Pq: Name CVE-2026-3084.patch

[PATCH 1/3] h266parser: Fix overflow when parsing subpic_level_info

1. non_subpic_layers_fraction, ref_level_idc and ref_level_fraction_minus1
   fields should not have the GST_H266_MAX_SUBLAYERS limitation.
2. Should check max_sublayers_minus1, no more than GST_H266_MAX_SUBLAYERS-1

Fixes ZDI-CAN-27381, CVE-2025-6663

Closes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4503
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9295>

Gbp-Pq: Name 0001-h266parser-Fix-overflow-when-parsing-subpic_level_in.patch

[PATCH] Skip failing tests

camerabin:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1244

netsim:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3000

Gbp-Pq: Name Skip-failing-tests.patch

opencv data path

Gbp-Pq: Name 02_opencv-data-path.patch

gst-plugins-bad1.0 (1.26.2-3+deb13u2) trixie-security; urgency=medium

  * CVE-2026-52718
  * CVE-2026-52719
  * CVE-2026-53701

[dgit import unpatched gst-plugins-bad1.0 1.26.2-3+deb13u2]

Import gst-plugins-bad1.0_1.26.2-3+deb13u2.debian.tar.xz

[dgit import tarball gst-plugins-bad1.0 1.26.2-3+deb13u2 gst-plugins-bad1.0_1.26.2-3+deb13u2.debian.tar.xz]

Merge gst-plugins-bad1.0 (1.26.2-3+deb13u1) import into refs/heads/workingbranch

[PATCH] dvbsuboverlay: Mark parsed byte array as const

From 7be5f191f01f3a8e114f4c6e8fb783716f51e98a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Wed, 11 Feb 2026 20:45:12 +0200
Subject: [PATCH] dvbsuboverlay: Add missing bounds checks to the parser
 everywhere

From 504f965a086ab8cf2d223a1a99d03a71b67458bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 12 Feb 2026 09:50:23 +0200
Subject: [PATCH] dvbsuboverlay: Avoid integer overflows and unreasonably large
 displays/regions

Gbp-Pq: Name CVE-2026-2923.patch

[PATCH] libs: jpegparser: boundary checks before copying it

Gbp-Pq: Name CVE-2026-3082.patch

[PATCH] h266parser: Fix APS ID bounds check in APS parsing

Gbp-Pq: Name CVE-2026-3086.patch

[PATCH] h266parser: Fix out of bounds write when parsing pic_timing SEI

Gbp-Pq: Name CVE-2026-3081.patch

[PATCH] h266parser: Validate tile index bounds in picture partition parsing

Gbp-Pq: Name CVE-2026-3084.patch

[PATCH 1/3] h266parser: Fix overflow when parsing subpic_level_info

1. non_subpic_layers_fraction, ref_level_idc and ref_level_fraction_minus1
   fields should not have the GST_H266_MAX_SUBLAYERS limitation.
2. Should check max_sublayers_minus1, no more than GST_H266_MAX_SUBLAYERS-1

Fixes ZDI-CAN-27381, CVE-2025-6663

Closes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4503
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9295>

Gbp-Pq: Name 0001-h266parser-Fix-overflow-when-parsing-subpic_level_in.patch

[PATCH] Skip failing tests

camerabin:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1244

netsim:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3000

Gbp-Pq: Name Skip-failing-tests.patch

opencv data path

Gbp-Pq: Name 02_opencv-data-path.patch

gst-plugins-bad1.0 (1.26.2-3+deb13u1) trixie-security; urgency=medium

  * CVE-2026-2923
  * CVE-2026-3081
  * CVE-2026-3082
  * CVE-2026-3084
  * CVE-2026-3086

[dgit import unpatched gst-plugins-bad1.0 1.26.2-3+deb13u1]

Import gst-plugins-bad1.0_1.26.2-3+deb13u1.debian.tar.xz

[dgit import tarball gst-plugins-bad1.0 1.26.2-3+deb13u1 gst-plugins-bad1.0_1.26.2-3+deb13u1.debian.tar.xz]

Merge gst-plugins-bad1.0 (1.26.2-3) import into refs/heads/workingbranch

[PATCH 1/3] h266parser: Fix overflow when parsing subpic_level_info

1. non_subpic_layers_fraction, ref_level_idc and ref_level_fraction_minus1
   fields should not have the GST_H266_MAX_SUBLAYERS limitation.
2. Should check max_sublayers_minus1, no more than GST_H266_MAX_SUBLAYERS-1

Fixes ZDI-CAN-27381, CVE-2025-6663

Closes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4503
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9295>

Gbp-Pq: Name 0001-h266parser-Fix-overflow-when-parsing-subpic_level_in.patch

[PATCH] Skip failing tests

camerabin:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1244

netsim:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3000

Gbp-Pq: Name Skip-failing-tests.patch

opencv data path

Gbp-Pq: Name 02_opencv-data-path.patch

gst-plugins-bad1.0 (1.26.2-3) unstable; urgency=medium

  * d/patches: 0001-h266parser-Fix-overflow-when-parsing-subpic_level_in.patch
    - Fix CVE-2025-6663 (Closes: #1108973)
      Fix overflow when parsing subpic_level_info in H.266 parser

[dgit import unpatched gst-plugins-bad1.0 1.26.2-3]

Import gst-plugins-bad1.0_1.26.2-3.debian.tar.xz

[dgit import tarball gst-plugins-bad1.0 1.26.2-3 gst-plugins-bad1.0_1.26.2-3.debian.tar.xz]

Merge gst-plugins-bad1.0 (1.26.2-2) import into refs/heads/workingbranch

[PATCH] Skip failing tests

camerabin:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1244

netsim:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3000

Gbp-Pq: Name Skip-failing-tests.patch

opencv data path

Gbp-Pq: Name 02_opencv-data-path.patch

gst-plugins-bad1.0 (1.26.2-2) unstable; urgency=medium

  * Revert "d/rules: gstcuda missing on arm" (Closes: #1107628)

[dgit import unpatched gst-plugins-bad1.0 1.26.2-2]

Import gst-plugins-bad1.0_1.26.2-2.debian.tar.xz

[dgit import tarball gst-plugins-bad1.0 1.26.2-2 gst-plugins-bad1.0_1.26.2-2.debian.tar.xz]

Import gst-plugins-bad1.0_1.26.2.orig.tar.xz

[dgit import orig gst-plugins-bad1.0_1.26.2.orig.tar.xz]

Merge gst-plugins-bad1.0 (1.26.1-1) import into refs/heads/workingbranch

[PATCH] Skip failing tests

camerabin:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1244

netsim:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3000

Gbp-Pq: Name Skip-failing-tests.patch

opencv data path

Gbp-Pq: Name 02_opencv-data-path.patch

gst-plugins-bad1.0 (1.26.1-1) unstable; urgency=medium

  * d/copyright: add default
  * d/patches: remove 0002-test-latomic.patch
  * New upstream version 1.26.1

[dgit import unpatched gst-plugins-bad1.0 1.26.1-1]

Import gst-plugins-bad1.0_1.26.1.orig.tar.xz

[dgit import orig gst-plugins-bad1.0_1.26.1.orig.tar.xz]

Import gst-plugins-bad1.0_1.26.1-1.debian.tar.xz

[dgit import tarball gst-plugins-bad1.0 1.26.1-1 gst-plugins-bad1.0_1.26.1-1.debian.tar.xz]

Merge gst-plugins-bad1.0 (1.26.0-1) import into refs/heads/workingbranch

test-latomic

===================================================================

Gbp-Pq: Name 0002-test-latomic.patch

[PATCH] Skip failing tests

camerabin:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1244

netsim:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3000

Gbp-Pq: Name Skip-failing-tests.patch

opencv data path

Gbp-Pq: Name 02_opencv-data-path.patch

gst-plugins-bad1.0 (1.26.0-1) unstable; urgency=medium

  [ Marc Leeman ]
  * Revert "d/watch: pin on 1.24.x"
  * New upstream version 1.26.0
  * d/patches: remove 0001-fix-build-without-wayland.patch
  * d/patches: refresh Skip-failing-tests.patch
  * d/rules: cuda-nvmm not available in debian yet
  * d/rules: disable android media
  * d/rules: cevc not in debian yet
  * d/rules: nvcomp not in debian yet
  * d/rules: nvdswrapper not in debian yet
  * d/rules: svtjpegxs not in debian yet
  * d/install: install libgsttensordecoders.so
  * d/control: bump GStreamer version dependency
  * d/patches: test for latomic generic
  * d/rules: gstcuda missing on arm
  * d/patches: disable libs_vkwindow elements_vkdeviceprovider
  * Revert "d/install: remove libweebrtcdsp"
  * d/: disable webrtcdsp for hurd
  * d/control: update dependency version to 1.25.90

  [ Jeremy Bícha ]
  * Mark -good as only needed for build tests

  [ Marc Leeman ]
  * d/control: update GStreamer dependencies to >= 1.26.0

[dgit import unpatched gst-plugins-bad1.0 1.26.0-1]

Import gst-plugins-bad1.0_1.26.0.orig.tar.xz

[dgit import orig gst-plugins-bad1.0_1.26.0.orig.tar.xz]

Import gst-plugins-bad1.0_1.26.0-1.debian.tar.xz

[dgit import tarball gst-plugins-bad1.0 1.26.0-1 gst-plugins-bad1.0_1.26.0-1.debian.tar.xz]

Merge gst-plugins-bad1.0 (1.24.12-3) import into refs/heads/workingbranch

fix-build-without-wayland

commit 5cc93d5002f1f3f22738eddc28724191e28cbfb3
Author: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date:   Mon Dec 30 21:59:03 2024 +0100

    meson: Fix build with gtk3 but not wayland

Gbp-Pq: Name 0001-fix-build-without-wayland.patch

[PATCH] Skip failing tests

camerabin:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1244

netsim:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3000

Gbp-Pq: Name Skip-failing-tests.patch

opencv data path

Gbp-Pq: Name 02_opencv-data-path.patch

gst-plugins-bad1.0 (1.24.12-3) unstable; urgency=medium

  * d/: disable webrtcdsp for hurd

[dgit import unpatched gst-plugins-bad1.0 1.24.12-3]

Import gst-plugins-bad1.0_1.24.12-3.debian.tar.xz

[dgit import tarball gst-plugins-bad1.0 1.24.12-3 gst-plugins-bad1.0_1.24.12-3.debian.tar.xz]

Merge gst-plugins-bad1.0 (1.24.12-2) import into refs/heads/workingbranch

fix-build-without-wayland

commit 5cc93d5002f1f3f22738eddc28724191e28cbfb3
Author: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date:   Mon Dec 30 21:59:03 2024 +0100

    meson: Fix build with gtk3 but not wayland

Gbp-Pq: Name 0001-fix-build-without-wayland.patch

[PATCH] Skip failing tests

camerabin:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1244

netsim:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3000

Gbp-Pq: Name Skip-failing-tests.patch

opencv data path

Gbp-Pq: Name 02_opencv-data-path.patch

gst-plugins-bad1.0 (1.24.12-2) unstable; urgency=medium

  * Revert "d/install: remove libweebrtcdsp"
  * Revert "d/control: libwebrtc-audio-processing-dev removed"
  * Revert "d/rules: webrtcdsp disabled" (Closes: #1094638)

[dgit import unpatched gst-plugins-bad1.0 1.24.12-2]

Import gst-plugins-bad1.0_1.24.12-2.debian.tar.xz

[dgit import tarball gst-plugins-bad1.0 1.24.12-2 gst-plugins-bad1.0_1.24.12-2.debian.tar.xz]

Import gst-plugins-bad1.0_1.24.12.orig.tar.xz

[dgit import orig gst-plugins-bad1.0_1.24.12.orig.tar.xz]

Merge gst-plugins-bad1.0 (1.24.11-3) import into refs/heads/workingbranch

fix-build-without-wayland

commit 5cc93d5002f1f3f22738eddc28724191e28cbfb3
Author: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date:   Mon Dec 30 21:59:03 2024 +0100

    meson: Fix build with gtk3 but not wayland

Gbp-Pq: Name 0001-fix-build-without-wayland.patch

[PATCH] Skip failing tests

camerabin:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1244

netsim:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3000

Gbp-Pq: Name Skip-failing-tests.patch

opencv data path

Gbp-Pq: Name 02_opencv-data-path.patch

gst-plugins-bad1.0 (1.24.11-3) unstable; urgency=medium

  * d/rules: remove modules that break hurd-any (Closes: #1091759)
  * d/patches: fix build without wayland

[dgit import unpatched gst-plugins-bad1.0 1.24.11-3]

Import gst-plugins-bad1.0_1.24.11-3.debian.tar.xz

[dgit import tarball gst-plugins-bad1.0 1.24.11-3 gst-plugins-bad1.0_1.24.11-3.debian.tar.xz]

Import gst-plugins-bad1.0_1.24.11.orig.tar.xz

[dgit import orig gst-plugins-bad1.0_1.24.11.orig.tar.xz]

Merge gst-plugins-bad1.0 (1.24.10-2) import into refs/heads/workingbranch

[PATCH] meson: Drop max version bound from neon

Neon 0.34.0 broke the build again, but the API+ABI has been stable since
0.27 and the library is so-versioned.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8008>

Gbp-Pq: Name 0001_drop-max-version-bound-neon.patch

[PATCH] Skip failing tests

camerabin:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1244

netsim:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3000

Gbp-Pq: Name Skip-failing-tests.patch

opencv data path

Gbp-Pq: Name 02_opencv-data-path.patch

gst-plugins-bad1.0 (1.24.10-2) unstable; urgency=medium

  * d/patches: meson: Drop max version bound from neon

[dgit import unpatched gst-plugins-bad1.0 1.24.10-2]

Import gst-plugins-bad1.0_1.24.10-2.debian.tar.xz

[dgit import tarball gst-plugins-bad1.0 1.24.10-2 gst-plugins-bad1.0_1.24.10-2.debian.tar.xz]

Import gst-plugins-bad1.0_1.24.10.orig.tar.xz

[dgit import orig gst-plugins-bad1.0_1.24.10.orig.tar.xz]

Merge gst-plugins-bad1.0 (1.24.9-1) import into refs/heads/workingbranch

[PATCH] Skip failing tests

camerabin:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1244

netsim:
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3000

Gbp-Pq: Name Skip-failing-tests.patch

opencv data path

Gbp-Pq: Name 02_opencv-data-path.patch

gst-plugins-bad1.0 (1.24.9-1) unstable; urgency=medium

  * New upstream version 1.24.9

[dgit import unpatched gst-plugins-bad1.0 1.24.9-1]