From 59460fb5b725acdf3f22cad0db413ea643cd55b3 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Sebastian=20Dr=C3=B6ge?= Date: Mon, 3 Aug 2026 12:30:30 +0300 Subject: [PATCH] [PATCH] adpcmdec: Fail negotiation if block_align is not provided From dbc19dcbb0d16484ec77e8ba1ec590b71d286570 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Mon, 3 Aug 2026 12:30:45 +0300 Subject: [PATCH] adpcmdec: Fix IMA ADPCM input size check to match with the actual code Gbp-Pq: Name CVE-2026-19387.patch --- gst/adpcmdec/adpcmdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gst/adpcmdec/adpcmdec.c b/gst/adpcmdec/adpcmdec.c index fb25ca5a..4cc6aeed 100644 --- a/gst/adpcmdec/adpcmdec.c +++ b/gst/adpcmdec/adpcmdec.c @@ -108,7 +108,7 @@ adpcmdec_set_format (GstAudioDecoder * bdec, GstCaps * in_caps) return FALSE; if (!gst_structure_get_int (structure, "block_align", &dec->blocksize)) - dec->blocksize = -1; /* Not provided */ + return FALSE; if (!gst_structure_get_int (structure, "rate", &dec->rate)) return FALSE; @@ -280,7 +280,7 @@ adpcmdec_decode_ima_block (ADPCMDec * dec, int n_samples, const guint8 * data, int i, j; int sample; - if ((n_samples - dec->channels) % 8 != 0) { + if ((n_samples - dec->channels) % (8 * dec->channels) != 0) { GST_WARNING_OBJECT (dec, "Input not correct size"); return FALSE; } -- 2.39.5