=== release 1.28.9 ===

2026-11-06 12:54:37 +0000  Tim-Philipp Müller <tim@centricular.com>

	* gst-plugins-bad.doap:
	* meson.build:
	  Release 1.28.9

2026-11-06 10:56:54 +0000  Tim-Philipp Müller <tim@centricular.com>

	* scripts/dist-common-files.py:
	  scripts: dist-common-files: update for new release notes formatting

2026-10-29 10:42:48 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gstmpegtssection.c:
	  mpegtssection: Fix potential under-read when reading the section CRC

2026-10-29 10:38:30 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gst-dvb-section.c:
	  dvb-section: Fix transport_stream_loop_length underflow in NIT/BAT

2026-10-29 01:09:39 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gst-scte-section.c:
	  scte-section: Fix out of bounds reads in splice_info_section parsing
	  Adds missing and fixes wrong bounds checks.

2026-10-29 01:09:38 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gst-atsc-section.c:
	  atsc-section: Validate RRT and MGT lengths against the section end

2026-10-29 01:09:30 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gst-dvb-section.c:
	  dvb-section: Validate descriptor loop lengths in EIT/TOT/SIT

2026-10-29 01:09:29 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gstmpegtsdescriptor.c:
	  mpegtsdescriptor: Fix out of bounds reads when parsing descriptors
	  Various places trusted the advertised payload size without checking
	  that enough data is actually available.

2026-10-29 01:09:06 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gst-dvb-descriptor.c:
	  dvb-descriptor: Fix out of bounds reads on truncated descriptors
	  Add bounds checks for truncated DVB descriptors where the payload size was
	  previously trusted blindly.
	  Also make sure to initialize out parameters in all conditions.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/5312

2026-10-30 17:34:25 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/mpegtsmux/gstbasetsmux.c:
	  basetsmux: Clear the pts_adjustment high bit before setting it
	  The highest pts_adjustment bit is OR-ed into the copied section data
	  instead of replacing the original bit, so a section whose original
	  adjustment had that bit set kept it whenever the computed adjustment
	  had it cleared, adding a spurious 2^32 to the splice times. Replace
	  the bit instead, leaving the surrounding flags untouched.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12919>

2026-10-29 18:57:05 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/mpegtsmux/gstbasetsmux.c:
	  basetsmux: Packetize manually created SCTE sections
	  handle_scte35_section() assumed that any section that is not in the
	  running-time domain comes from tsdemux and has a serialized
	  representation, and asserted on section->data otherwise. Applications
	  are free to clear is_running_time to feed their splice times already
	  expressed in the MPEG time domain though, and manually created
	  sections from gst_mpegts_section_from_scte_sit() have no serialized
	  representation, which made the muxer abort on them.
	  Packetize such sections instead and use the result as if it came from
	  the demuxer, its splice times are in the right domain already and
	  only the PTS adjustment is missing.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12919>

2026-10-29 11:13:46 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gst-atsc-section.c:
	  atsc-section: Copy compressed data when parsing string segments
	  Let's avoid double frees.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12919>

2026-10-29 10:42:49 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gst-scte-section.c:
	  scte-section: Fix critical on early splice event parse errors
	  Don't unref NULL pointer arrays.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12919>

2026-10-30 17:02:29 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gstmpegtssection.c:
	  mpegtssection: Require long sections to be at least 12 bytes long
	  A long section consists of 3 header bytes, the 5 bytes for subtable
	  extension, version, section number and last section number, and the
	  4 byte CRC. That makes 12 bytes, which is also what the comment said,
	  while the check only required 11. Align the check and the warning
	  message with the comment.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12919>

2026-10-29 12:45:54 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gst-dvb-section.h:
	  dvb-section: Use the correct boxed GType for BAT streams
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12919>

2026-10-29 12:45:22 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gst-dvb-descriptor.c:
	  dvb-descriptor: Deep copy members of the extended event descriptor copy
	  Let's avoid double frees.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12919>

2026-10-29 11:14:10 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gst-scte-section.c:
	  scte-section: Write splice_count in serialized schedule commands
	  The splice_schedule command starts with a splice_count byte that
	  the parser consumes before reading that many splice events, but
	  _packetize_sit() never wrote it. Serializing a schedule section
	  with a number of events other than one and parsing it back
	  therefore lost or corrupted the events. Count and emit the byte
	  for the schedule command.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12919>

2026-10-29 11:13:41 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gstmpegtsdescriptor.c:
	  mpegtsdescriptor: Escape control codes as bytes in EUC-KR
	  EUC-KR is not a fixed-width encoding: iconv() emits characters as
	  either single US-ASCII bytes or two KS X 1001 bytes >= 0xA1. The
	  control code escaping ran the fixed-width 16-bit BE pass over the
	  converted text, which read one byte past the end for odd sizes and
	  never escaped an unaligned LF.
	  Handle EUC-KR separately: EN 300 468 (annex A, table A.2) requires
	  CR/LF in two byte character tables to be transmitted as the control
	  code 0xE0 0x8A, and since a LF byte cannot occur within a KS X 1001
	  double byte, replace each LF with the escape sequence while
	  widening the buffer as needed.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12919>

2026-10-29 10:42:21 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gst-atsc-section.c:
	  atsc-section: Deep copy owned members in boxed copy functions
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12919>

2026-10-29 10:42:08 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gst-atsc-section.c:
	  atsc-section: Fix MGT and RRT packetization
	  _packetize_mgt() indexed the tables array with a literal 1 instead of
	  the loop variable, dereferencing an uninitialized GPtrArray slot when
	  the table array held less than two entries, and it reserved 11 bytes
	  per table in the output buffer but only wrote 7, emitting
	  uninitialized heap memory in place of the never written
	  table_type_number_bytes field.
	  _packetize_rrt() counted the packetized size of each dimension's names
	  but serialized the top-level region names instead, overflowing the
	  output buffer whenever the region names were larger, and the
	  dimensions_defined field was counted but never written.
	  Also make the multi string helpers tolerate NULL string arrays and
	  multi strings without a segments array instead of dereferencing them:
	  there is no public constructor for the nested multi string types, so
	  applications have to build them with NULL arrays.
	  _parse_rrt() read dimensions_defined together with its 3 reserved bits
	  which are set on the wire and by the packetizer, inflating the parsed
	  count past the end of the section data; mask them out.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12919>

2026-10-29 10:37:52 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/mpegts/gst-dvb-descriptor.c:
	* gst-libs/gst/mpegts/gstmpegtsdescriptor.c:
	  mpegtsdescriptor: Validate payload sizes in descriptor creation functions
	  The internal descriptor constructors take a guint8 length while the
	  public creators take a gsize, silently truncating it before the
	  allocation but not before the payload memcpy.
	  Also initialize the size variable in gst_mpegts_descriptor_from_dvb_network_name(),
	  it was read uninitialized when encoding failed.
	  Also reject a NULL struct in gst_mpegts_descriptor_from_jpeg_xs(),
	  which dereferenced it immediately.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12919>

2026-10-18 09:23:21 -0400  Nicolas Dufresne <nicolas.dufresne@collabora.com>

	* gst-libs/gst/codecparsers/gsth265parser.c:
	  h265parser: Initialize sps_ext structure
	  The parsed data is being discarded in both cases. There is no visible side
	  effect of initializing these structure, but the path is rather complex.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13000>

2026-10-16 15:45:52 -0400  Nicolas Dufresne <nicolas.dufresne@collabora.com>

	* gst-libs/gst/codecparsers/gsth265parser.c:
	  h265parser: Fix use of uninitialized HRD parameters
	  This issue causes undefined behaviour that can be detected with specific
	  stream and valgrind. Avoid this by clearing the entire structure before
	  filling it.
	  Fixes #5332
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13000>

2026-10-29 00:27:33 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/mxf/mxfdemux.c:
	  mxfdemux: use the demuxer as logging object for a warning
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5392
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12998>

2026-10-21 20:23:40 +0200  François Laignel <francois@centricular.com>

	* gst/mxf/mxfdemux.c:
	  mxfdemux: check slice index before reading slice offset
	  The slice index in a delta entry comes from a potentially malicious source, it
	  can be out of range and can't be checked beforehand. Add bounds checks before
	  indexing into the slice offset array.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12998>

2026-10-27 12:21:24 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/mxf/mxfdemux.c:
	* gst/mxf/mxfdemux.h:
	  mxfdemux: only use delta entries of a consistent index search domain
	  The delta lookup table is a property of a single index segment, but the
	  position of a track in that table is stored on the track and used with
	  every segment of the index search domain. This only works if all segments
	  of the domain use the same delta table, which is not guaranteed for
	  malicious files.
	  Drop the delta entries of a domain as soon as one of its segments uses a
	  different table, so that tracks fall back to ignoring delta entries
	  instead of applying entries taken from an unrelated table.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12998>

2026-10-16 18:19:54 +0200  François Laignel <francois@centricular.com>

	* gst/mxf/mxfdemux.c:
	* gst/mxf/mxfdemux.h:
	  mxfdemux: fix out-of-bounds read when looking up delta entry by delta_id
	  etrack->delta_id uses negative values to encode UNKNOWN or IGNORE. All reads
	  into the segment->delta_entries array using etrack->delta_id must ensure
	  delta_id refers to an entry of the segment read from.
	  fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5352
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12998>

2026-11-05 09:47:32 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/asfmux/gstasfparse.c:
	  asfparse: Clamp object sizes to G_MAXUINT32
	  The minimum frame size API of baseparse takes a guint32.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13006>

2026-11-05 09:46:55 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/asfmux/gstasfobjects.c:
	* gst/asfmux/gstasfobjects.h:
	  asfmux: asfobjects: Reject packet sizes below the smallest possible packet
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13006>

2026-11-05 09:38:13 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/asfmux/gstasfobjects.c:
	  asfmux: asfobjects: Reject header child objects smaller than the object header
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13006>

2026-11-05 09:37:14 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/asfmux/gstrtpasfpay.c:
	  rtpasfpay: Add bounds check against the overall packet size
	  The packet size comes from the packet data.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13006>

2026-11-05 09:36:23 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/asfmux/gstrtpasfpay.c:
	  rtpasfpay: Reject packets whose padding is bigger or equal to the packet size
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13006>

2026-11-05 09:34:46 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/asfmux/gstasfmux.c:
	  asfmux: Fix header size calculation for non-BMP characters in string tags
	  The size reserved for string tag values was computed as
	  2 * (1 + g_utf8_strlen (text, -1)), which assumes every code point is
	  2 bytes in UTF-16. Characters outside the Basic Multilingual Plane are
	  encoded as surrogate pairs (4 bytes), so the header buffer was
	  under-allocated by 2 bytes per such character, and
	  gst_asf_mux_write_string_with_size() then wrote past its end.
	  Compute the size with the same g_convert() call used by the write path
	  so that both always agree.
	  Patch provided by Bruno Fournier.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/5321
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13006>

2026-11-04 18:08:28 +0100  Mathieu Duponchelle <mathieu@centricular.com>

	* gst/festival/gstfestival.c:
	  festival: cap waveform size
	  The element stores the entire waveform for a single input cue in memory
	  before outputting it. This can easily result in OOM with malicious
	  input, for instance a text cue that would cause the festival server to
	  generate one day's worth of audio samples.
	  This commit simply puts a 128 MB cap on the maximum waveform size, or
	  about one hour worth of samples. This value should be more than enough
	  for legitimate inputs.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13004>

2026-10-29 13:51:35 +0100  Mathieu Duponchelle <mathieu@centricular.com>

	* gst/festival/gstfestival.c:
	  festival: check read return value
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13004>

2026-10-22 10:00:37 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/vmnc/vmncdec.c:
	  vmnc: Use the correct stride for the output frames
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13001>

2026-10-22 10:00:20 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/vmnc/vmncdec.c:
	  vmnc: Only remember the format descriptor when decoding
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13001>

2026-10-22 00:50:27 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/vmnc/vmncdec.c:
	  vmnc: Use unaligned-safe accessors for pixel data
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13001>

2026-10-22 00:01:53 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/vmnc/vmncdec.c:
	  vmnc: Use a lower bound for WMVi screen dimensions
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13001>

2026-10-21 18:32:27 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/vmnc/vmncdec.c:
	  vmnc: Drop colour cursor on pixel format change
	  The cursor buffers are allocated with the bytes_per_pixel that were in
	  use when they were allocated, but render_colour_cursor() indexes them
	  with the current bytes_per_pixel. We have to drop the cursors until a
	  new WMVd arrives.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5308
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/13001>

2026-11-04 14:57:07 +0100  Piotr Brzeziński <piotr@centricular.com>

	* sys/androidmedia/gstamcaudiodec.c:
	* sys/androidmedia/gstamcvideodec.c:
	  androidmedia: Don't wait for input buffers after the srcpad loop stopped
	  If the loop stopped with EOS or an error while the codec's input was
	  full, handle_frame waited for an input buffer forever. It now bails out
	  and returns the last downstream result.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12996>

2026-11-04 13:36:57 +0100  Piotr Brzeziński <piotr@centricular.com>

	* sys/androidmedia/gstamcaudiodec.c:
	* sys/androidmedia/gstamcvideodec.c:
	  androidmedia: Fix drain deadlock when the srcpad loop stops
	  If the srcpad loop stopped before a drain started waiting for it,
	  draining would then get stuck. It held the upstream stream lock, so if
	  the upstream was a queue, that queue couldn't then pause for the flush
	  start, locking everything up. This simply adds a check before we start
	  waiting and returns the actual downstream push result instead of always
	  OK. Also added a missing save of the downstream ret value after a failed
	  frame allocation in the video dec.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12996>

2026-10-04 16:42:25 +0900  Daeho Ro <email@daeho.ro>

	* ext/faac/gstfaac.h:
	* ext/faac/meson.build:
	* tests/check/meson.build:
	  faac: detect libfaac via pkg-config first
	  faac has installed a faac.pc since 1.31. Use it when available and only
	  fall back to the faac.h symbol check plus cc.find_library() for older
	  releases without one. Like other plugins, skip all dependency checks
	  when the plugin is disabled.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12985>

2026-09-29 21:36:28 +0900  Daeho Ro <email@daeho.ro>

	* ext/faac/gstfaac.c:
	  faac: pass caller_size to faac_params_init() for faac >= 2.2
	  faac 2.2 bumped FAAC_VERSION_MAJOR and the library SONAME to 2 and
	  added a caller_size argument to faac_params_init(). Pass sizeof(params)
	  when FAAC_VERSION_MAJOR >= 2 and keep the one-argument call for faac
	  2.0 and 2.1.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12985>

2026-07-20 20:50:06 +0900  Daeho Ro <email@daeho.ro>

	* ext/faac/gstfaac.c:
	* ext/faac/gstfaac.h:
	* ext/faac/meson.build:
	  faac: support faac >= 2.0 (faac_* API)
	  faac 2.0 removed the legacy faacEnc* API and bumped the library SONAME
	  to 1. Detect the new API via FAAC_VERSION_MAJOR and use it when
	  available, keeping the faacEnc* path for faac 1.x.
	  With the new API the pad templates only offer the lc profile: faac 2.0
	  dropped the MAIN/SSR/LTP object types, which were never actually
	  implemented by libfaac. The AudioSpecificConfig buffer is library-owned
	  in the new API and must not be freed. The meson header check now accepts
	  either faacEncOpen (1.x) or faac_encoder_open (2.0).
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12985>

2026-11-05 09:39:22 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/asfmux/gstasfobjects.c:
	  asfmux: asfobjects: Fix gboolean / GstFlowReturn confusion
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12983>

2026-11-05 09:37:52 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst/asfmux/gstasfparse.c:
	  asfparse: Unmap buffer on parsing errors
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12983>

2026-02-02 20:57:20 +0530  Nirbheek Chauhan <nirbheek@centricular.com>

	* gst-libs/gst/vulkan/ios/gstvkwindow_ios.m:
	  vulkan/ios: Remove internal_view from the superview when closing
	  Otherwise we will leave a dangling pointer in the UIView hierarchy,
	  and any code that encounters it will crash. This allows the iOS app to
	  reuse the UIView across pipeline instances.
	  Same fix as eagl.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12975>

2026-10-22 10:29:15 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Guard against missing previous frame buffer in update requests
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-22 10:16:57 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Treat unknown server messages as a fatal error
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-22 10:10:23 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Reset the decoder state when disconnecting
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-22 10:04:07 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/gstrfbsrc.c:
	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Validate the framebuffer pixel format
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-22 00:47:43 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Avoid unaligned writes when filling rectangles
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-22 00:20:16 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Bound the framebuffer dimensions
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-22 00:05:13 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Do not decode rectangles larger than the framebuffer
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-21 21:51:40 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Handle 3 bytes per pixel formats when filling rectangles
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-21 21:48:14 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Bound the length of server provided strings
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-21 21:24:01 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Reject invalid colour shifts from the server
	  The pixel format shifts from the server are applied directly to a
	  guint32 later on; values >= 32 are undefined. Reject such handshakes
	  instead of producing a bogus video format.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-21 18:57:01 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/gstrfbsrc.c:
	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Write pixels with the stride of the output format
	  The decoder wrote rows packed at rect_width * bytespp while the
	  frames and the negotiated caps use the padded stride of the output
	  format, shifting all rows for formats like RGB with a padded stride.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-21 18:46:16 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/gstrfbsrc.c:
	  rfbsrc: Reinitialize decoder state on stop
	  With inited left set, start() skipped the reconnect and handshake and
	  fill() copied from the freed frame buffer after a state cycle.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-21 18:46:08 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/gstrfbsrc.c:
	  rfbsrc: Zero the frame buffers
	  Frame areas not covered by the server updates and the stride padding
	  of the output format were never written, leaking uninitialized heap
	  memory into the output buffers.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-21 18:45:50 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Do not read subrectangles when there are none
	  A hextile tile may legitimately contain zero subrectangles. Passing 0
	  to rfb_decoder_read() failed its length assertion and tore down the
	  connection.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-21 18:45:25 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Handle framebuffer updates with zero rectangles
	  n_rects is only tested after being decremented, so an update with no
	  rectangles would keep the state machine from ever completing the frame,
	  letting a server stall the source task indefinitely.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-21 18:45:09 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Do not use server strings without termination
	  The reason and ServerCutText strings sent by the server are not
	  NUL-terminated on the wire. Copying them with g_strndup() before
	  printing avoids out-of-bounds reads when formatting the warning and
	  GError messages, and negative lengths are now rejected.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-21 18:44:44 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst/librfb/rfbdecoder.c:
	  rfbsrc: Do not decode CopyRect when it was not negotiated
	  A malicious server can send CopyRect-encoded rectangles although the
	  encoding was never requested. The prev_frame backup buffer is only
	  allocated when the use-copyrect property is set, so decoding such a
	  rectangle reads through a NULL base pointer.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12972>

2026-10-22 10:56:04 -0700  Xavier Claessens <xclaessens@netflix.com>

	* gst/videoparsers/gsth265parse.c:
	  h265parse: Fix have_vcl_in_frame flag
	  In the packetized path, have_vcl_in_frame was being set after
	  gst_h265_parse_parse_frame() had already used it and reset it, and from
	  the previous frame's last NAL. and the first frame always got duration
	  0. The flag is now set inside the loop for each NAL, right after
	  gst_h265_parse_process_nal(), which is how h266parse already does it.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12733>

2026-04-16 12:02:01 -0400  Detlev Casanova <detlev.casanova@collabora.com>

	* tests/check/elements/h264parse.c:
	  tests: h264parse: Add test to ensure non-VCL NALs have a DTS of 0
	  Some non-VCL NALs can have invalid duration values, which could make
	  gstreamer drop future VCL NALs.
	  Make sure non-VCL always have a 0 duration.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12733>

2026-04-16 10:30:20 -0400  Detlev Casanova <detlev.casanova@collabora.com>

	* tests/check/elements/h266parse.c:
	  tests: h266parse: Add test to ensure non-VCL NALs have a DTS of 0
	  Some non-VCL NALs can have invalid duration values, which could make
	  gstreamer drop future VCL NALs.
	  Make sure non-VCL always have a 0 duration.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12733>

2026-04-16 10:28:20 -0400  Detlev Casanova <detlev.casanova@collabora.com>

	* gst/videoparsers/gsth266parse.c:
	* gst/videoparsers/gsth266parse.h:
	  h266parse: only extrapolate duration for vcl nal
	  Without this change we're extrapolating nal duration even for non-vcl nal, which
	  lead to incorrect duration, incorrect dts and incorrect pts and cause
	  frame-drop.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12733>

2026-03-24 11:18:03 -0400  Detlev Casanova <detlev.casanova@collabora.com>

	* tests/check/elements/h265parse.c:
	  tests: h265parse: Add test to ensure non-VCL NALs have a DTS of 0
	  Some non-VCL NALs can have invalid duration values, which could make
	  gstreamer drop future VCL NALs.
	  Make sure non-VCL always have a 0 duration.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12733>

2025-02-07 16:17:12 -0500  Daniel Morin <daniel.morin@collabora.com>

	* gst/videoparsers/gsth265parse.c:
	* gst/videoparsers/gsth265parse.h:
	  h265parse: only extrapolate duration for vcl nal
	  - Without this change we're extrapolating nal duration even for non-vcl nal, which
	  lead to incorrect duration, incorrect dts and incorrect pts and cause
	  frame-drop.
	  Fixes: #4099
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12733>

2026-10-30 20:03:00 +0530  Nirbheek Chauhan <nirbheek.chauhan@coram.ai>

	* gst-libs/gst/codecparsers/gsth264parser.c:
	* gst-libs/gst/codecparsers/gsth265parser.c:
	* gst-libs/gst/codecparsers/gsth266parser.c:
	* gst/videoparsers/gsth264parse.c:
	* gst/videoparsers/gsth265parse.c:
	* gst/videoparsers/gsth266parse.c:
	* tests/check/elements/h264parse.c:
	* tests/check/libs/h264parser.c:
	* tests/check/libs/h265parser.c:
	* tests/check/libs/h266parser.c:
	  codecparsers: h26x: Reject NALs with forbidden_zero_bit set
	  Reject forbidden headers in H.264, H.265 and H.266 NAL identification.
	  When splitting packetized input, skip invalid chunks while preserving
	  valid NALs before and after them.
	  Reject forbidden headers in direct H.264 subset SPS parsing as well.
	  Otherwise, camera metadata can be accepted as a parameter set and
	  corrupt the stream dimensions. Add regression coverage for these paths.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12962>

2026-11-03 07:14:05 +0100  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gsth265parser.c:
	* tests/check/libs/h265parser.c:
	  codecparsers: h265: Free SEI payload when parsing fails
	  gst_h265_parser_parse_sei_message() returns the payload parser result
	  directly, bypassing the error label that frees the message. A malformed
	  picture timing SEI that fails after the decoding unit arrays were
	  allocated leaked them: the failed message is never appended to the
	  array, so its clear function never runs.
	  Take the error path when a payload parser fails.
	  The decoding unit arrays are also allocated for a single decoding unit,
	  but the free and copy functions keyed off num_decoding_units_minus1 and
	  skipped them. Free them unconditionally, and copy them based on whether
	  the source has them.
	  oss-fuzz: 5916135967752192 (issue 580193202)
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12959>

2026-09-19 15:55:56 +0200  Mark Nauwelaerts <mnauw@users.sourceforge.net>

	* gst/mpegdemux/gstmpegdemux.c:
	  mpegdemux: increase gap thresholds
	  Fixes #5317
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12946>

2026-09-19 15:55:38 +0200  Mark Nauwelaerts <mnauw@users.sourceforge.net>

	* gst/mpegdemux/gstmpegdemux.c:
	  mpegdemux: compare to segment position for sending gap updates
	  Fixes #5317
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12946>

2026-11-01 09:54:58 +0000  Daniel Golle <daniel@makrotopia.org>

	* sys/v4l2codecs/gstv4l2codech264dec.c:
	* sys/v4l2codecs/gstv4l2codech265dec.c:
	  v4l2codecs: h264, h265: negotiate with the first picture
	  When the caps carry codec data, the sequence is parsed while decodebin
	  pushes the sticky events into the new decoder, before it exposes the
	  decoder's src pad. Negotiating right there sends the allocation query
	  to a pad nothing answers, so DMABuf caps are found without GstVideoMeta
	  and the caps event fails with not-negotiated. Record that negotiation
	  is needed and do it when the first picture starts, as the AV1 decoder
	  already does; by then the pad is exposed and linked to the sink.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12940>

2026-10-31 21:17:31 +0200  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/codecparsers/gsth266parser.c:
	* gst-libs/gst/codecparsers/gsth266parser.h:
	  h266parser: Fix out-of-bounds write when parsing DCI
	  The corresponding API is currently not called by anything in-tree.
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/5323
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12926>

2026-05-20 13:24:18 +0200  Benjamin Gaignard <benjamin.gaignard@collabora.com>

	* sys/v4l2codecs/gstv4l2codecmpeg2dec.c:
	  v4l2codecs: mpeg2: Reset pool size when discarding source pool
	  When releasing the source pool, reset pool minimum size to avoid
	  allocating too much buffers on an other session.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12922>

2026-05-20 13:23:23 +0200  Benjamin Gaignard <benjamin.gaignard@collabora.com>

	* sys/v4l2codecs/gstv4l2codecav1dec.c:
	  v4l2codecs: av1: Reset pool size when discarding source pool
	  When releasing the source pool, reset pool minimum size to avoid
	  allocating too much buffers on an other session.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12922>

2026-05-20 13:22:34 +0200  Benjamin Gaignard <benjamin.gaignard@collabora.com>

	* sys/v4l2codecs/gstv4l2codech265dec.c:
	  v4l2codecs: h265: Reset pool size when discarding source pool
	  When releasing the source pool, reset pool minimum size to avoid
	  allocating too much buffers on an other session.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12922>

2026-05-19 10:25:46 +0200  Benjamin Gaignard <benjamin.gaignard@collabora.com>

	* sys/v4l2codecs/gstv4l2codech264dec.c:
	  v4l2codecs: h264: Minimize memory allocation
	  Be smarter when allocating sink and source memory pools to reduce the
	  memory footprint. Use gst_v4l2_decoder_get_render_delay() to know the
	  need number of buffers for downstream element.
	  Reset minimum pool size when discarding the source pool to be sure that
	  an other session won't use a wrong buffer pool size.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12922>

2026-05-19 09:03:35 +0200  Benjamin Gaignard <benjamin.gaignard@collabora.com>

	* sys/v4l2codecs/gstv4l2codecvp8dec.c:
	  v4l2codecs: vp8: Minimize memory allocation
	  Be smarter when allocating sink and source memory pools to reduce the
	  memory footprint. Use gst_v4l2_decoder_get_render_delay() to know the
	  need number of buffers for downstream element.
	  Reset minimum pool size when discarding the source pool to be sure that
	  an other session doesn't use a wrong buffer pool size.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12922>

2026-05-13 16:28:00 +0200  Benjamin Gaignard <benjamin.gaignard@collabora.com>

	* sys/v4l2codecs/gstv4l2codecvp9dec.c:
	  v4l2codecs: vp9: Minimize memory allocation
	  Be smarter when allocating sink and source memory pools to reduce the
	  memory footprint. Use gst_v4l2_decoder_get_render_delay() to know the
	  need number of buffers for downstream element.
	  Reset minimum pool size when discarding the source pool to be sure
	  that an other session doesn't use a wrong buffer pool size.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12922>

2026-10-09 01:30:12 +0530  Nirbheek Chauhan <nirbheek.chauhan@coram.ai>

	* gst/videoparsers/gsth264parse.c:
	* gst/videoparsers/gsth265parse.c:
	* gst/videoparsers/gsth266parse.c:
	* tests/check/elements/h264parse.c:
	* tests/check/elements/h265parse.c:
	* tests/check/elements/h266parse.c:
	  h26*parse: Reject malformed NALs with forbidden_zero_bit set
	  Some cameras by "MULTITECH SYSTEMS, INC." append custom metadata as
	  a valid-seeming NAL unit which will pass through the depayloader, and
	  is expected to be dropped by standards-compliant parsers because the
	  forbidden_zero_bit is set instead of being unset.
	  We need to drop such NALs, or we will interpret it as a PPS causing
	  a resolution change to an absurd value like 16×16 / 16×32 / 48×32.
	  This was reproduced with an H264 RTSP stream, but the same change
	  makes sense for H265 and H266 as well.
	  (cherry picked from commit 07f8674039ebd06708b9e0dc463991d92cbd1173)
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12767>

2026-10-30 09:30:53 +0100  Edward Hervey <edward@centricular.com>

	* gst/ivfparse/gstivfparse.c:
	  ivfparse: Reject frame sizes that overflow the size check
	  frame_size is read from the stream and added to the frame header size as
	  a guint32 to check that the buffer holds the whole frame. A value close
	  to G_MAXUINT32 wraps that sum, the check passes, and the frame is then
	  copied with a size larger than the buffer, tripping a critical in
	  gst_buffer_copy_region and over-reading when checks are disabled.
	  Reject frame sizes that do not fit in the sum.
	  oss-fuzz: 6030072591745024 (issue 578103620)
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12907>

2026-10-22 16:22:25 +0200  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gsth265parser.c:
	* tests/check/libs/h265parser.c:
	  codecparsers: h265: Do not overflow conformance window size
	  The conf_win_*_offset fields are unbounded ue() values. The cropped
	  size is computed from them in 32-bit arithmetic and stored in gint
	  fields, so an oversized conformance window wraps around and a
	  negative crop rectangle width or height is accepted and handed to
	  decoders.
	  Sum the offsets in unsigned 64 bit arithmetic, which cannot wrap, and
	  reject a conformance window that does not leave a non-empty picture.
	  The h266 parser already bounds these offsets and checks the
	  conformance window, so only h265 needs the treatment already applied
	  to h264.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12899>

2026-10-21 17:22:48 +0300  Sebastian Dröge <sebastian@centricular.com>

	* gst-libs/gst/codecparsers/gsth266parser.c:
	  h266parser: Validate that rectangular slices fit into the tile grid
	  The maximum values of slice_{width,height}_in_tiles_minus1 were only checked
	  against the size of the whole tile grid and ignored the slice's start position.
	  Because of this, a slice starting at a non-zero tile column or row could extend
	  past the grid, which could cause out-of-bounds reads of the tile boundary and
	  size arrays in gst_h266_parser_generate_ctb_map().
	  Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5269
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12883>

2026-10-26 16:34:53 +0100  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gsth266parser.c:
	  codecparsers: h266: Reject VPS when multi-layer OLS count is zero
	  num_dpb_params_minus1 and num_ols_timing_hrd_params_minus1 are read with
	  an upper bound of num_multi_layer_olss - 1. When num_multi_layer_olss is
	  0 that bound underflows to G_MAXUINT, so an unbounded value is accepted
	  and then drives the dpb and ols-hrd parse loops past the end of their
	  arrays. The spec range for both elements is empty in that case, so
	  reject the VPS instead.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12874>

2026-10-24 09:34:46 +0200  Edward Hervey <edward@centricular.com>

	* gst/videoparsers/h263parse.c:
	* tests/check/elements/h263parse.c:
	  videoparsers: h263: Reject zero custom picture clock frequency code
	  The custom_pc_clock_freq code in the CPCFC is 7 bits and the value 0
	  is reserved (valid range 1..127), but the parser fed it straight to
	  gst_util_uint64_scale_int() as the denominator of the frame rate.
	  A stream carrying code 0 therefore tripped the
	  _gst_util_uint64_scale_int() assertion. Reject the header instead, as
	  for the other corrupt header fields, and let the element fall back to
	  passthrough.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12874>

2026-10-23 16:40:55 +0200  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gstav1parser.c:
	* tests/check/elements/av1parse.c:
	  codecparsers: av1: Do not left-shift a negative global motion value
	  The global motion parameters scale the decoded sub-exponential value
	  to the warp model precision by left-shifting it. The decoded value is
	  signed, and left-shifting a negative int is undefined behaviour.
	  Check the parse status before using the value, then scale it by
	  multiplication; the product fits a gint for every warp model type.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12874>

2026-10-23 15:35:10 +0200  Edward Hervey <edward@centricular.com>

	* gst/videoparsers/gsth265parse.c:
	* tests/check/elements/h265parse.c:
	  videoparsers: h265: Skip timecode meta when VUI time_scale is zero
	  The timecode SEI scales the frame count by
	  fps_n * num_units_in_tick / (fps_d * time_scale). time_scale is
	  parsed from the VUI without a range check; a zero value makes the
	  denominator zero and trips the assertion in gst_util_uint64_scale().
	  Warn and skip the timecode meta when the scale denominator is zero.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12874>

2026-10-23 15:35:09 +0200  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gstav1parser.c:
	* tests/check/elements/av1parse.c:
	  codecparsers: av1: Fail parse on frame size reference to an unfilled slot
	  A frame header can derive its size from a reference frame slot. The
	  slot only carries a meaningful size once a frame using it has been
	  parsed; a stream can reference a slot that was never filled, which
	  holds a zero frame size. The zero size propagated into the tile grid
	  computation, which divides by the width of the widest tile in
	  superblocks; with a zero-sized frame no tile width is read and that
	  divisor stays zero.
	  Fail the parse with a missing-reference error when the referenced slot
	  has no known size.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12874>

2026-10-23 14:20:40 +0200  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gsth266parser.c:
	* tests/check/elements/h266parse.c:
	  codecparsers: h266: Do not assert on SPS/PPS state in slice parsing
	  gst_h266_parser_set_active_sps_pps() asserted that the active SPS
	  has a VPS and that the SPS and PPS are valid. A crafted stream can
	  reach it with an SPS that was parsed without a VPS: the slice header
	  parse only checks that the referenced SPS and PPS exist. The assert
	  then aborts the process instead of failing the parse.
	  Turn the asserts into a parse failure; the only caller already
	  handles the error return.
	  oss-fuzz: 5808758765453312 (issue 577715859)
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12874>

2026-10-23 13:38:14 +0200  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gstav1parser.c:
	* tests/check/elements/av1parse.c:
	  codecparsers: av1: Fix integer overflow in av1_bitstreamfn_le
	  av1_bitstreamfn_le() assembles an n-byte little-endian number by
	  shifting each byte by i * 8. The bytes are promoted to int, so a
	  value whose top byte is 0x80 or greater, such as tg_size_minus_1 of
	  a tile group with explicit sizes, caused a signed left shift
	  overflow, which is undefined behaviour.
	  Cast the byte to guint before shifting.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12874>

2026-10-23 13:25:35 +0200  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gsth266parser.c:
	* tests/check/elements/h266parse.c:
	  codecparsers: h266: Replace asserts in ref_pic_lists parsing
	  gst_h266_ref_pic_lists() asserted that the SPS holds at least one
	  reference picture list for each list signalled with rpl_sps_flag,
	  and that num_long_term_pic matches the number of long term pictures
	  read from the bitstream. Crafted streams can violate both: with
	  rpl1_idx_present_flag equal to 0 the second list copies the flags
	  of the first one even when the SPS has no lists, and the long term
	  count is read independently of the entries that follow it.
	  Turn both asserts into a parse failure so that malformed streams are
	  rejected instead of aborting the process.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12874>

2026-10-26 16:38:02 +0100  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gsth266parser.c:
	* tests/check/elements/h266parse.c:
	  codecparsers: h266: Check HRD parameter parse return values
	  gst_h266_parse_sps() ignored the return value of
	  gst_h266_parse_general_timing_hrd_parameters() and
	  gst_h266_parse_ols_timing_hrd_parameters(). With a truncated HRD
	  parameter structure either call can fail partway through, leaving
	  partially filled state that parsing then continued on.
	  Propagate the failure and abort SPS parsing when either call fails.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12874>

2026-10-23 10:51:25 +0200  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gsth266parser.c:
	* tests/check/libs/h266parser.c:
	  codecparsers: h266: Fix off-by-one bound for scalable nesting layer count
	  num_layers_minus1 was allowed up to GST_H266_MAX_LAYERS (64), but the
	  layer_id array is indexed from 1 up to num_layers_minus1, so the last
	  iteration wrote one entry past the end of the array. The spec limits
	  the value to vps_max_layers_minus1 - 1 (63).
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12874>

2026-10-23 10:51:25 +0200  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gsth266parser.c:
	* tests/check/elements/h266parse.c:
	  codecparsers: h266: Bound num_tiles_in_slice_minus1 by the remaining tiles
	  The spec requires num_tiles_in_slice_minus1 to be in the range
	  0 to NumTilesInPic - SliceAddress - 1. The parser only bounded it by
	  NumTilesInPic - 1, so the loop summing the CTU counts of the slice
	  tiles could index past the PPS tile_row_height_minus1 array.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12874>

2026-10-23 10:44:29 +0200  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gstav1parser.c:
	* tests/check/elements/av1parse.c:
	  codecparsers: av1: Validate tile group extent against the tile count
	  tg_start and tg_end are read with tile_cols_log2 + tile_rows_log2 bits
	  into guint8 fields and only tg_end < tg_start was checked. A tg_end
	  beyond the tile count made the per-tile loop index past mi_row_starts,
	  reading past the parser allocation; the values are also returned to
	  callers. The spec requires tg_end to be at most num_tiles - 1.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12874>

2026-10-23 10:44:29 +0200  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gsth265parser.c:
	* tests/check/elements/h265parse.c:
	  codecparsers: h265: Reject SCC SPS with empty palette predictor range
	  When palette_max_size and delta_palette_max_predictor_size are both 0
	  the bound for sps_num_palette_predictor_initializer_minus1
	  (palette_max_size + delta_palette_max_predictor_size - 1) becomes
	  negative, which turns into G_MAXUINT32 in the unsigned comparison and
	  so accepted any value. The fill loop could then write up to 512 bytes
	  past the initializer arrays. The spec range is empty in that case, so
	  reject the SPS.
	  Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12874>

2026-10-23 07:32:51 +0200  Edward Hervey <edward@centricular.com>

	* gst-libs/gst/codecparsers/gstav1parser.c:
	* tests/check/elements/av1parse.c:
	  codecparsers: av1: Fix insufficient remaining-bits checks in sequence header
	  Several reads in gst_av1_parser_parse_sequence_header_obu() were not
	  covered by the preceding remaining-bits checks:
	  - the seq_level_idx read in the reduced_still_picture_header path
