Merge updates from debian/bookworm-security

debian/changelog

+gst-plugins-good1.0 (1.22.0-5+deb12u1) bookworm-security; urgency=medium
+
+  * GST-2023-0001
+
+ -- Moritz Mühlenhoff <jmm@debian.org>  Thu, 29 Jun 2023 20:21:18 +0200
+
 gst-plugins-good1.0 (1.22.0-5+apertis1) apertis; urgency=medium
 
   * Sync updates from Debian Bookworm. Remaining Apertis changes:

debian/patches/GST-2023-0001.patch

+--- gst-plugins-good1.0-1.22.0.orig/gst/audioparsers/gstflacparse.c
++++ gst-plugins-good1.0-1.22.0/gst/audioparsers/gstflacparse.c
+@@ -1111,6 +1111,7 @@ gst_flac_parse_handle_picture (GstFlacPa
+   GstMapInfo map;
+   guint32 img_len = 0, img_type = 0;
+   guint32 img_mimetype_len = 0, img_description_len = 0;
++  const guint8 *img_data;
+ 
+   gst_buffer_map (buffer, &map, GST_MAP_READ);
+   gst_byte_reader_init (&reader, map.data, map.size);
+@@ -1137,7 +1138,7 @@ gst_flac_parse_handle_picture (GstFlacPa
+   if (!gst_byte_reader_get_uint32_be (&reader, &img_len))
+     goto error;
+ 
+-  if (gst_byte_reader_get_pos (&reader) + img_len > map.size)
++  if (!gst_byte_reader_get_data (&reader, img_len, &img_data))
+     goto error;
+ 
+   GST_INFO_OBJECT (flacparse, "Got image of %d bytes", img_len);
+@@ -1146,8 +1147,7 @@ gst_flac_parse_handle_picture (GstFlacPa
+     if (flacparse->tags == NULL)
+       flacparse->tags = gst_tag_list_new_empty ();
+ 
+-    gst_tag_list_add_id3_image (flacparse->tags,
+-        map.data + gst_byte_reader_get_pos (&reader), img_len, img_type);
++    gst_tag_list_add_id3_image (flacparse->tags, img_data, img_len, img_type);
+   }
+ 
+   gst_buffer_unmap (buffer, &map);

debian/patches/series

 Skip-failing-tests.patch
+GST-2023-0001.patch