new file mode 100644
@@ -0,0 +1,99 @@
+From 3cdf206f4fc5a9860bfe1437ed3d01e7d23c6c3e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
+Date: Mon, 30 Sep 2024 16:22:19 +0300
+Subject: [PATCH] jpegdec: Directly error out on negotiation failures
+
+Thanks to Antonio Morales for finding and reporting the issue.
+
+Fixes GHSL-2024-247
+Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3862
+
+Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8040>
+
+CVE: CVE-2024-47599
+Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/3cdf206f4fc5a9860bfe1437ed3d01e7d23c6c3e]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ .../gst-plugins-good/ext/jpeg/gstjpegdec.c | 22 ++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/ext/jpeg/gstjpegdec.c b/ext/jpeg/gstjpegdec.c
+index 51bc2d14bf..7523419835 100644
+--- a/ext/jpeg/gstjpegdec.c
++++ b/ext/jpeg/gstjpegdec.c
+@@ -1068,13 +1068,14 @@ gst_jpeg_turbo_parse_ext_fmt_convert (GstJpegDec * dec, gint * clrspc)
+ }
+ #endif
+
+-static void
++static gboolean
+ gst_jpeg_dec_negotiate (GstJpegDec * dec, gint width, gint height, gint clrspc,
+ gboolean interlaced)
+ {
+ GstVideoCodecState *outstate;
+ GstVideoInfo *info;
+ GstVideoFormat format;
++ gboolean res;
+
+ #ifdef JCS_EXTENSIONS
+ if (dec->format_convert) {
+@@ -1104,7 +1105,7 @@ gst_jpeg_dec_negotiate (GstJpegDec * dec, gint width, gint height, gint clrspc,
+ height == GST_VIDEO_INFO_HEIGHT (info) &&
+ format == GST_VIDEO_INFO_FORMAT (info)) {
+ gst_video_codec_state_unref (outstate);
+- return;
++ return TRUE;
+ }
+ gst_video_codec_state_unref (outstate);
+ }
+@@ -1118,6 +1119,8 @@ gst_jpeg_dec_negotiate (GstJpegDec * dec, gint width, gint height, gint clrspc,
+ outstate =
+ gst_video_decoder_set_output_state (GST_VIDEO_DECODER (dec), format,
+ width, height, dec->input_state);
++ if (!outstate)
++ return FALSE;
+
+ switch (clrspc) {
+ case JCS_RGB:
+@@ -1142,10 +1145,12 @@ gst_jpeg_dec_negotiate (GstJpegDec * dec, gint width, gint height, gint clrspc,
+
+ gst_video_codec_state_unref (outstate);
+
+- gst_video_decoder_negotiate (GST_VIDEO_DECODER (dec));
++ res = gst_video_decoder_negotiate (GST_VIDEO_DECODER (dec));
+
+ GST_DEBUG_OBJECT (dec, "max_v_samp_factor=%d", dec->cinfo.max_v_samp_factor);
+ GST_DEBUG_OBJECT (dec, "max_h_samp_factor=%d", dec->cinfo.max_h_samp_factor);
++
++ return res;
+ }
+
+ static GstFlowReturn
+@@ -1425,8 +1430,9 @@ gst_jpeg_dec_handle_frame (GstVideoDecoder * bdec, GstVideoCodecFrame * frame)
+ num_fields = 1;
+ }
+
+- gst_jpeg_dec_negotiate (dec, width, output_height,
+- dec->cinfo.jpeg_color_space, num_fields == 2);
++ if (!gst_jpeg_dec_negotiate (dec, width, output_height,
++ dec->cinfo.jpeg_color_space, num_fields == 2))
++ goto negotiation_failed;
+
+ state = gst_video_decoder_get_output_state (bdec);
+ ret = gst_video_decoder_allocate_output_frame (bdec, frame);
+@@ -1558,6 +1564,12 @@ map_failed:
+ ret = GST_FLOW_ERROR;
+ goto exit;
+ }
++negotiation_failed:
++ {
++ GST_ELEMENT_ERROR (dec, CORE, NEGOTIATION, (NULL), ("failed to negotiate"));
++ ret = GST_FLOW_NOT_NEGOTIATED;
++ goto exit;
++ }
+ decode_error:
+ {
+ gchar err_msg[JMSG_LENGTH_MAX];
+--
+2.30.2
+
@@ -28,6 +28,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-go
file://0019-matroskademux-Skip-over-laces-directly-when-postproc.patch \
file://0020-matroskademux-Skip-over-zero-sized-Xiph-stream-heade.patch \
file://0021-matroskademux-Put-a-copy-of-the-codec-data-into-the-.patch \
+ file://0022-jpegdec-Directly-error-out-on-negotiation-failures.patch \
"
SRC_URI[sha256sum] = "9c1913f981900bd8867182639b20907b28ed78ef7a222cfbf2d8ba9dab992fa7"