[PATCH 1/3] h266parser: Fix overflow when parsing subpic_level_info
authorHe Junyan <junyan.he@intel.com>
Tue, 24 Jun 2025 13:40:26 +0000 (21:40 +0800)
committerMoritz Mühlenhoff <jmm@debian.org>
Mon, 30 Mar 2026 21:57:55 +0000 (23:57 +0200)
commit42f426f96bebd8c3118abb984a474579e9e74363
treea2ad12da2789bd1c60f81cb80461a64a67408012
parentc220644fa9a6cfb4adbdd93fa4a6c8fbc3a42dfb
[PATCH 1/3] h266parser: Fix overflow when parsing subpic_level_info

1. non_subpic_layers_fraction, ref_level_idc and ref_level_fraction_minus1
   fields should not have the GST_H266_MAX_SUBLAYERS limitation.
2. Should check max_sublayers_minus1, no more than GST_H266_MAX_SUBLAYERS-1

Fixes ZDI-CAN-27381, CVE-2025-6663

Closes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4503
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9295>

Gbp-Pq: Name 0001-h266parser-Fix-overflow-when-parsing-subpic_level_in.patch
gst-libs/gst/codecparsers/gsth266parser.c
gst-libs/gst/codecparsers/gsth266parser.h