[PATCH 1/3] h266parser: Fix overflow when parsing subpic_level_info
authorHe Junyan <junyan.he@intel.com>
Tue, 24 Jun 2025 13:40:26 +0000 (21:40 +0800)
committerMarc Leeman <marc.leeman@gmail.com>
Thu, 10 Jul 2025 08:07:14 +0000 (10:07 +0200)
commit468039b0bcb34e647fff79337dda56234f21feb1
tree5bbedb9eb3560f98f25e9149f71f08419d025538
parent1f24e7cfda7e883e659bbeb4d330fa41f4077f62
[PATCH 1/3] h266parser: Fix overflow when parsing subpic_level_info

1. non_subpic_layers_fraction, ref_level_idc and ref_level_fraction_minus1
   fields should not have the GST_H266_MAX_SUBLAYERS limitation.
2. Should check max_sublayers_minus1, no more than GST_H266_MAX_SUBLAYERS-1

Fixes ZDI-CAN-27381, CVE-2025-6663

Closes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4503
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9295>

Gbp-Pq: Name 0001-h266parser-Fix-overflow-when-parsing-subpic_level_in.patch
gst-libs/gst/codecparsers/gsth266parser.c
gst-libs/gst/codecparsers/gsth266parser.h