[PATCH 1/3] h266parser: Fix overflow when parsing subpic_level_info
authorHe Junyan <junyan.he@intel.com>
Tue, 24 Jun 2025 13:40:26 +0000 (21:40 +0800)
committerMoritz Mühlenhoff <jmm@debian.org>
Sun, 21 Jun 2026 17:35:19 +0000 (19:35 +0200)
commit673d2e07a1d48eb00702db9c59fb4ddb49fe331a
treefdc0cbf55e0f1c9b257a4e6088aa99bc63870a5d
parenteb1249fe517e666109af1380f2084b8c732a7b61
[PATCH 1/3] h266parser: Fix overflow when parsing subpic_level_info

1. non_subpic_layers_fraction, ref_level_idc and ref_level_fraction_minus1
   fields should not have the GST_H266_MAX_SUBLAYERS limitation.
2. Should check max_sublayers_minus1, no more than GST_H266_MAX_SUBLAYERS-1

Fixes ZDI-CAN-27381, CVE-2025-6663

Closes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4503
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9295>

Gbp-Pq: Name 0001-h266parser-Fix-overflow-when-parsing-subpic_level_in.patch
gst-libs/gst/codecparsers/gsth266parser.c
gst-libs/gst/codecparsers/gsth266parser.h