CVE-2026-45382: Heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated...

Origin: https://github.com/strukturag/libde265/commit/c33b4f63ae9056b00f34a31874fed55cd0aa29c9
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9

From c33b4f63ae9056b00f34a31874fed55cd0aa29c9 Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Sun, 10 May 2026 19:57:18 +0200
Subject: [PATCH] fix CTB OOB access when pps.sps mismatches active sps
 (GHSA-hwhx-x2mq-ccr9)

Gbp-Pq: Name CVE-2026-45382.patch

diff --git a/libde265/decctx.cc b/libde265/decctx.cc
index 0747c6908024775d3ef4b1a66493bba2db1015da..8820b1eab2e26f539bda266b388d675c055af6ec 100644 (file)
--- a/libde265/decctx.cc
+++ b/libde265/decctx.cc
@@ -1316,6 +1316,11 @@ de265_error decoder_context::decode_slice_unit_WPP(image_unit* imgunit,
     tctx->img     = img;
     tctx->imgunit = imgunit;
     tctx->sliceunit= sliceunit;
+
+    if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
+      err = DE265_WARNING_SLICEHEADER_INVALID;
+      break;
+    }
     tctx->CtbAddrInTS = pps.CtbAddrRStoTS[ctbAddrRS];
 
     init_thread_context(tctx);
@@ -1393,6 +1398,12 @@ de265_error decoder_context::decode_slice_unit_tiles(image_unit* imgunit,
 
   // first CTB in this slice
   int ctbAddrRS = shdr->slice_segment_address;
+
+  // pps.TileIdRS and pps.CtbAddrRStoTS are both sized to PicSizeInCtbsY in
+  // set_derived_values(), so one bound covers both accesses below.
+  if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
+    return DE265_WARNING_SLICEHEADER_INVALID;
+  }
   int tileID = pps.TileIdRS[ctbAddrRS];
 
   for (int entryPt=0;entryPt<nTiles;entryPt++) {
@@ -1408,6 +1419,11 @@ de265_error decoder_context::decode_slice_unit_tiles(image_unit* imgunit,
       int ctbX = pps.colBd[tileID % pps.num_tile_columns];
       int ctbY = pps.rowBd[tileID / pps.num_tile_columns];
       ctbAddrRS = ctbY * ctbsWidth + ctbX;
+
+      if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
+        err = DE265_WARNING_SLICEHEADER_INVALID;
+        break;
+      }
     }
 
     // set thread context