CVE-2023-51792: check validity of conformance window parameters

Origin: https://github.com/strukturag/libde265/commit/221e767136b8c46c748ae35b79ec9b976b3da301

Imported from 1.0.11-0+deb11u4
(cherry picked from commit 221e767136b8c46c748ae35b79ec9b976b3da301)

Gbp-Pq: Name CVE-2023-51792.patch

diff --git a/libde265/image.cc b/libde265/image.cc
index 39813b04d748f3d0816b8fad3b482b52251e866a..057705ce1112fab75180c27f0ffd4fb5bb7cdb66 100644 (file)
--- a/libde265/image.cc
+++ b/libde265/image.cc
@@ -330,6 +330,14 @@ de265_error de265_image::alloc_image(int w,int h, enum de265_chroma c,
   int top    = sps ? sps->conf_win_top_offset : 0;
   int bottom = sps ? sps->conf_win_bottom_offset : 0;
 
+  if ((left+right)*WinUnitX >= width) {
+    return DE265_ERROR_CODED_PARAMETER_OUT_OF_RANGE;
+  }
+
+  if ((top+bottom)*WinUnitX >= height) {
+    return DE265_ERROR_CODED_PARAMETER_OUT_OF_RANGE;
+  }
+
   width_confwin = width - (left+right)*WinUnitX;
   height_confwin= height- (top+bottom)*WinUnitY;
   chroma_width_confwin = chroma_width -left-right;