[dgit import tarball libde265 1.0.11-1+deb12u3 libde265_1.0.11-1+deb12u3.debian.tar.xz]
--- /dev/null
+# Copyright salsa-ci-team and others
+# SPDX-License-Identifier: FSFAP
+# Copying and distribution of this file, with or without modification, are
+# permitted in any medium without royalty provided the copyright notice and
+# this notice are preserved. This file is offered as-is, without any warranty.
+
+include:
+ - https://salsa.debian.org/lts-team/pipeline/raw/master/vars/base.yml
+
+variables:
+ RELEASE: 'bookworm'
+ SALSA_CI_DISABLE_LINTIAN: 1
+ SALSA_CI_DISABLE_PIUPARTS: 1
+ SALSA_CI_DISABLE_REPROTEST: 1
--- /dev/null
+libde265 (1.0.11-1+deb12u3) bookworm-security; urgency=high
+
+ * Non-maintainer upload by the LTS Team.
+ * Backport fixes for:
+ - CVE-2023-51792 - Buffer-Overflow
+ - CVE-2026-33164 - DoS (crash) (Closes: #1131469)
+ - CVE-2026-33165 - heap out-of-bounds write (Closes: #1131468)
+ - CVE-2024-38949 - Heap Buffer Overflow (Closes: #1074416)
+ - CVE-2024-38950 - Heap Buffer Overflow (same bug/patch as 2024-38949)
+ - CVE-2024-45382 - Heap Buffer Read Overflow
+ - CVE-2026-45383 - Heap Buffer Read Overflow
+ - CVE-2026-49295 - Out-of-bounds write (Closes: #1140431)
+ - CVE-2026-49337 - Unbounded memory accumulation (also #1140431)
+ - CVE-2026-49346 - Heap buffer overflow (also #1140431)
+ - CVE-2026-54240 - Heap Buffer Overflow
+ - CVE-2026-54241 - Heap Buffer Overflow
+ * Backport security fixes without CVE assigned yet:
+ - GHSA-xp3h-6f5r-8cxp - Use after free / double free
+ in concurrent execution enviornments (race conditions)
+ - GHSA-mm7m-v26f-wf8x - heap-use-after-free
+
+ -- Tobias Frost <tobi@debian.org> Sun, 20 Sep 2026 13:47:08 +0200
+
+libde265 (1.0.11-1+deb12u2) bookworm; urgency=medium
+
+ * Non-maintainer upload by the LTS Team.
+ (Closes: #1059275)
+ * CVE-2023-49465
+ heap-buffer-overflow in derive_spatial_luma_vector_prediction()
+ * CVE-2023-49467
+ heap-buffer-overflow in derive_combined_bipredictive_merging_candidates()
+ * CVE-2023-49468
+ global buffer overflow in read_coding_unit()
+
+ -- Thorsten Alteholz <debian@alteholz.de> Fri, 29 Dec 2023 23:03:02 +0100
+
+libde265 (1.0.11-1+deb12u1) bookworm; urgency=medium
+
+ * Non-maintainer upload by the LTS Team.
+ * CVE-2023-27102 (Closes: #1033257)
+ fix segmentation violation in the
+ function decoder_context::process_slice_segment_header
+ * CVE-2023-27103
+ fix heap buffer overflow in the
+ function derive_collocated_motion_vectors
+ * CVE-2023-43887
+ fix buffer over-read in pic_parameter_set::dump
+ * CVE-2023-47471 (Closes: #1056187)
+ fix buffer overflow in the slice_segment_header function
+
+ -- Thorsten Alteholz <debian@alteholz.de> Sun, 26 Nov 2023 13:03:02 +0100
+
+libde265 (1.0.11-1) unstable; urgency=medium
+
+ [ Tobias Frost ]
+ * Make my patch less noisy.
+
+ [ Joachim Bauch ]
+ * New upstream version 1.0.11
+ * Unpackaged upstream version 1.0.10 fixes the following CVEs, most caused
+ by the same underlying issue:
+ CVE-2020-21594, CVE-2020-21595, CVE-2020-21596, CVE-2020-21597,
+ CVE-2020-21598, CVE-2020-21599, CVE-2020-21600, CVE-2020-21601,
+ CVE-2020-21602, CVE-2020-21603, CVE-2020-21604, CVE-2020-21605,
+ CVE-2020-21606, CVE-2022-1253, CVE-2022-43236, CVE-2022-43237,
+ CVE-2022-43238, CVE-2022-43239, CVE-2022-43240, CVE-2022-43241,
+ CVE-2022-43242, CVE-2022-43243, CVE-2022-43244, CVE-2022-43245,
+ CVE-2022-43248, CVE-2022-43249, CVE-2022-43250, CVE-2022-43252,
+ CVE-2022-43253, CVE-2022-47655
+ * Remove patch applied upstream.
+ * Update patches for new upstream version.
+ * Remove copyright entry for file no longer present in upstream.
+ * Update symbols for new upstream version.
+ * Bump "Standards-Version" to 4.6.2
+
+ -- Joachim Bauch <bauch@struktur.de> Thu, 02 Feb 2023 16:06:20 +0100
+
+libde265 (1.0.9-1.1) unstable; urgency=medium
+
+ * Non-maintainer upload.
+ * Apply patches to mitigate asan failures:
+ reject_reference_pics_from_different_sps.patch and
+ use_sps_from_the_image.patch.
+ * Combined, this two patches fixes:
+ - CVE-2022-43243, CVE-2022-43248, CVE-2022-43253 (Closes: #1025816)
+ - CVE-2022-43235, CVE-2022-43236, CVE-2022-43237, CVE-2022-43238,
+ CVE-2022-43239, CVE-2022-43240, CVE-2022-43241, CVE-2022-43242,
+ CVE-2022-43244, CVE-2022-43250, CVE-2022-43252 (Closes: #1027179)
+ - CVE-2022-47655
+ * Additional patch recycle_sps_if_possible.patch to avoid over-rejecting
+ valid video streams due to reject_reference_pics_from_different_sps.patch.
+ * Modifying past changelog entries to indicate when vulnerabilities were
+ fixed:
+ - In 1.0.9-1, in total 11 CVE's. see #1004963 and #1014999
+ - In 1.0.3-1, 1 CVE, see #1029396
+ * drop unused Build-Depends: libjpeg-dev, libpng-dev and libxv-dev
+ (Closes: #981260)
+
+ -- Tobias Frost <tobi@debian.org> Sun, 22 Jan 2023 13:19:20 +0100
+
+libde265 (1.0.9-1) unstable; urgency=medium
+
+ * Add "Rules-Requires-Root: no".
+ * New upstream version 1.0.9.
+ Bisecting shows that this version fixed this CVES:
+ - CVE-2020-21598, CVE-2020-21600, CVE-2020-21602 (Closes: #1004963)
+ - CVE-2020-21595, CVE-2020-21597, CVE-2020-21599, CVE-2020-21601,
+ CVE-2020-21603, CVE-2020-21604, CVE-2020-21605, CVE-2020-21606
+ (Closes: #1014999)
+ * Remove patches now part of upstream release.
+ * Bump "Standards-Version" to 4.6.1
+ * Add patch to provide "gl_VISIBILITY" macro.
+ * Update symbols for new upstream version.
+
+ -- Joachim Bauch <bauch@struktur.de> Tue, 25 Oct 2022 10:15:37 +0200
+
+libde265 (1.0.8-1.1) unstable; urgency=medium
+
+ * Non-maintainer upload.
+ * Import upstream fixes for CVE-tracked vulnerabilities
+ (Closes: #1014977)
+ - CVE-2022-1253
+ - CVE-2021-36411
+ - CVE-2021-36410
+ - CVE-2021-36409
+ - CVE-2021-36408
+ - CVE-2021-35452
+
+ -- Philipp Kern <pkern@debian.org> Sun, 16 Oct 2022 15:26:20 +0200
+
+libde265 (1.0.8-1) unstable; urgency=medium
+
+ * Update to debhelper compat level 13 and add debian/not-installed
+ * Imported Upstream version 1.0.8
+ * Remove patch applied upstream.
+ * Bump "Standards-Version" to 4.5.1
+
+ -- Joachim Bauch <bauch@struktur.de> Wed, 16 Dec 2020 16:32:29 +0100
+
+libde265 (1.0.7-1) unstable; urgency=medium
+
+ [ Debian Janitor ]
+ * Set upstream metadata fields: Bug-Submit.
+
+ [ Joachim Bauch ]
+ * Imported Upstream version 1.0.7
+ * Update patches for new upstream version.
+ * Update symbols for new upstream version.
+ * Bump "Standards-Version" to 4.5.0
+
+ -- Joachim Bauch <bauch@struktur.de> Fri, 25 Sep 2020 13:00:59 +0200
+
+libde265 (1.0.4-1) unstable; urgency=medium
+
+ [ Ondřej Nový ]
+ * Use debhelper-compat instead of debian/compat
+
+ [ Joachim Bauch ]
+ * Imported Upstream version 1.0.4
+ * Enable hardening.
+ * Specify Build-Depends-Package in symbols.
+ * Ignore more internal STL symbols.
+ * Bump "Standards-Version" to 4.4.1
+ * Update to debhelper compat level 12.
+
+ [ Debian Janitor ]
+ * Set upstream metadata fields: Bug-Database, Repository, Repository-
+ Browse.
+
+ [ Sebastian Ramacher ]
+ * debian/rules: Remove obsolete dh_strip override
+
+ -- Joachim Bauch <bauch@struktur.de> Fri, 20 Dec 2019 12:17:15 +0100
+
+libde265 (1.0.3-1) unstable; urgency=medium
+
+ [ Ondřej Nový ]
+ * d/copyright: Use https protocol in Format field
+ * d/control: Set Vcs-* to salsa.debian.org
+
+ [ Felipe Sateler ]
+ * Change maintainer address to debian-multimedia@lists.debian.org
+
+ [ Joachim Bauch ]
+ * Imported Upstream version 1.0.3
+ This version fixes CVE-2020-21594. (Closes: #1029396)
+ * Update patches for new upstream version.
+ * Update symbols for new upstream version.
+ * Update standards version and switch to debhelper 10.
+
+ -- Joachim Bauch <bauch@struktur.de> Thu, 19 Apr 2018 11:44:40 +0200
+
+libde265 (1.0.2-2) unstable; urgency=low
+
+ [ Joachim Bauch ]
+ * Added patch by Andreas Cadhalpun to fix compilation with FFmpeg 2.9
+ (Closes: #803834)
+ * Updated symbols file for new C++11 symbols.
+
+ [ Sebastian Ramacher ]
+ * Migrate to automatic dbg packages.
+ * debian/control: Remove some unnecessary Build-Depends.
+
+ -- Joachim Bauch <bauch@struktur.de> Mon, 11 Jan 2016 19:12:19 +0100
+
+libde265 (1.0.2-1) unstable; urgency=low
+
+ * Imported Upstream version 1.0.2
+ * Added new files to copyright information.
+ * Only export decoder API and update symbols for new version.
+
+ -- Joachim Bauch <bauch@struktur.de> Thu, 16 Jul 2015 11:07:46 +0200
+
+libde265 (0.9-1) unstable; urgency=low
+
+ * Updated symbols to make all "std::vector" symbols optional.
+ * Imported Upstream version 0.9
+ * Removed deprecated patch to update symbols visibility. Changes were
+ applied upstream.
+ * Upstream supports compiling against Qt5, prefer that over Qt4.
+ * Added new symbols from new upstream release.
+
+ -- Joachim Bauch <bauch@struktur.de> Tue, 16 Sep 2014 18:47:14 +0200
+
+libde265 (0.8-1) unstable; urgency=low
+
+ * Initial release. (Closes: #744190)
+
+ -- Joachim Bauch <bauch@struktur.de> Fri, 08 Aug 2014 17:23:37 +0200
--- /dev/null
+INSTALL
+Makefile.in
+acceleration-speed/Makefile.in
+aclocal.m4
+compile
+config.guess
+config.h.in
+config.sub
+configure
+dec265/Makefile.in
+depcomp
+enc265/Makefile.in
+install-sh
+libde265/Makefile.in
+libde265/arm/Makefile.in
+libde265/encoder/Makefile.in
+libde265/encoder/algo/Makefile.in
+libde265/x86/Makefile.in
+ltmain.sh
+m4/libtool.m4
+m4/ltoptions.m4
+m4/ltsugar.m4
+m4/ltversion.m4
+m4/lt~obsolete.m4
+missing
+sherlock265/Makefile.in
+tools/Makefile.in
+acceleration-speed/.deps/
+acceleration-speed/Makefile
+enc265/.deps/
+enc265/Makefile
+tools/.deps/
+tools/Makefile
--- /dev/null
+Source: libde265
+Section: libs
+Priority: optional
+Maintainer: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
+Uploaders:
+ Alessio Treglia <alessio@debian.org>,
+ Joachim Bauch <bauch@struktur.de>
+Build-Depends:
+ debhelper-compat (= 13),
+ qtbase5-dev | libqt4-dev,
+ libsdl-dev,
+ libswscale-dev,
+ libx11-dev,
+ libxext-dev,
+ pkg-config
+Rules-Requires-Root: no
+Standards-Version: 4.6.2
+Homepage: https://github.com/strukturag/libde265
+Vcs-Git: https://salsa.debian.org/multimedia-team/libde265.git
+Vcs-Browser: https://salsa.debian.org/multimedia-team/libde265
+
+Package: libde265-0
+Architecture: any
+Multi-Arch: same
+Depends:
+ ${misc:Depends},
+ ${shlibs:Depends}
+Description: Open H.265 video codec implementation
+ libde265 is an open source implementation of the H.265 video codec.
+ It is written from scratch in plain C for simplicity and efficiency.
+ Its simple API makes it easy to integrate it into other software.
+
+Package: libde265-dev
+Section: libdevel
+Multi-Arch: same
+Architecture: any
+Depends:
+ libde265-0 (= ${binary:Version}),
+ ${misc:Depends}
+Description: Open H.265 video codec implementation - development files
+ libde265 is an open source implementation of the H.265 video codec.
+ It is written from scratch in plain C for simplicity and efficiency.
+ Its simple API makes it easy to integrate it into other software.
+ .
+ The development headers for compiling programs that use libde265
+ are provided by this package.
+
+Package: libde265-examples
+Section: video
+Architecture: any
+Depends:
+ libde265-0 (= ${binary:Version}),
+ ${misc:Depends},
+ ${shlibs:Depends}
+Description: Open H.265 video codec implementation - examples
+ libde265 is an open source implementation of the H.265 video codec.
+ It is written from scratch in plain C for simplicity and efficiency.
+ Its simple API makes it easy to integrate it into other software.
+ .
+ Sample applications using libde265 are provided by this package.
--- /dev/null
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: libde265
+Upstream-Contact: struktur AG <opensource@struktur.de>
+Source: https://github.com/strukturag/libde265
+
+Files: *
+Copyright:
+ 2013-2014 struktur AG, Dirk Farin <farin@struktur.de>
+ 2013 openHEVC contributors
+License: LGPL-3+
+
+Files: dec265/dec265.cc
+ dec265/hdrcopy.cc
+ dec265/sdl.cc
+ dec265/sdl.hh
+ enc265/enc265.cc
+ sherlock265/VideoDecoder.cc
+ sherlock265/VideoDecoder.hh
+ sherlock265/VideoPlayer.cc
+ sherlock265/VideoPlayer.hh
+ sherlock265/VideoWidget.cc
+ sherlock265/VideoWidget.hh
+ sherlock265/sherlock265.cc
+ tools/bjoentegaard.cc
+ tools/block-rate-estim.cc
+ tools/gen-entropy-table.cc
+ tools/rd-curves.cc
+ tools/tests.cc
+ tools/yuv-distortion.cc
+Copyright:
+ 2013-2014 struktur AG, Dirk Farin <farin@struktur.de>
+ 2013-2014 struktur AG, Joachim Bauch <bauch@struktur.de>
+ 1998-2013 Free Software Foundation, Inc
+License: GPL-3+
+Comment: Please note that only the sample applications are GPL-3+ while
+ the decoding library itself is licensed as LGPL-3+.
+
+Files: extra/getopt.c
+ extra/getopt.h
+ extra/getopt_long.c
+Copyright: 1987-1996 The Regents of the University of California
+License: BSD-4-clause
+
+Files: libde265/md5.cc
+ libde265/md5.h
+Copyright: No copyright holder
+License: public-domain-1
+ This software was written by Alexander Peslyak in 2001. No copyright is
+ claimed, and the software is hereby placed in the public domain.
+ In case this attempt to disclaim copyright and place the software in the
+ public domain is deemed null and void, then the software is
+ Copyright (c) 2001 Alexander Peslyak and it is hereby released to the
+ general public under the following terms:
+ .
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted.
+ .
+ There's ABSOLUTELY NO WARRANTY, express or implied.
+ .
+ (This is a heavily cut-down "BSD license".)
+ .
+ This differs from Colin Plumb's older public domain implementation in that
+ no exactly 32-bit integer data type is required (any 32-bit or wider
+ unsigned integer data type will do), there's no compile-time endianness
+ configuration, and the function prototypes match OpenSSL's. No code from
+ Colin Plumb's implementation has been reused; this comment merely compares
+ the properties of the two independent implementations.
+ .
+ The primary goals of this implementation are portability and ease of use.
+ It is meant to be fast, but not as fast as possible. Some known
+ optimizations are not included to reduce source code size and avoid
+ compile-time configuration.
+
+Files: extra/win32cond.c
+ extra/win32cond.h
+Copyright:
+ 1993-2009 Douglas C. Schmidt and his research group at
+ Washington University, University of California, Irvine, and
+ Vanderbilt University
+License: other-1
+ ACE(TM), TAO(TM), CIAO(TM), DAnCE>(TM), and CoSMIC(TM) (henceforth
+ referred to as "DOC software") are copyrighted by Douglas C. Schmidt
+ and his research group at Washington University, University of California,
+ Irvine, and Vanderbilt University, Copyright (c) 1993-2009, all rights
+ reserved.
+ .
+ Since DOC software is open-source, freely available software, you are free
+ to use, modify, copy, and distribute--perpetually and irrevocably--the DOC
+ software source code and object code produced from the source, as well as
+ copy and distribute modified versions of this software. You must, however,
+ include this copyright statement along with any code built using DOC
+ software that you release.
+ .
+ No copyright statement needs to be provided if you just ship binary
+ executables of your software products.
+ .
+ See "Strategies for Implementing POSIX Condition Variables on Win32" at
+ http://www.cs.wustl.edu/~schmidt/win32-cv-1.html
+
+Files: debian/*
+Copyright:
+ 2014-2023 Joachim Bauch <jojo@struktur.de>
+ 2014 Alessio Treglia <alessio@debian.org>
+License: LGPL-3+
+
+License: GPL-3+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+ .
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+ .
+ On Debian systems the complete text of the GNU General Public License
+ can be found in the `/usr/share/common-licenses/GPL-3' file.
+ .
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+License: LGPL-3+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+ .
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+ .
+ On Debian systems the complete text of the GNU Lesser General Public
+ License can be found in the `/usr/share/common-licenses/LGPL-3' file.
+ .
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+License: BSD-4-clause
+ Copyright (c) 1987, 1993, 1994
+ The Regents of the University of California. All rights reserved.
+ .
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+ 1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+ 3. All advertising materials mentioning features or use of this software
+ must display the following acknowledgement:
+ This product includes software developed by the University of
+ California, Berkeley and its contributors.
+ 4. Neither the name of the University nor the names of its contributors
+ may be used to endorse or promote products derived from this software
+ without specific prior written permission.
+ .
+ THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ SUCH DAMAGE.
--- /dev/null
+[DEFAULT]
+debian-branch = debian/bookworm
+pristine-tar = True
--- /dev/null
+usr/lib/*/*.so.*
--- /dev/null
+libde265.so.0 libde265-0 #MINVER#
+* Build-Depends-Package: libde265-dev
+ (optional|c++|regex)"^std::_Sp_counted_base<.*@Base$" 1.0.2
+ (optional|c++|regex)"^std::_Sp_counted_ptr<.*@Base$" 1.0.3
+ (optional|c++|regex)"^std::_Sp_make_shared_tag.*@Base$" 1.0.4
+ (optional|c++|regex)"^std::_Vector_base<.*@Base$" 1.0.7
+ (optional|c++|regex)"^std::__cxx11::basic_string<.*@Base$" 1.0.9
+ (optional|c++|regex)"^std::__cxx11::basic_stringbuf<.*@Base$" 1.0.2
+ (optional|c++|regex)"^std::vector<.*@Base$" 1.0.2
+ (optional|c++|regex)"^typeinfo for std::.*@Base$" 1.0.2
+ (optional|c++|regex)"^typeinfo name for std::.*@Base$" 1.0.2
+ (optional|c++|regex)"^void std::vector<.*@Base$" 1.0.2
+ (optional=only used internally by dec265|c++)"MSE(unsigned char const*, int, unsigned char const*, int, int, int)@Base" 1.0.2
+ (optional=only used internally by dec265|c++)"PSNR(double)@Base" 1.0.2
+ (optional=only used by the non-final encoder api)de265_alloc_image_plane@Base 1.0.2
+ de265_change_framerate@Base 0.8
+ de265_decode@Base 0.8
+ de265_decode_data@Base 0.8
+ de265_disable_logging@Base 0.8
+ de265_flush_data@Base 0.8
+ de265_free@Base 0.8
+ de265_free_decoder@Base 0.8
+ (optional=only used by the non-final encoder api)de265_free_image_plane@Base 1.0.2
+ de265_get_bits_per_pixel@Base 1.0.2
+ de265_get_chroma_format@Base 0.8
+ de265_get_current_TID@Base 0.8
+ de265_get_default_image_allocation_functions@Base 0.8
+ de265_get_error_text@Base 0.8
+ de265_get_highest_TID@Base 0.8
+ de265_get_image_NAL_header@Base 0.8
+ de265_get_image_PTS@Base 0.8
+ de265_get_image_colour_primaries@Base 1.0.7
+ de265_get_image_full_range_flag@Base 1.0.7
+ de265_get_image_height@Base 0.8
+ de265_get_image_matrix_coefficients@Base 1.0.7
+ de265_get_image_plane@Base 0.8
+ de265_get_image_plane_user_data@Base 0.8
+ de265_get_image_transfer_characteristics@Base 1.0.7
+ de265_get_image_user_data@Base 0.8
+ de265_get_image_width@Base 0.8
+ de265_get_next_picture@Base 0.8
+ de265_get_number_of_NAL_units_pending@Base 0.8
+ de265_get_number_of_input_bytes_pending@Base 0.8
+ de265_get_parameter_bool@Base 0.8
+ de265_get_version@Base 0.8
+ de265_get_version_number@Base 0.8
+ de265_get_version_number_maintenance@Base 1.0.2
+ de265_get_version_number_major@Base 1.0.2
+ de265_get_version_number_minor@Base 1.0.2
+ de265_get_warning@Base 0.8
+ de265_init@Base 0.8
+ de265_isOK@Base 0.8
+ de265_new_decoder@Base 0.8
+ de265_peek_next_picture@Base 0.8
+ de265_push_NAL@Base 0.8
+ de265_push_data@Base 0.8
+ de265_push_end_of_NAL@Base 0.8
+ de265_push_end_of_frame@Base 0.9
+ de265_release_next_picture@Base 0.8
+ de265_reset@Base 0.8
+ de265_set_framerate_ratio@Base 0.8
+ de265_set_image_allocation_functions@Base 0.8
+ de265_set_image_plane@Base 0.8
+ de265_set_image_user_data@Base 0.9
+ de265_set_limit_TID@Base 0.8
+ de265_set_parameter_bool@Base 0.8
+ de265_set_parameter_int@Base 0.8
+ de265_set_verbosity@Base 0.8
+ de265_start_worker_threads@Base 0.8
+ (optional=only used internally by sherlock265)draw_CB_grid@Base 0.8
+ (optional=only used internally by sherlock265)draw_Motion@Base 0.8
+ (optional=only used internally by sherlock265)draw_PB_grid@Base 0.8
+ (optional=only used internally by sherlock265)draw_PB_pred_modes@Base 0.8
+ (optional=only used internally by sherlock265)draw_QuantPY@Base 0.8
+ (optional=only used internally by sherlock265)draw_Slices@Base 0.8
+ (optional=only used internally by sherlock265)draw_TB_grid@Base 0.8
+ (optional=only used internally by sherlock265)draw_Tiles@Base 0.8
+ (optional=only used internally by sherlock265)draw_intra_pred_modes@Base 0.8
--- /dev/null
+usr/include/*
+usr/lib/*/*.so
+usr/lib/*/pkgconfig/*
--- /dev/null
+usr/lib/*/libde265.a
+usr/lib/*/libde265.la
--- /dev/null
+commit 0b1752abff97cb542941d317a0d18aa50cb199b1
+Author: Dirk Farin <dirk.farin@gmail.com>
+Date: Sat Mar 4 10:32:43 2023 +0100
+
+ check whether referenced PPS exists (fixes #393)
+
+Index: libde265-1.0.11/libde265/decctx.cc
+===================================================================
+--- libde265-1.0.11.orig/libde265/decctx.cc 2023-11-19 19:08:18.703219858 +0100
++++ libde265-1.0.11/libde265/decctx.cc 2023-11-19 19:08:18.703219858 +0100
+@@ -2276,9 +2276,10 @@
+ // get PPS and SPS for this slice
+
+ int pps_id = hdr->slice_pic_parameter_set_id;
+- if (pps[pps_id]->pps_read==false) {
++ if (pps[pps_id]==nullptr || pps[pps_id]->pps_read==false) {
+ logerror(LogHeaders, "PPS %d has not been read\n", pps_id);
+- assert(false); // TODO
++ img->decctx->add_warning(DE265_WARNING_NONEXISTING_PPS_REFERENCED, false);
++ return false;
+ }
+
+ current_pps = pps[pps_id];
--- /dev/null
+commit d6bf73e765b7a23627bfd7a8645c143fd9097995
+Author: Dirk Farin <dirk.farin@gmail.com>
+Date: Sat Mar 4 10:27:59 2023 +0100
+
+ check for valid slice header index access (fixes #394)
+
+Index: libde265-1.0.11/libde265/de265.cc
+===================================================================
+--- libde265-1.0.11.orig/libde265/de265.cc 2023-11-19 19:08:22.851224558 +0100
++++ libde265-1.0.11/libde265/de265.cc 2023-11-19 19:08:22.847224554 +0100
+@@ -174,6 +174,8 @@
+ return "Bit-depth of current image does not match SPS";
+ case DE265_WARNING_REFERENCE_IMAGE_CHROMA_FORMAT_DOES_NOT_MATCH:
+ return "Chroma format of reference image does not match current image";
++ case DE265_WARNING_INVALID_SLICE_HEADER_INDEX_ACCESS:
++ return "Access with invalid slice header index";
+
+ default: return "unknown error";
+ }
+Index: libde265-1.0.11/libde265/de265.h
+===================================================================
+--- libde265-1.0.11.orig/libde265/de265.h 2023-11-19 19:08:22.851224558 +0100
++++ libde265-1.0.11/libde265/de265.h 2023-11-19 19:08:22.847224554 +0100
+@@ -145,7 +145,8 @@
+ DE265_WARNING_REFERENCE_IMAGE_SIZE_DOES_NOT_MATCH_SPS=1029,
+ DE265_WARNING_CHROMA_OF_CURRENT_IMAGE_DOES_NOT_MATCH_SPS=1030,
+ DE265_WARNING_BIT_DEPTH_OF_CURRENT_IMAGE_DOES_NOT_MATCH_SPS=1031,
+- DE265_WARNING_REFERENCE_IMAGE_CHROMA_FORMAT_DOES_NOT_MATCH=1032
++ DE265_WARNING_REFERENCE_IMAGE_CHROMA_FORMAT_DOES_NOT_MATCH=1032,
++ DE265_WARNING_INVALID_SLICE_HEADER_INDEX_ACCESS=1033
+ } de265_error;
+
+ LIBDE265_API const char* de265_get_error_text(de265_error err);
+Index: libde265-1.0.11/libde265/motion.cc
+===================================================================
+--- libde265-1.0.11.orig/libde265/motion.cc 2023-11-19 19:08:22.851224558 +0100
++++ libde265-1.0.11/libde265/motion.cc 2023-11-19 19:08:22.847224554 +0100
+@@ -1266,6 +1266,16 @@
+
+
+
++ int slice_hdr_idx = colImg->get_SliceHeaderIndex(xColPb,yColPb);
++ if (slice_hdr_idx >= colImg->slices.size()) {
++ ctx->add_warning(DE265_WARNING_INVALID_SLICE_HEADER_INDEX_ACCESS, false);
++
++ *out_availableFlagLXCol = 0;
++ out_mvLXCol->x = 0;
++ out_mvLXCol->y = 0;
++ return;
++ }
++
+ const slice_segment_header* colShdr = colImg->slices[ colImg->get_SliceHeaderIndex(xColPb,yColPb) ];
+
+ if (shdr->LongTermRefPic[X][refIdxLX] !=
--- /dev/null
+commit 63b596c915977f038eafd7647d1db25488a8c133
+Author: Dirk Farin <dirk.farin@gmail.com>
+Date: Fri Sep 1 21:18:48 2023 +0200
+
+ fix #418
+
+Index: libde265-1.0.11/libde265/decctx.cc
+===================================================================
+--- libde265-1.0.11.orig/libde265/decctx.cc 2023-11-21 19:05:15.995562788 +0100
++++ libde265-1.0.11/libde265/decctx.cc 2023-11-21 19:05:15.991562787 +0100
+@@ -854,16 +854,17 @@
+ std::shared_ptr<pic_parameter_set> new_pps = std::make_shared<pic_parameter_set>();
+
+ bool success = new_pps->read(&reader,this);
++ if (!success) {
++ return DE265_WARNING_PPS_HEADER_INVALID;
++ }
+
+ if (param_pps_headers_fd>=0) {
+ new_pps->dump(param_pps_headers_fd);
+ }
+
+- if (success) {
+- pps[ (int)new_pps->pic_parameter_set_id ] = new_pps;
+- }
++ pps[ (int)new_pps->pic_parameter_set_id ] = new_pps;
+
+- return success ? DE265_OK : DE265_WARNING_PPS_HEADER_INVALID;
++ return DE265_OK;
+ }
+
+ de265_error decoder_context::read_sei_NAL(bitreader& reader, bool suffix)
--- /dev/null
+commit e36b4a1b0bafa53df47514c419d5be3e8916ebc7
+Author: Dirk Farin <dirk.farin@gmail.com>
+Date: Sat Nov 4 15:20:50 2023 +0100
+
+ null-pointer check in debug output (fixes #426)
+
+diff --git a/libde265/slice.cc b/libde265/slice.cc
+index 280b7417..435123dc 100644
+--- a/libde265/slice.cc
++++ b/libde265/slice.cc
+@@ -1277,14 +1277,23 @@ void slice_segment_header::dump_slice_segment_header(const decoder_context* ctx,
+ #define LOG3(t,d1,d2,d3) log2fh(fh, t,d1,d2,d3)
+ #define LOG4(t,d1,d2,d3,d4) log2fh(fh, t,d1,d2,d3,d4)
+
++ LOG0("----------------- SLICE -----------------\n");
++
+ const pic_parameter_set* pps = ctx->get_pps(slice_pic_parameter_set_id);
++ if (!pps) {
++ LOG0("invalid PPS referenced\n");
++ return;
++ }
+ assert(pps->pps_read); // TODO: error handling
+
+ const seq_parameter_set* sps = ctx->get_sps((int)pps->seq_parameter_set_id);
++ if (!sps) {
++ LOG0("invalid SPS referenced\n");
++ return;
++ }
+ assert(sps->sps_read); // TODO: error handling
+
+
+- LOG0("----------------- SLICE -----------------\n");
+ LOG1("first_slice_segment_in_pic_flag : %d\n", first_slice_segment_in_pic_flag);
+ if (ctx->get_nal_unit_type() >= NAL_UNIT_BLA_W_LP &&
+ ctx->get_nal_unit_type() <= NAL_UNIT_RESERVED_IRAP_VCL23) {
--- /dev/null
+commit 1475c7d2f0a6dc35c27e18abc4db9679bfd32568
+Author: Dirk Farin <dirk.farin@gmail.com>
+Date: Thu Nov 23 19:43:55 2023 +0100
+
+ possible fix for #435
+
+Index: libde265-1.0.11/libde265/motion.cc
+===================================================================
+--- libde265-1.0.11.orig/libde265/motion.cc 2023-12-26 00:54:05.172996659 +0100
++++ libde265-1.0.11/libde265/motion.cc 2023-12-26 00:54:05.168996661 +0100
+@@ -1859,7 +1859,14 @@
+ logmvcand(vi);
+
+ const de265_image* imgX = NULL;
+- if (vi.predFlag[X]) imgX = ctx->get_image(shdr->RefPicList[X][ vi.refIdx[X] ]);
++ if (vi.predFlag[X]) {
++ if (vi.refIdx[X] < 0 || vi.refIdx[X] >= MAX_NUM_REF_PICS) {
++ return;
++ }
++
++ imgX = ctx->get_image(shdr->RefPicList[X][ vi.refIdx[X] ]);
++ }
++
+ const de265_image* imgY = NULL;
+ if (vi.predFlag[Y]) imgY = ctx->get_image(shdr->RefPicList[Y][ vi.refIdx[Y] ]);
+
--- /dev/null
+commit 7e4faf254bbd2e52b0f216cb987573a2cce97b54
+Author: Dirk Farin <dirk.farin@gmail.com>
+Date: Thu Nov 23 19:38:34 2023 +0100
+
+ prevent endless loop for #434 input
+
+diff --git a/libde265/slice.cc b/libde265/slice.cc
+index 435123dc..3a8a8de1 100644
+--- a/libde265/slice.cc
++++ b/libde265/slice.cc
+@@ -2582,6 +2582,11 @@ static int decode_rqt_root_cbf(thread_context* tctx)
+
+ static int decode_ref_idx_lX(thread_context* tctx, int numRefIdxLXActive)
+ {
++ // prevent endless loop when 'numRefIdxLXActive' is invalid
++ if (numRefIdxLXActive <= 1) {
++ return 0;
++ }
++
+ logtrace(LogSlice,"# ref_idx_lX\n");
+
+ int cMax = numRefIdxLXActive-1;
--- /dev/null
+commit 3e822a3ccf88df1380b165d6ce5a00494a27ceeb
+Author: Dirk Farin <dirk.farin@gmail.com>
+Date: Thu Nov 23 19:11:34 2023 +0100
+
+ fix #432 (undefined IPM)
+
+diff --git a/libde265/image.h b/libde265/image.h
+index 0b536054..0a0c0e32 100644
+--- a/libde265/image.h
++++ b/libde265/image.h
+@@ -624,7 +624,14 @@ public:
+
+ enum IntraPredMode get_IntraPredMode(int x,int y) const
+ {
+- return (enum IntraPredMode)intraPredMode.get(x,y);
++ uint8_t ipm = intraPredMode.get(x,y);
++
++ // sanitize values if IPM is uninitialized (because of earlier read error)
++ if (ipm > 34) {
++ ipm = 0;
++ }
++
++ return static_cast<enum IntraPredMode>(ipm);
+ }
+
+ enum IntraPredMode get_IntraPredMode_atIndex(int idx) const
--- /dev/null
+Description: CVE-2023-51792: check validity of conformance window parameters
+ Imported from 1.0.11-0+deb11u4
+Origin: https://github.com/strukturag/libde265/commit/221e767136b8c46c748ae35b79ec9b976b3da301
+
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Sat, 4 Nov 2023 15:13:36 +0100
+Subject: check validity of conformance window parameters (fixes #427)
+
+(cherry picked from commit 221e767136b8c46c748ae35b79ec9b976b3da301)
+---
+ libde265/image.cc | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/libde265/image.cc b/libde265/image.cc
+index 39813b0..057705c 100644
+--- a/libde265/image.cc
++++ b/libde265/image.cc
+@@ -330,6 +330,14 @@ de265_error de265_image::alloc_image(int w,int h, enum de265_chroma c,
+ int top = sps ? sps->conf_win_top_offset : 0;
+ int bottom = sps ? sps->conf_win_bottom_offset : 0;
+
++ if ((left+right)*WinUnitX >= width) {
++ return DE265_ERROR_CODED_PARAMETER_OUT_OF_RANGE;
++ }
++
++ if ((top+bottom)*WinUnitX >= height) {
++ return DE265_ERROR_CODED_PARAMETER_OUT_OF_RANGE;
++ }
++
+ width_confwin = width - (left+right)*WinUnitX;
+ height_confwin= height- (top+bottom)*WinUnitY;
+ chroma_width_confwin = chroma_width -left-right;
--- /dev/null
+Description: CVE-2024-38949 (Heap Buffer Overflow) and CVE-2024-38950 (crash)
+ as the version in bookworm is still using SDL1.2, the resize() function has
+ been backported for SDL1.2.
+ The display444as420() does not need backporting, as with SDL1.2 the faulty
+ pointer arimethic is not needed, SDL has separate buffers.
+Author: Tobias Frost <tobi@debian.org>
+Origin: https://github.com/strukturag/libde265/commit/4089de0845e0009e019be4ca5cbebaf2aee0a8ce
+Bug: https://github.com/strukturag/libde265/issues/460
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1074416
+
+From 4089de0845e0009e019be4ca5cbebaf2aee0a8ce Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Sun, 10 May 2026 22:37:53 +0200
+Subject: [PATCH] dec265: fix SDL OOB on 4:4:4 streams and mid-stream
+ resolution change (closes #460)
+
+---
+ dec265/dec265.cc | 22 ++++++++++++----------
+ dec265/sdl-display.cc | 39 ++++++++++++++++++++++++++++++++++++++-
+ dec265/sdl-display.h | 1 +
+ 3 files changed, 51 insertions(+), 11 deletions(-)
+
+--- a/dec265/dec265.cc
++++ b/dec265/dec265.cc
+@@ -261,17 +261,20 @@
+
+ de265_chroma chroma = de265_get_chroma_format(img);
+
++ enum SDL_YUV_Display::SDL_Chroma sdlChroma;
++ switch (chroma) {
++ case de265_chroma_420: sdlChroma = SDL_YUV_Display::SDL_CHROMA_420; break;
++ case de265_chroma_422: sdlChroma = SDL_YUV_Display::SDL_CHROMA_422; break;
++ case de265_chroma_444: sdlChroma = SDL_YUV_Display::SDL_CHROMA_444; break;
++ case de265_chroma_mono: sdlChroma = SDL_YUV_Display::SDL_CHROMA_MONO; break;
++ default: sdlChroma = SDL_YUV_Display::SDL_CHROMA_MONO;
++ }
++
+ if (!sdl_active) {
+ sdl_active=true;
+- enum SDL_YUV_Display::SDL_Chroma sdlChroma;
+- switch (chroma) {
+- case de265_chroma_420: sdlChroma = SDL_YUV_Display::SDL_CHROMA_420; break;
+- case de265_chroma_422: sdlChroma = SDL_YUV_Display::SDL_CHROMA_422; break;
+- case de265_chroma_444: sdlChroma = SDL_YUV_Display::SDL_CHROMA_444; break;
+- case de265_chroma_mono: sdlChroma = SDL_YUV_Display::SDL_CHROMA_MONO; break;
+- }
+-
+- sdlWin.init(width,height, sdlChroma);
++ if (!sdlWin.init(width,height, sdlChroma)) return true;
++ } else {
++ if (!sdlWin.resize(width,height, sdlChroma)) return true;
+ }
+
+ int stride,chroma_stride;
+--- a/dec265/sdl.cc
++++ b/dec265/sdl.cc
+@@ -96,6 +96,80 @@
+ return true;
+ }
+
++
++
++bool SDL_YUV_Display::resize(int frame_width, int frame_height, enum SDL_Chroma chroma)
++{
++ if (!mWindowOpen) {
++ return init(frame_width, frame_height, chroma);
++ }
++
++ // reduce image size to a multiple of 8, same rounding as init()
++ frame_width &= ~7;
++ frame_height &= ~7;
++
++ if (frame_width == rect.w && frame_height == rect.h && mChroma == chroma) {
++ return true;
++ }
++
++ mChroma = chroma;
++
++ // The overlay is tied to the old dimensions/pixel format; it has to be
++ // freed and recreated at the new size (SDL 1.2 has no in-place resize).
++ if (mYUVOverlay) {
++ SDL_FreeYUVOverlay(mYUVOverlay);
++ mYUVOverlay = NULL;
++ }
++
++ const SDL_VideoInfo* info = SDL_GetVideoInfo();
++ if (!info) {
++ printf("SDL_GetVideoInfo() failed: %s\n", SDL_GetError());
++ mWindowOpen = false;
++ return false;
++ }
++
++ Uint8 bpp = info->vfmt->BitsPerPixel;
++
++ Uint32 vflags;
++ if (info->hw_available)
++ vflags = SDL_HWSURFACE;
++ else
++ vflags = SDL_SWSURFACE;
++
++ mScreen = SDL_SetVideoMode(frame_width, frame_height, bpp, vflags);
++ if (mScreen == NULL) {
++ printf("SDL: Couldn't set video mode to %dx%d,%d bpp: %s",
++ frame_width, frame_height, bpp, SDL_GetError());
++ mWindowOpen = false;
++ return false;
++ }
++
++ uint32_t pixelFormat;
++ switch (mChroma) {
++ case SDL_CHROMA_MONO: pixelFormat = SDL_YV12_OVERLAY; break;
++ case SDL_CHROMA_420: pixelFormat = SDL_YV12_OVERLAY; break;
++ case SDL_CHROMA_422: pixelFormat = SDL_YUY2_OVERLAY; break;
++ case SDL_CHROMA_444: pixelFormat = SDL_YV12_OVERLAY; break;
++ default: pixelFormat = SDL_YV12_OVERLAY; break;
++ }
++
++ mYUVOverlay = SDL_CreateYUVOverlay(frame_width, frame_height, pixelFormat, mScreen);
++ if (mYUVOverlay == NULL) {
++ printf("SDL: Couldn't recreate SDL YUV overlay: %s", SDL_GetError());
++ mWindowOpen = false;
++ return false;
++ }
++
++ rect.x = 0;
++ rect.y = 0;
++ rect.w = frame_width;
++ rect.h = frame_height;
++
++ return true;
++}
++
++
++
+ void SDL_YUV_Display::display(const unsigned char *Y,
+ const unsigned char *U,
+ const unsigned char *V,
+--- a/dec265/sdl.hh
++++ b/dec265/sdl.hh
+@@ -39,6 +39,7 @@
+ };
+
+ bool init(int frame_width, int frame_height, enum SDL_Chroma chroma = SDL_CHROMA_420);
++ bool resize(int frame_width, int frame_height, enum SDL_Chroma chroma);
+ void display(const unsigned char *Y, const unsigned char *U, const unsigned char *V,
+ int stride, int chroma_stride);
+ void close();
--- /dev/null
+Description: CVE-2026-33164 + CVE-2026-33165: fix reallocation of metadata array...
+ Imported from 1.0.11-0+deb11u4
+Origin: https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658
+Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg (CVE-2026-33165)
+Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r (CVE-2026-33164)
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131468 (CVE-2026-33165)
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131469 (CVE-2026-33164)
+
+
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Sun, 15 Mar 2026 22:58:39 +0100
+Subject: fix reallocation of metadata array when ctb size changes (thanks to
+ Ana K.)
+
+(cherry picked from commit c7891e412106130b83f8e8ea8b7f907e9449b658)
+---
+ libde265/image.cc | 5 +++--
+ libde265/image.h | 2 +-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/libde265/image.cc b/libde265/image.cc
+index 057705c..a376aaa 100644
+--- a/libde265/image.cc
++++ b/libde265/image.cc
+@@ -453,8 +453,9 @@ de265_error de265_image::alloc_image(int w,int h, enum de265_chroma c,
+
+ // CTB info
+
+- if (ctb_info.width_in_units != sps->PicWidthInCtbsY ||
+- ctb_info.height_in_units != sps->PicHeightInCtbsY)
++ if (ctb_info.width_in_units != sps->PicWidthInCtbsY ||
++ ctb_info.height_in_units != sps->PicHeightInCtbsY ||
++ ctb_info.log2unitSize != sps->Log2CtbSizeY)
+ {
+ delete[] ctb_progress;
+
+diff --git a/libde265/image.h b/libde265/image.h
+index 0a0c0e3..7908fe3 100644
+--- a/libde265/image.h
++++ b/libde265/image.h
+@@ -149,7 +149,7 @@ template <class DataUnit> class MetaDataArray
+ // private:
+ DataUnit* data;
+ int data_size;
+- int log2unitSize;
++ uint8_t log2unitSize;
+ int width_in_units;
+ int height_in_units;
+ };
--- /dev/null
+Description: CVE-2026-45382: Heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometry
+Origin: https://github.com/strukturag/libde265/commit/c33b4f63ae9056b00f34a31874fed55cd0aa29c9
+Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9
+
+From c33b4f63ae9056b00f34a31874fed55cd0aa29c9 Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Sun, 10 May 2026 19:57:18 +0200
+Subject: [PATCH] fix CTB OOB access when pps.sps mismatches active sps
+ (GHSA-hwhx-x2mq-ccr9)
+
+---
+ libde265/decctx.cc | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/libde265/decctx.cc b/libde265/decctx.cc
+index 70968c1f..45d04665 100644
+--- a/libde265/decctx.cc
++++ b/libde265/decctx.cc
+@@ -861,6 +861,11 @@ de265_error decoder_context::decode_slice_unit_WPP(image_unit* imgunit,
+ tctx->img = img;
+ tctx->imgunit = imgunit;
+ tctx->sliceunit= sliceunit;
++
++ if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
++ err = DE265_WARNING_SLICEHEADER_INVALID;
++ break;
++ }
+ tctx->CtbAddrInTS = pps.CtbAddrRStoTS[ctbAddrRS];
+
+ init_thread_context(tctx);
+@@ -937,6 +942,12 @@ de265_error decoder_context::decode_slice_unit_tiles(image_unit* imgunit,
+
+ // first CTB in this slice
+ int ctbAddrRS = shdr->slice_segment_address;
++
++ // pps.TileIdRS and pps.CtbAddrRStoTS are both sized to PicSizeInCtbsY in
++ // set_derived_values(), so one bound covers both accesses below.
++ if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
++ return DE265_WARNING_SLICEHEADER_INVALID;
++ }
+ int tileID = pps.TileIdRS[ctbAddrRS];
+
+ for (int entryPt=0;entryPt<nTiles;entryPt++) {
+@@ -952,6 +963,11 @@ de265_error decoder_context::decode_slice_unit_tiles(image_unit* imgunit,
+ int ctbX = pps.colBd[tileID % pps.num_tile_columns];
+ int ctbY = pps.rowBd[tileID / pps.num_tile_columns];
+ ctbAddrRS = ctbY * ctbsWidth + ctbX;
++
++ if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
++ err = DE265_WARNING_SLICEHEADER_INVALID;
++ break;
++ }
+ }
+
+ // set thread context
+--
+2.55.0
+
--- /dev/null
+Description: CVE-2026-45383: prevent reading past end of CtbAddrRStoTS[] in WPP images
+ In the WPP slice decoder ctbAddrRS = ctbRow * ctbsWidth can exceed the
+ allocated vector size, causing out-of-bounds reads.
+Origin: upstream, https://github.com/strukturag/libde265/commit/d1a2c3b4b751d21f44e8e82220fe9766c9d116ff
+Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38
+Applied-Upstream: 1.0.19
+
+diff --git a/libde265/decctx.cc b/libde265/decctx.cc
+index ea2e2136..ed8709d8 100644
+--- a/libde265/decctx.cc
++++ b/libde265/decctx.cc
+@@ -1291,6 +1291,10 @@ de265_error decoder_context::decode_slice_unit_WPP(image_unit* imgunit,
+ int ctbAddrRS = shdr->slice_segment_address;
+ int ctbRow = ctbAddrRS / ctbsWidth;
+
++ if (ctbRow + nRows > img->get_sps().PicHeightInCtbsY) {
++ return DE265_WARNING_SLICEHEADER_INVALID;
++ }
++
+ for (int entryPt=0;entryPt<nRows;entryPt++) {
+ // entry points other than the first start at CTB rows
+ if (entryPt>0) {
--- /dev/null
+Description: CVE-2026-49295: bound aggregate short-term RPS size
+ Missing aggregate bound check on predicted reference picture set entries
+ allows exceeding the 16-entry array, an out-of-bounds array write in
+ process_reference_picture_set().
+Origin: upstream, https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b
+Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594
+Bug-Debian: https://bugs.debian.org/1140431
+Applied-Upstream: 1.1.0
+
+diff --git a/libde265/refpic.cc b/libde265/refpic.cc
+index 77cc719e..ab7de2a6 100644
+--- a/libde265/refpic.cc
++++ b/libde265/refpic.cc
+@@ -318,6 +318,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue,
+
+ out_set->compute_derived_values();
+
++ // The unused short-term references are all collected into a single PocStFoll array
++ // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set).
++ // While each individual list is bounded above, the predicted-RPS construction can
++ // append the current-picture delta to an already-full source set, pushing the
++ // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds
++ // write when filling PocStFoll.
++ if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) {
++ out_set->NumNegativePics = 0;
++ out_set->NumPositivePics = 0;
++ out_set->NumDeltaPocs = 0;
++ out_set->NumPocTotalCurr_shortterm_only = 0;
++
++ errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false);
++ return false;
++ }
++
+ return true;
+ }
+
--- /dev/null
+Description: CVE-2026-49337: free orphaned slice header when no active image unit
+ Slice headers attached to finished pictures without an active image unit
+ were retained forever; a crafted NAL sequence can grow memory without
+ bound during continuous streaming.
+Origin: upstream, https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9
+Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm
+Bug-Debian: https://bugs.debian.org/1140431
+Applied-Upstream: 1.1.0
+Comment: Backport: on 1.0.15 the pre-existing unconditional add_slice_segment_header() call must be removed (upstream moves it into the guarded block); keeping both would double-free every slice header.
+
+diff --git a/libde265/decctx.cc b/libde265/decctx.cc
+index ed8709d8..8383dd2b 100644
+--- a/libde265/decctx.cc
++++ b/libde265/decctx.cc
+@@ -928,8 +928,6 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na
+ return err;
+ }
+
+- this->img->add_slice_segment_header(shdr);
+-
+ skip_bits(&reader,1); // TODO: why?
+ prepare_for_CABAC(&reader);
+
+@@ -957,6 +955,13 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na
+
+ if ( ! image_units.empty() ) {
+
++ // Hand the slice header to the picture (which takes ownership and frees it
++ // on release). Only do this when there is an active image unit to decode
++ // the slice; otherwise the header would be retained on img->slices forever,
++ // which a crafted stream of non-first slice NALs can exploit to grow memory
++ // without bound.
++ this->img->add_slice_segment_header(shdr);
++
+ slice_unit* sliceunit = new slice_unit(this);
+ sliceunit->nal = nal;
+ sliceunit->shdr = shdr;
+@@ -967,6 +972,10 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na
+
+ image_units.back()->slice_units.push_back(sliceunit);
+ }
++ else {
++ nal_parser.free_NAL_unit(nal);
++ delete shdr;
++ }
+
+ bool did_work;
+ err = decode_some(&did_work);
--- /dev/null
+Description: CVE-2026-49346: fix integer overflow in image plane allocation size
+ Large SPS dimensions with 16-bit bit depth overflow the 32-bit allocation
+ size in de265_image_get_buffer(); the wrapped ~1 KB allocation is later
+ written with the full plane size, corrupting the heap.
+Origin: upstream, https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8
+Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86
+Bug-Debian: https://bugs.debian.org/1140431
+Applied-Upstream: 1.1.0
+
+diff --git a/libde265/image.cc b/libde265/image.cc
+index 0ae77511..9ddfed2c 100644
+--- a/libde265/image.cc
++++ b/libde265/image.cc
+@@ -71,10 +71,11 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx,
+ void* inputdata, int inputstride, void *userdata)
+ {
+ int alignment = STANDARD_ALIGNMENT;
+- int stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment;
+- int height = img->get_height(cIdx);
++ uint32_t stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment;
++ uint32_t height = img->get_height(cIdx);
+
+- uint8_t* p = (uint8_t *)ALLOC_ALIGNED_16(stride * height + MEMORY_PADDING);
++ // size computed in size_t: stride*height can exceed UINT32_MAX for large planes
++ uint8_t* p = static_cast<uint8_t*>(ALLOC_ALIGNED_16(static_cast<size_t>(stride) * height + MEMORY_PADDING));
+
+ if (p==NULL) { return NULL; }
+
+@@ -82,13 +83,15 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx,
+
+ // copy input data if provided
+
+- if (inputdata != NULL) {
+- if (inputstride == stride) {
+- memcpy(p, inputdata, stride*height);
++ if (inputdata != nullptr) {
++ if (inputstride == static_cast<int>(stride)) {
++ memcpy(p, inputdata, static_cast<size_t>(stride) * height);
+ }
+ else {
+- for (int y=0;y<height;y++) {
+- memcpy(p+y*stride, ((char*)inputdata) + inputstride*y, inputstride);
++ for (uint32_t y=0;y<height;y++) {
++ memcpy(p + static_cast<size_t>(y) * stride,
++ static_cast<char*>(inputdata) + static_cast<size_t>(inputstride) * y,
++ inputstride);
+ }
+ }
+ }
+@@ -108,30 +111,35 @@ LIBDE265_API void de265_free_image_plane(struct de265_image* img, int cIdx)
+ static int de265_image_get_buffer(de265_decoder_context* ctx,
+ de265_image_spec* spec, de265_image* img, void* userdata)
+ {
+- const int rawChromaWidth = spec->width / img->SubWidthC;
+- const int rawChromaHeight = spec->height / img->SubHeightC;
++ const uint32_t rawChromaWidth = spec->width / img->SubWidthC;
++ const uint32_t rawChromaHeight = spec->height / img->SubHeightC;
+
+- int luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment;
+- int chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment;
++ uint32_t luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment;
++ uint32_t chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment;
+
+ assert(img->BitDepth_Y >= 8 && img->BitDepth_Y <= 16);
+ assert(img->BitDepth_C >= 8 && img->BitDepth_C <= 16);
+
+- int luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8);
+- int chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8);
++ uint32_t luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8);
++ uint32_t chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8);
+
+- int luma_height = spec->height;
+- int chroma_height = rawChromaHeight;
++ uint32_t luma_height = spec->height;
++ uint32_t chroma_height = rawChromaHeight;
+
+ bool alloc_failed = false;
+
+- uint8_t* p[3] = { 0,0,0 };
+- p[0] = (uint8_t *)ALLOC_ALIGNED_16(luma_height * luma_bpl + MEMORY_PADDING);
+- if (p[0]==NULL) { alloc_failed=true; }
++ // Compute the plane sizes in size_t. Each operand fits in uint32_t, but the
++ // height * bytes-per-line product can exceed UINT32_MAX for large frames, so
++ // the multiplication must be done in 64 bits. Computing it in 32 bits wraps
++ // the allocation size to a small value while fill_image() later writes the
++ // real (size_t) size -> heap buffer overflow (GHSA-vv8h-932h-7r86).
++ uint8_t* p[3] = { nullptr,nullptr,nullptr };
++ p[0] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(static_cast<size_t>(luma_height) * luma_bpl + MEMORY_PADDING));
++ if (p[0]==nullptr) { alloc_failed=true; }
+
+ if (img->get_chroma_format() != de265_chroma_mono) {
+- p[1] = (uint8_t *)ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING);
+- p[2] = (uint8_t *)ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING);
++ p[1] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(static_cast<size_t>(chroma_height) * chroma_bpl + MEMORY_PADDING));
++ p[2] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(static_cast<size_t>(chroma_height) * chroma_bpl + MEMORY_PADDING));
+
+ if (p[1]==NULL || p[2]==NULL) { alloc_failed=true; }
+ }
--- /dev/null
+Description: CVE-2026-54240, CVE-2026-54241: fix pixel-accessor integer overflow
+ The image pixel accessors computed xpos + ypos*stride in signed 32-bit
+ arithmetic; frames with width*height > INT32_MAX wrap the offset and the
+ returned pointer lands far outside the buffer (OOB read/write). Widen
+ stride/offset math to 64 bits and store validated SPS dimensions in
+ uint16_t.
+Origin: upstream, https://github.com/strukturag/libde265/commit/bdca87569b9c63c2a7054d90ae4462dbb78d159a
+Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3
+Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr
+Applied-Upstream: 1.1.1
+
+diff --git a/libde265/de265.cc b/libde265/de265.cc
+index 6ff01918..571ed06b 100644
+--- a/libde265/de265.cc
++++ b/libde265/de265.cc
+@@ -672,7 +672,7 @@ LIBDE265_API const uint8_t* de265_get_image_plane(const de265_image* img, int ch
+
+ uint8_t* data = img->pixels_confwin[channel];
+
+- if (stride) *stride = img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8);
++ if (stride) *stride = static_cast<int>(img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8));
+
+ return data;
+ }
+diff --git a/libde265/image-io.cc b/libde265/image-io.cc
+index 49837837..c6370bcd 100644
+--- a/libde265/image-io.cc
++++ b/libde265/image-io.cc
+@@ -73,7 +73,7 @@ de265_image* ImageSource_YUV::read_next_image()
+ // --- load image ---
+
+ uint8_t* p;
+- int stride;
++ ptrdiff_t stride;
+
+ p = img->get_image_plane(0); stride = img->get_image_stride(0);
+ for (int y=0;y<height;y++) {
+@@ -154,7 +154,7 @@ void ImageSink_YUV::send_image(const de265_image* img)
+ // --- write image ---
+
+ const uint8_t* p;
+- int stride;
++ ptrdiff_t stride;
+
+ int width = img->get_width();
+ int height= img->get_height();
+diff --git a/libde265/image.cc b/libde265/image.cc
+index 9ddfed2c..9beeb07e 100644
+--- a/libde265/image.cc
++++ b/libde265/image.cc
+@@ -183,7 +183,7 @@ de265_image_allocation de265_image::default_image_allocation = {
+ };
+
+
+-void de265_image::set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata)
++void de265_image::set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata)
+ {
+ pixels[cIdx] = mem;
+ plane_user_data[cIdx] = userdata;
+diff --git a/libde265/image.h b/libde265/image.h
+index 0a0c0e32..c514429d 100644
+--- a/libde265/image.h
++++ b/libde265/image.h
+@@ -26,6 +26,7 @@
+ #endif
+
+ #include <assert.h>
++#include <stddef.h>
+ #include <stdint.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -254,11 +255,11 @@ struct de265_image {
+ /* */ uint8_t* get_image_plane(int cIdx) { return pixels[cIdx]; }
+ const uint8_t* get_image_plane(int cIdx) const { return pixels[cIdx]; }
+
+- void set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata);
++ void set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata);
+
+ uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos)
+ {
+- int stride = get_image_stride(cIdx);
++ ptrdiff_t stride = get_image_stride(cIdx);
+ return pixels[cIdx] + xpos + ypos*stride;
+ }
+
+@@ -267,38 +268,38 @@ struct de265_image {
+ template <class pixel_t>
+ pixel_t* get_image_plane_at_pos_NEW(int cIdx, int xpos,int ypos)
+ {
+- int stride = get_image_stride(cIdx);
++ ptrdiff_t stride = get_image_stride(cIdx);
+ return (pixel_t*)(pixels[cIdx] + (xpos + ypos*stride)*sizeof(pixel_t));
+ }
+
+ const uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos) const
+ {
+- int stride = get_image_stride(cIdx);
++ ptrdiff_t stride = get_image_stride(cIdx);
+ return pixels[cIdx] + xpos + ypos*stride;
+ }
+
+ void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos)
+ {
+- int stride = get_image_stride(cIdx);
++ ptrdiff_t stride = get_image_stride(cIdx);
+ return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]);
+ }
+
+ const void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos) const
+ {
+- int stride = get_image_stride(cIdx);
++ ptrdiff_t stride = get_image_stride(cIdx);
+ return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]);
+ }
+
+ /* Number of pixels in one row (not number of bytes).
+ */
+- int get_image_stride(int cIdx) const
++ ptrdiff_t get_image_stride(int cIdx) const
+ {
+ if (cIdx==0) return stride;
+ else return chroma_stride;
+ }
+
+- int get_luma_stride() const { return stride; }
+- int get_chroma_stride() const { return chroma_stride; }
++ ptrdiff_t get_luma_stride() const { return stride; }
++ ptrdiff_t get_chroma_stride() const { return chroma_stride; }
+
+ int get_width (int cIdx=0) const { return cIdx==0 ? width : chroma_width; }
+ int get_height(int cIdx=0) const { return cIdx==0 ? height : chroma_height; }
+@@ -352,8 +353,8 @@ private:
+
+ int width, height; // size in luma pixels
+
+- int chroma_width, chroma_height;
+- int stride, chroma_stride;
++ int chroma_width = 0, chroma_height = 0;
++ ptrdiff_t stride = 0, chroma_stride = 0;
+
+ public:
+ uint8_t BitDepth_Y, BitDepth_C;
+diff --git a/libde265/intrapred.h b/libde265/intrapred.h
+index 5c997908..2b224879 100644
+--- a/libde265/intrapred.h
++++ b/libde265/intrapred.h
+@@ -533,7 +533,7 @@ void intra_border_computer<pixel_t>::fill_from_image()
+ assert(nT<=32);
+
+ pixel_t* image;
+- int stride;
++ ptrdiff_t stride;
+ image = (pixel_t*)img->get_image_plane(cIdx);
+ stride = img->get_image_stride(cIdx);
+
+diff --git a/libde265/motion.cc b/libde265/motion.cc
+index 0ddfaabd..35030064 100644
+--- a/libde265/motion.cc
++++ b/libde265/motion.cc
+@@ -50,7 +50,7 @@ void mc_luma(const base_context* ctx,
+ const seq_parameter_set* sps, int mv_x, int mv_y,
+ int xP,int yP,
+ int16_t* out, int out_stride,
+- const pixel_t* ref, int ref_stride,
++ const pixel_t* ref, ptrdiff_t ref_stride,
+ int nPbW, int nPbH, int bitDepth_L)
+ {
+ int xFracL = mv_x & 3;
+@@ -129,7 +129,7 @@ void mc_luma(const base_context* ctx,
+ pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+7)];
+
+ const pixel_t* src_ptr;
+- int src_stride;
++ ptrdiff_t src_stride;
+
+ if (-extra_left + xIntOffsL >= 0 &&
+ -extra_top + yIntOffsL >= 0 &&
+@@ -176,7 +176,7 @@ void mc_chroma(const base_context* ctx,
+ int mv_x, int mv_y,
+ int xP,int yP,
+ int16_t* out, int out_stride,
+- const pixel_t* ref, int ref_stride,
++ const pixel_t* ref, ptrdiff_t ref_stride,
+ int nPbWC, int nPbHC, int bit_depth_C)
+ {
+ // chroma sample interpolation process (8.5.3.2.2.2)
+@@ -222,7 +222,7 @@ void mc_chroma(const base_context* ctx,
+ pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+3)];
+
+ const pixel_t* src_ptr;
+- int src_stride;
++ ptrdiff_t src_stride;
+
+ int extra_top = 1;
+ int extra_left = 1;
+diff --git a/libde265/sao.cc b/libde265/sao.cc
+index 1b88a102..92125db0 100644
+--- a/libde265/sao.cc
++++ b/libde265/sao.cc
+@@ -28,8 +28,8 @@
+ template <class pixel_t>
+ void apply_sao_internal(de265_image* img, int xCtb,int yCtb,
+ const slice_segment_header* shdr, int cIdx, int nSW,int nSH,
+- const pixel_t* in_img, int in_stride,
+- /* */ pixel_t* out_img, int out_stride)
++ const pixel_t* in_img, ptrdiff_t in_stride,
++ /* */ pixel_t* out_img, ptrdiff_t out_stride)
+ {
+ const sao_info* saoinfo = img->get_sao_info(xCtb,yCtb);
+
+@@ -77,7 +77,7 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb,
+
+ if (SaoTypeIdx==2) {
+ int hPos[2], vPos[2];
+- int vPosStride[2]; // vPos[] multiplied by image stride
++ ptrdiff_t vPosStride[2]; // vPos[] multiplied by image stride
+ int SaoEoClass = (saoinfo->SaoEoClass >> (2*cIdx)) & 0x3;
+
+ switch (SaoEoClass) {
+@@ -277,8 +277,8 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb,
+ template <class pixel_t>
+ void apply_sao(de265_image* img, int xCtb,int yCtb,
+ const slice_segment_header* shdr, int cIdx, int nSW,int nSH,
+- const pixel_t* in_img, int in_stride,
+- /* */ pixel_t* out_img, int out_stride)
++ const pixel_t* in_img, ptrdiff_t in_stride,
++ /* */ pixel_t* out_img, ptrdiff_t out_stride)
+ {
+ if (img->high_bit_depth(cIdx)) {
+ apply_sao_internal<uint16_t>(img,xCtb,yCtb, shdr,cIdx,nSW,nSH,
+@@ -343,8 +343,8 @@ void apply_sample_adaptive_offset_sequential(de265_image* img)
+ return;
+ }
+
+- int lumaImageSize = img->get_image_stride(0) * img->get_height(0) * img->get_bytes_per_pixel(0);
+- int chromaImageSize = img->get_image_stride(1) * img->get_height(1) * img->get_bytes_per_pixel(1);
++ size_t lumaImageSize = static_cast<size_t>(img->get_image_stride(0)) * img->get_height(0) * img->get_bytes_per_pixel(0);
++ size_t chromaImageSize = static_cast<size_t>(img->get_image_stride(1)) * img->get_height(1) * img->get_bytes_per_pixel(1);
+
+ uint8_t* inputCopy = new uint8_t[ libde265_max(lumaImageSize, chromaImageSize) ];
+ if (inputCopy == NULL) {
+@@ -358,10 +358,10 @@ void apply_sample_adaptive_offset_sequential(de265_image* img)
+
+ for (int cIdx=0;cIdx<nChannels;cIdx++) {
+
+- int stride = img->get_image_stride(cIdx);
++ ptrdiff_t stride = img->get_image_stride(cIdx);
+ int height = img->get_height(cIdx);
+
+- memcpy(inputCopy, img->get_image_plane(cIdx), stride * height * img->get_bytes_per_pixel(cIdx));
++ memcpy(inputCopy, img->get_image_plane(cIdx), static_cast<size_t>(stride) * height * img->get_bytes_per_pixel(cIdx));
+
+ for (int yCtb=0; yCtb<sps.PicHeightInCtbsY; yCtb++)
+ for (int xCtb=0; xCtb<sps.PicWidthInCtbsY; xCtb++)
+diff --git a/libde265/sei.cc b/libde265/sei.cc
+index 978f7fb7..38de33d6 100644
+--- a/libde265/sei.cc
++++ b/libde265/sei.cc
+@@ -99,7 +99,7 @@ static void dump_sei_decoded_picture_hash(const sei_message* sei,
+ class raw_hash_data
+ {
+ public:
+- raw_hash_data(int w, int stride);
++ raw_hash_data(int w, ptrdiff_t stride);
+ ~raw_hash_data();
+
+ struct data_chunk {
+@@ -111,13 +111,14 @@ public:
+ data_chunk prepare_16bit(const uint8_t* data,int y);
+
+ private:
+- int mWidth, mStride;
++ int mWidth;
++ ptrdiff_t mStride;
+
+ uint8_t* mMem;
+ };
+
+
+-raw_hash_data::raw_hash_data(int w, int stride)
++raw_hash_data::raw_hash_data(int w, ptrdiff_t stride)
+ {
+ mWidth=w;
+ mStride=stride;
+@@ -157,7 +158,7 @@ raw_hash_data::data_chunk raw_hash_data::prepare_16bit(const uint8_t* data,int y
+ }
+
+
+-static uint32_t compute_checksum_8bit(uint8_t* data,int w,int h,int stride, int bit_depth)
++static uint32_t compute_checksum(uint8_t* data,int w,int h,ptrdiff_t stride, int bit_depth)
+ {
+ uint32_t sum = 0;
+
+@@ -169,6 +170,8 @@ static uint32_t compute_checksum_8bit(uint8_t* data,int w,int h,int stride, int
+ }
+ }
+ else {
++ auto* data16 = reinterpret_cast<uint16_t*>(data);
++ ptrdiff_t stride16 = stride / 2;
+ for (int y=0; y<h; y++)
+ for(int x=0; x<w; x++) {
+ uint8_t xorMask = ( x & 0xFF ) ^ ( y & 0xFF ) ^ ( x >> 8 ) ^ ( y >> 8 );
+@@ -222,7 +225,7 @@ static inline uint16_t crc_process_byte_parallel(uint16_t crc, uint8_t byte)
+ (t << 12)) & 0xFFFF;
+ }
+
+-static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride, int bit_depth)
++static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,ptrdiff_t stride, int bit_depth)
+ {
+ raw_hash_data raw_data(w,stride);
+
+@@ -248,7 +251,7 @@ static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride
+ }
+
+
+-static void compute_MD5(uint8_t* data,int w,int h,int stride, uint8_t* result, int bit_depth)
++static void compute_MD5(uint8_t* data,int w,int h,ptrdiff_t stride, uint8_t* result, int bit_depth)
+ {
+ MD5_CTX md5;
+ MD5_Init(&md5);
+@@ -287,7 +290,8 @@ static de265_error process_sei_decoded_picture_hash(const sei_message* sei, de26
+ int nHashes = img->get_sps().chroma_format_idc==0 ? 1 : 3;
+ for (int i=0;i<nHashes;i++) {
+ uint8_t* data;
+- int w,h,stride;
++ int w,h;
++ ptrdiff_t stride;
+
+ w = img->get_width(i);
+ h = img->get_height(i);
+@@ -339,7 +343,7 @@ static de265_error process_sei_decoded_picture_hash(const sei_message* sei, de26
+
+ case sei_decoded_picture_hash_type_checksum:
+ {
+- uint32_t chksum = compute_checksum_8bit(data,w,h,stride, img->get_bit_depth(i));
++ uint32_t chksum = compute_checksum(data,w,h,stride, img->get_bit_depth(i));
+
+ if (chksum != seihash->checksum[i]) {
+ /*
+diff --git a/libde265/sps.cc b/libde265/sps.cc
+index 0652e426..29409fc5 100644
+--- a/libde265/sps.cc
++++ b/libde265/sps.cc
+@@ -521,7 +521,7 @@ de265_error seq_parameter_set::compute_derived_values(bool sanitize_values)
+ PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY);
+ PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY;
+ PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY;
+- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples;
++ PicSizeInSamplesY = static_cast<uint32_t>(pic_width_in_luma_samples) * pic_height_in_luma_samples;
+
+ if (chroma_format_idc==0 || separate_colour_plane_flag) {
+ CtbWidthC = 0;
+@@ -1276,7 +1276,7 @@ de265_error seq_parameter_set::write(error_queue* errqueue, CABAC_encoder& out)
+ PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY);
+ PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY;
+ PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY;
+- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples;
++ PicSizeInSamplesY = static_cast<uint32_t>(pic_width_in_luma_samples) * pic_height_in_luma_samples;
+ if (chroma_format_idc==0 || separate_colour_plane_flag) {
+ CtbWidthC = 0;
+ CtbHeightC = 0;
+diff --git a/libde265/sps.h b/libde265/sps.h
+index 9759bae0..18be31b2 100644
+--- a/libde265/sps.h
++++ b/libde265/sps.h
+@@ -39,6 +39,13 @@ class error_queue;
+ #define MAX_PICTURE_WIDTH 65535
+ #define MAX_PICTURE_HEIGHT 65535
+
++// pic_width/height_in_luma_samples are stored as uint16_t and PicSizeInSamplesY as uint32_t,
++// so these limits must keep width/height in 16 bits and their product in 32 bits.
++static_assert(MAX_PICTURE_WIDTH <= 0xFFFF, "picture width must fit in uint16_t");
++static_assert(MAX_PICTURE_HEIGHT <= 0xFFFF, "picture height must fit in uint16_t");
++static_assert((uint64_t)MAX_PICTURE_WIDTH * MAX_PICTURE_HEIGHT <= 0xFFFFFFFFu,
++ "total luma sample count must fit in uint32_t");
++
+ enum {
+ CHROMA_MONO = 0,
+ CHROMA_420 = 1,
+@@ -110,10 +117,10 @@ public:
+ int seq_parameter_set_id;
+ int chroma_format_idc;
+
+- char separate_colour_plane_flag;
+- int pic_width_in_luma_samples;
+- int pic_height_in_luma_samples;
+- char conformance_window_flag;
++ bool separate_colour_plane_flag;
++ uint16_t pic_width_in_luma_samples; // <= MAX_PICTURE_WIDTH (validated on parse)
++ uint16_t pic_height_in_luma_samples; // <= MAX_PICTURE_HEIGHT (validated on parse)
++ bool conformance_window_flag;
+
+ int conf_win_left_offset;
+ int conf_win_right_offset;
--- /dev/null
+Description: Double Free / Use after Free
+ Concurrent Execution using Shared Resource with Imprope
+ Synchronization ('Race Condition') and Use After Free and Double Free in
+ libde265.
+ There is no CVE assigned yet.
+Origin: https://github.com/strukturag/libde265/commit/eb346780796055d9f9aac62d725d3170aa60c7b4
+Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-xp3h-6f5r-8cxp
+Comment: As the version in bookworm does not have StatCoeff_models, those
+ patch parts have been omitted.
+
+From eb346780796055d9f9aac62d725d3170aa60c7b4 Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Wed, 2 Sep 2026 20:09:20 +0200
+Subject: [PATCH] Fix WPP CABAC context handoff race (GHSA-xp3h-6f5r-8cxp)
+
+In WPP-threaded decoding, each CTB row task hands its saved CABAC
+context (imgunit->ctx_models[row]) to the row below through
+context_model_table, a hand-rolled refcounted handle whose model and
+refcnt pointers are mutated together by copy, assignment, release(),
+and decouple(). The producer/consumer handoff relied on
+wait_for_progress()/set_progress() to order the accesses, but that
+lock's fast path read a plain non-atomic int with no acquire/release
+barrier, so writes to a row slot were not reliably published across
+threads. Under a crafted stream this let two tasks touch the same
+slot's ownership metadata concurrently, corrupting it and causing
+heap-use-after-free / double-free (confirmed via AddressSanitizer,
+reproducing the double-free in context_model_table::release() at
+the exact reported sites).
+
+Add a mutex to image_unit guarding the whole copy/release (consumer)
+and assign/decouple (producer) sequence for a row slot, so ownership
+transitions are mutually exclusive. Also make de265_progress_lock's
+progress counter atomic with acquire/release ordering, closing the
+underlying missing-barrier gap that the same fast path exposes to
+every other wait_for_progress() consumer (deblocking, SAO, motion
+readiness).
+
+Verified: unpatched build reliably double-frees under ASan within a
+few hundred fuzzer iterations; the fixed build stayed clean across
+thousands of iterations of the same reproducers. Decode output is
+unchanged (girlshy.h265 hash matches single- and multi-threaded).
+---
+ libde265/decctx.h | 19 +++++++++++++++++++
+ libde265/slice.cc | 40 +++++++++++++++++++++++++++++-----------
+ libde265/threads.cc | 18 +++++++++++-------
+ libde265/threads.h | 11 +++++++++--
+ 4 files changed, 68 insertions(+), 20 deletions(-)
+
+--- a/libde265/decctx.h
++++ b/libde265/decctx.h
+@@ -36,6 +36,7 @@
+ #include "libde265/nal-parser.h"
+
+ #include <memory>
++#include <mutex>
+
+ #define DE265_MAX_VPS_SETS 16 // this is the maximum as defined in the standard
+ #define DE265_MAX_SPS_SETS 16 // this is the maximum as defined in the standard
+@@ -267,6 +268,22 @@
+ There is one saved model for the initialization of each CTB row.
+ The array is unused for non-WPP streams. */
+ std::vector<context_model_table> ctx_models; // TODO: move this into image ?
++
++ /* Serializes the producer/consumer handoff of the saved WPP row state
++ (ctx_models[] together with StatCoeff_models[]).
++ Each context_model_table is a reference-counted handle whose model
++ pointer, refcnt pointer, and the referenced count are all mutated
++ together by copy construction, assignment, release(), and decouple().
++ In WPP mode the producer row task stores its context into ctx_models[row]
++ while the consumer row task below copies it out and releases the slot.
++ The progress-lock fast path does not provide an acquire/release barrier
++ around this compound object, so without an explicit lock the two tasks
++ can concurrently mutate the same ownership metadata, corrupting it and
++ causing use-after-free / double-free (GHSA-xp3h-6f5r-8cxp).
++ Holding this mutex across the whole copy/assign/release/decouple of a
++ row slot (on both the producer and consumer side) both excludes
++ concurrent mutation and publishes the writes to the other thread. */
++ std::mutex ctx_models_mutex;
+ };
+
+
+--- a/libde265/slice.cc
++++ b/libde265/slice.cc
+@@ -4710,9 +4710,18 @@
+ // we have to wait until the context model data is there
+ tctx->img->wait_for_progress(tctx->task, 1,tctx->CtbY-1,CTB_PROGRESS_PREFILTER);
+
+- // copy CABAC model from previous CTB row
+- tctx->ctx_model = tctx->imgunit->ctx_models[(tctx->CtbY-1)];
+- tctx->imgunit->ctx_models[(tctx->CtbY-1)].release(); // not used anymore
++ // Copy CABAC model from the previous CTB row.
++ // The whole handoff of this row slot must be serialized against the
++ // producer that stores into the same slot, because context_model_table
++ // is a reference-counted handle whose ownership metadata is mutated as
++ // a unit by the copy/release below (GHSA-xp3h-6f5r-8cxp).
++ {
++ std::lock_guard<std::mutex> lock(tctx->imgunit->ctx_models_mutex);
++
++ // copy CABAC model from previous CTB row
++ tctx->ctx_model = tctx->imgunit->ctx_models[(tctx->CtbY-1)];
++ tctx->imgunit->ctx_models[(tctx->CtbY-1)].release(); // not used anymore
++ }
+ }
+ else {
+ tctx->img->wait_for_progress(tctx->task, 0,tctx->CtbY-1,CTB_PROGRESS_PREFILTER);
+@@ -4766,9 +4775,18 @@
+ return Decode_Error;
+ }
+
+- tctx->imgunit->ctx_models[ctby] = tctx->ctx_model;
+- tctx->imgunit->ctx_models[ctby].decouple(); // store an independent copy
+- }
++ // Store an independent copy of the CABAC model (and StatCoeff state) for
++ // the row below to pick up. Serialize the whole store against the
++ // consumer that copies/releases the same slot: context_model_table is a
++ // reference-counted handle whose ownership metadata is mutated as a unit
++ // by the assignment/decouple below (GHSA-xp3h-6f5r-8cxp).
++ {
++ std::lock_guard<std::mutex> lock(tctx->imgunit->ctx_models_mutex);
++
++ tctx->imgunit->ctx_models[ctby] = tctx->ctx_model;
++ tctx->imgunit->ctx_models[ctby].decouple(); // store an independent copy
++ }
++ }
+
+
+ // end of slice segment ?
+--- a/libde265/threads.cc
++++ b/libde265/threads.cc
+@@ -87,7 +87,7 @@
+
+ de265_progress_lock::de265_progress_lock()
+ {
+- mProgress = 0;
++ mProgress.store(0, std::memory_order_relaxed);
+
+ de265_mutex_init(&mutex);
+ de265_cond_init(&cond);
+@@ -101,12 +101,15 @@
+
+ void de265_progress_lock::wait_for_progress(int progress)
+ {
+- if (mProgress >= progress) {
++ // Fast path: acquire-load pairs with the release-store in set_progress()/
++ // increase_progress() so that everything the signalling thread wrote before
++ // reaching this progress value is visible once we observe it here.
++ if (mProgress.load(std::memory_order_acquire) >= progress) {
+ return;
+ }
+
+ de265_mutex_lock(&mutex);
+- while (mProgress < progress) {
++ while (mProgress.load(std::memory_order_acquire) < progress) {
+ de265_cond_wait(&cond, &mutex);
+ }
+ de265_mutex_unlock(&mutex);
+@@ -116,8 +119,8 @@
+ {
+ de265_mutex_lock(&mutex);
+
+- if (progress>mProgress) {
+- mProgress = progress;
++ if (progress > mProgress.load(std::memory_order_relaxed)) {
++ mProgress.store(progress, std::memory_order_release);
+
+ de265_cond_broadcast(&cond, &mutex);
+ }
+@@ -129,7 +132,8 @@
+ {
+ de265_mutex_lock(&mutex);
+
+- mProgress += progress;
++ mProgress.store(mProgress.load(std::memory_order_relaxed) + progress,
++ std::memory_order_release);
+ de265_cond_broadcast(&cond, &mutex);
+
+ de265_mutex_unlock(&mutex);
+@@ -137,7 +141,7 @@
+
+ int de265_progress_lock::get_progress() const
+ {
+- return mProgress;
++ return mProgress.load(std::memory_order_acquire);
+ }
+
+
+--- a/libde265/threads.h
++++ b/libde265/threads.h
+@@ -81,10 +81,16 @@
+ void set_progress(int progress);
+ void increase_progress(int progress);
+ int get_progress() const;
+- void reset(int value=0) { mProgress=value; }
++ void reset(int value=0) { mProgress.store(value, std::memory_order_release); }
+
+ private:
+- int mProgress;
++ // Read lock-free on the fast paths of wait_for_progress()/get_progress()
++ // while written under 'mutex'. It must be atomic so those reads are not a
++ // data race, and it carries acquire/release ordering so that the state a
++ // producer wrote before signalling progress (e.g. the saved WPP row context)
++ // is published to a consumer that observes the progress value without taking
++ // the mutex (GHSA-xp3h-6f5r-8cxp).
++ std::atomic<int> mProgress;
+
+ // private data
+
--- /dev/null
+Description: heap-use-after-free in decoder_context::reset() via dangling previous_slice_header
+ The issue does not have yet an CVE number assigned.
+Origin: https://github.com/strukturag/libde265/commit/07bc500d45f781a7e2915afb7eebc2d6d9a541c9
+Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-mm7m-v26f-wf8x
+
+From 07bc500d45f781a7e2915afb7eebc2d6d9a541c9 Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Wed, 2 Sep 2026 23:55:01 +0200
+Subject: [PATCH] Fix heap-use-after-free in decoder_context::reset()
+ (GHSA-mm7m-v26f-wf8x)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+decoder_context::reset() calls dpb.clear() which frees all de265_image objects
+and their owned slice_segment_header structs. However, reset() never nulls the
+previous_slice_header pointer, leaving a dangling reference into freed memory.
+
+When the next NAL unit after reset() is a dependent slice, slice_segment_header::read()
+at slice.cc:435 executes:
+ *this = *ctx->previous_slice_header;
+
+This copies from freed 1464-byte struct — heap-use-after-free (CWE-416).
+
+The in-stream case was already guarded by commit 12ba88ec (decctx.cc:556 nulls
+previous_slice_header on first slice of new picture). This fix applies the same
+invariant to the reset() path: only a slice header still retained by a live image
+may remain as previous_slice_header.
+---
+ libde265/decctx.cc | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/libde265/decctx.cc
++++ b/libde265/decctx.cc
+@@ -201,7 +201,6 @@
+ set_acceleration_functions(de265_acceleration_AUTO);
+ }
+
+-
+ decoder_context::decoder_context()
+ {
+ //memset(ctx, 0, sizeof(decoder_context));
+@@ -396,6 +395,15 @@
+
+ img = NULL;
+
++ // Drop the back-reference to the previous picture's slice header before the
++ // DPB is cleared below. dpb.clear() releases the images, which own and free
++ // their slice_segment_header structs (see de265_image::release()). Leaving
++ // previous_slice_header pointing into that freed storage lets a following
++ // dependent slice read from it (slice.cc: '*this = *ctx->previous_slice_header'),
++ // a heap-use-after-free. This mirrors the in-stream new-picture guard in
++ // read_slice_NAL(): only a slice header still retained by a live image may
++ // remain as previous_slice_header.
++ previous_slice_header = nullptr;
+
+ // TODO: remove all pending image_units
+
--- /dev/null
+Description: Disable building of some internal tools that no longer link
+ because internal symbols are no longer exported.
+Author: Joachim Bauch <bauch@struktur.de>
+--- a/dec265/Makefile.am
++++ b/dec265/Makefile.am
+@@ -1,5 +1,5 @@
+
+-bin_PROGRAMS = dec265 hdrcopy
++bin_PROGRAMS = dec265
+
+ AM_CPPFLAGS = -I$(top_srcdir)/libde265 -I$(top_srcdir)
+
+@@ -9,12 +9,6 @@
+ dec265_LDADD = ../libde265/libde265.la -lstdc++
+ dec265_SOURCES = dec265.cc
+
+-hdrcopy_DEPENDENCIES = ../libde265/libde265.la
+-hdrcopy_CXXFLAGS =
+-hdrcopy_LDFLAGS =
+-hdrcopy_LDADD = ../libde265/libde265.la -lstdc++
+-hdrcopy_SOURCES = hdrcopy.cc
+-
+ if HAVE_VIDEOGFX
+ dec265_CXXFLAGS += $(VIDEOGFX_CFLAGS)
+ dec265_LDFLAGS += $(VIDEOGFX_LIBS)
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -8,13 +8,6 @@
+ SUBDIRS+=dec265
+ endif
+
+-if ENABLE_ENCODER
+-SUBDIRS+=enc265
+-endif
+-
+-SUBDIRS+=tools
+-SUBDIRS+=acceleration-speed
+-
+ if ENABLE_SHERLOCK265
+ SUBDIRS+=sherlock265
+ endif
--- /dev/null
+Description: Only export symbols defined in the decoder API.
+ The encoder API is not final yet, so upstream exports all symbols to make
+ development easier. For packaging we only want to expose the public API.
+Author: Joachim Bauch <bauch@struktur.de>
+--- a/libde265/encoder/Makefile.am
++++ b/libde265/encoder/Makefile.am
+@@ -12,6 +12,18 @@
+ encpicbuf.h encpicbuf.cc \
+ sop.h sop.cc
+
++libde265_encoder_la_CFLAGS = \
++ $(CFLAG_VISIBILITY) \
++ -DLIBDE265_EXPORTS
++libde265_encoder_la_CXXFLAGS += \
++ $(CFLAG_VISIBILITY) \
++ -DLIBDE265_EXPORTS
++
++if HAVE_VISIBILITY
++ libde265_encoder_la_CFLAGS += -DHAVE_VISIBILITY
++ libde265_encoder_la_CXXFLAGS += -DHAVE_VISIBILITY
++endif
++
+ SUBDIRS=algo
+ libde265_encoder_la_LIBADD = algo/libde265_encoder_algo.la
+
+--- a/libde265/encoder/algo/Makefile.am
++++ b/libde265/encoder/algo/Makefile.am
+@@ -17,5 +17,13 @@
+ tb-rateestim.h tb-rateestim.cc \
+ pb-mv.h pb-mv.cc
+
++libde265_encoder_algo_la_CXXFLAGS += \
++ $(CFLAG_VISIBILITY) \
++ -DLIBDE265_EXPORTS
++
++if HAVE_VISIBILITY
++ libde265_encoder_algo_la_CXXFLAGS += -DHAVE_VISIBILITY
++endif
++
+ EXTRA_DIST = \
+ CMakeLists.txt
+--- a/configure.ac
++++ b/configure.ac
+@@ -56,9 +56,7 @@
+ fi
+ changequote([,])dnl
+
+-dnl gl_VISIBILITY
+-dnl : In encoder branch, we still export all library symbols :
+-HAVE_VISIBILITY=0
++gl_VISIBILITY
+ AM_CONDITIONAL([HAVE_VISIBILITY], [test "x$HAVE_VISIBILITY" != "x0"])
+
+ # Checks for header files.
+--- a/libde265/image-io.cc
++++ b/libde265/image-io.cc
+@@ -186,7 +186,7 @@
+ }
+
+
+-LIBDE265_API PacketSink_File::~PacketSink_File()
++PacketSink_File::~PacketSink_File()
+ {
+ if (mFH) {
+ fclose(mFH);
+@@ -194,7 +194,7 @@
+ }
+
+
+-LIBDE265_API void PacketSink_File::set_filename(const char* filename)
++void PacketSink_File::set_filename(const char* filename)
+ {
+ assert(mFH==NULL);
+
+@@ -202,7 +202,7 @@
+ }
+
+
+-LIBDE265_API void PacketSink_File::send_packet(const uint8_t* data, int n)
++void PacketSink_File::send_packet(const uint8_t* data, int n)
+ {
+ uint8_t startCode[3];
+ startCode[0] = 0;
+--- a/libde265/image-io.h
++++ b/libde265/image-io.h
+@@ -30,17 +30,17 @@
+ class ImageSource
+ {
+ public:
+- LIBDE265_API ImageSource();
+- virtual LIBDE265_API ~ImageSource() { }
++ ImageSource();
++ virtual ~ImageSource() { }
+
+ //enum ImageStatus { Available, Waiting, EndOfVideo };
+
+ //virtual ImageStatus get_status() = 0;
+- virtual LIBDE265_API de265_image* get_image(bool block=true) = 0;
+- virtual LIBDE265_API void skip_frames(int n) = 0;
++ virtual de265_image* get_image(bool block=true) = 0;
++ virtual void skip_frames(int n) = 0;
+
+- virtual LIBDE265_API int get_width() const = 0;
+- virtual LIBDE265_API int get_height() const = 0;
++ virtual int get_width() const = 0;
++ virtual int get_height() const = 0;
+ };
+
+
+@@ -48,17 +48,17 @@
+ class ImageSource_YUV : public ImageSource
+ {
+ public:
+- LIBDE265_API ImageSource_YUV();
+- virtual LIBDE265_API ~ImageSource_YUV();
++ ImageSource_YUV();
++ virtual ~ImageSource_YUV();
+
+- bool LIBDE265_API set_input_file(const char* filename, int w,int h);
++ bool set_input_file(const char* filename, int w,int h);
+
+ //virtual ImageStatus get_status();
+- virtual LIBDE265_API de265_image* get_image(bool block=true);
+- virtual LIBDE265_API void skip_frames(int n);
++ virtual de265_image* get_image(bool block=true);
++ virtual void skip_frames(int n);
+
+- virtual LIBDE265_API int get_width() const { return width; }
+- virtual LIBDE265_API int get_height() const { return height; }
++ virtual int get_width() const { return width; }
++ virtual int get_height() const { return height; }
+
+ private:
+ FILE* mFH;
+@@ -74,20 +74,20 @@
+ class ImageSink
+ {
+ public:
+- virtual LIBDE265_API ~ImageSink() { }
++ virtual ~ImageSink() { }
+
+- virtual LIBDE265_API void send_image(const de265_image* img) = 0;
++ virtual void send_image(const de265_image* img) = 0;
+ };
+
+ class ImageSink_YUV : public ImageSink
+ {
+ public:
+- LIBDE265_API ImageSink_YUV() : mFH(NULL) { }
+- LIBDE265_API ~ImageSink_YUV();
++ ImageSink_YUV() : mFH(NULL) { }
++ ~ImageSink_YUV();
+
+- bool LIBDE265_API set_filename(const char* filename);
++ bool set_filename(const char* filename);
+
+- virtual LIBDE265_API void send_image(const de265_image* img);
++ virtual void send_image(const de265_image* img);
+
+ private:
+ FILE* mFH;
+@@ -98,21 +98,21 @@
+ class PacketSink
+ {
+ public:
+- virtual LIBDE265_API ~PacketSink() { }
++ virtual ~PacketSink() { }
+
+- virtual LIBDE265_API void send_packet(const uint8_t* data, int n) = 0;
++ virtual void send_packet(const uint8_t* data, int n) = 0;
+ };
+
+
+ class PacketSink_File : public PacketSink
+ {
+ public:
+- LIBDE265_API PacketSink_File();
+- virtual LIBDE265_API ~PacketSink_File();
++ PacketSink_File();
++ virtual ~PacketSink_File();
+
+- LIBDE265_API void set_filename(const char* filename);
++ void set_filename(const char* filename);
+
+- virtual LIBDE265_API void send_packet(const uint8_t* data, int n);
++ virtual void send_packet(const uint8_t* data, int n);
+
+ private:
+ FILE* mFH;
+--- a/libde265/configparam.h
++++ b/libde265/configparam.h
+@@ -95,7 +95,7 @@
+ bool hasLongOption() const { return true; } //mLongOption!=NULL; }
+ std::string getLongOption() const { return mLongOption ? std::string(mLongOption) : get_name(); }
+
+- virtual LIBDE265_API bool processCmdLineArguments(char** argv, int* argc, int idx) { return false; }
++ virtual bool processCmdLineArguments(char** argv, int* argc, int idx) { return false; }
+
+
+
+@@ -132,7 +132,7 @@
+ virtual std::string get_default_string() const { return default_value ? "true":"false"; }
+
+ virtual std::string getTypeDescr() const { return "(boolean)"; }
+- virtual LIBDE265_API bool processCmdLineArguments(char** argv, int* argc, int idx) { set(true); return true; }
++ virtual bool processCmdLineArguments(char** argv, int* argc, int idx) { set(true); return true; }
+
+ bool set(bool v) { value_set=true; value=v; return true; }
+
+@@ -162,10 +162,10 @@
+ virtual bool has_default() const { return default_set; }
+
+ void set_default(std::string v) { default_value=v; default_set=true; }
+- virtual LIBDE265_API std::string get_default_string() const { return default_value; }
++ virtual std::string get_default_string() const { return default_value; }
+
+- virtual LIBDE265_API std::string getTypeDescr() const { return "(string)"; }
+- virtual LIBDE265_API bool processCmdLineArguments(char** argv, int* argc, int idx);
++ virtual std::string getTypeDescr() const { return "(string)"; }
++ virtual bool processCmdLineArguments(char** argv, int* argc, int idx);
+
+ bool set(std::string v) { value_set=true; value=v; return true; }
+
+@@ -201,10 +201,10 @@
+ virtual bool has_default() const { return default_set; }
+
+ void set_default(int v) { default_value=v; default_set=true; }
+- virtual LIBDE265_API std::string get_default_string() const;
++ virtual std::string get_default_string() const;
+
+- virtual LIBDE265_API std::string getTypeDescr() const;
+- virtual LIBDE265_API bool processCmdLineArguments(char** argv, int* argc, int idx);
++ virtual std::string getTypeDescr() const;
++ virtual bool processCmdLineArguments(char** argv, int* argc, int idx);
+
+ bool set(int v) {
+ if (is_valid(v)) { value_set=true; value=v; return true; }
+@@ -239,7 +239,7 @@
+ virtual std::vector<std::string> get_choice_names() const = 0;
+
+ virtual std::string getTypeDescr() const;
+- virtual LIBDE265_API bool processCmdLineArguments(char** argv, int* argc, int idx);
++ virtual bool processCmdLineArguments(char** argv, int* argc, int idx);
+
+ const char** get_choices_string_table() const;
+
+@@ -368,10 +368,10 @@
+ config_parameters() : param_string_table(NULL) { }
+ ~config_parameters() { delete[] param_string_table; }
+
+- void LIBDE265_API add_option(option_base* o);
++ void add_option(option_base* o);
+
+- void LIBDE265_API print_params() const;
+- bool LIBDE265_API parse_command_line_params(int* argc, char** argv, int* first_idx=NULL,
++ void print_params() const;
++ bool parse_command_line_params(int* argc, char** argv, int* first_idx=NULL,
+ bool ignore_unknown_options=false);
+
+
+--- a/libde265/quality.h
++++ b/libde265/quality.h
+@@ -26,11 +26,11 @@
+ #include <libde265/image.h>
+
+
+-LIBDE265_API uint32_t SSD(const uint8_t* img, int imgStride,
++uint32_t SSD(const uint8_t* img, int imgStride,
+ const uint8_t* ref, int refStride,
+ int width, int height);
+
+-LIBDE265_API uint32_t SAD(const uint8_t* img, int imgStride,
++uint32_t SAD(const uint8_t* img, int imgStride,
+ const uint8_t* ref, int refStride,
+ int width, int height);
+
+@@ -41,7 +41,7 @@
+ LIBDE265_API double PSNR(double mse);
+
+
+-LIBDE265_API uint32_t compute_distortion_ssd(const de265_image* img1, const de265_image* img2,
++uint32_t compute_distortion_ssd(const de265_image* img1, const de265_image* img2,
+ int x0, int y0, int log2size, int cIdx);
+
+ #endif
--- /dev/null
+Description: Don't update sps if they are only repeated
+Origin: https://github.com/strukturag/libde265/pull/372
+From 51f07f132f29832e025a8b913b61cbd20257c5fc Mon Sep 17 00:00:00 2001
+From: Tobias Frost <tobi@debian.org>
+Date: Fri, 13 Jan 2023 12:22:45 +0100
+Subject: [PATCH] Don't update sps if they are only repeated
+
+This is an attempt to improve the mitigations from #365 and #366 and picks up an idea I described at #345:
+
+> One way would be just to look at the pointers of the SPS (fast and easy, but
+> may reject more than required), or investigate if the SPS used for the image
+> generations are "compatible".
+
+This changes do exactly this: It (very conservativly) checks if the old and new sps have
+identical information -- except the reference picture set, which I believe is supposed
+to be updated by new sps'). If they are basically identical, the old sps will be
+used instead of the new one, (of course, reference image set is updated from the new one)
+
+I'm using standalone operator== and helper functions to avoid changing ABI of the library;
+if an ABI bump would be done, of course this should go to the respective classes.
+---
+ libde265/decctx.cc | 273 +++++++++++++++++++++++++++++++++++++++++++++
+ libde265/sps.cc | 6 +
+ 2 files changed, 279 insertions(+)
+
+diff --git a/libde265/decctx.cc b/libde265/decctx.cc
+index 6701725f..0000b25d 100644
+--- a/libde265/decctx.cc
++++ b/libde265/decctx.cc
+@@ -545,6 +545,263 @@ de265_error decoder_context::read_vps_NAL(bitreader& reader)
+ return DE265_OK;
+ }
+
++// implemented as freestanding functions to avoid changing API
++
++bool operator==(const profile_data &lhs, const profile_data &rhs) {
++ if(&lhs == &rhs) return true;
++ if(lhs.profile_present_flag != rhs.profile_present_flag ) return false;
++ if(lhs.profile_present_flag) {
++ if(lhs.profile_space != rhs.profile_space ) return false;
++ if(lhs.tier_flag != rhs.tier_flag ) return false;
++ if(lhs.profile_idc != rhs.profile_idc ) return false;
++
++ if(memcmp(lhs.profile_compatibility_flag, rhs.profile_compatibility_flag, sizeof(rhs.profile_compatibility_flag)) ) return false;
++
++ if(lhs.progressive_source_flag != rhs.progressive_source_flag ) return false;
++ if(lhs.interlaced_source_flag != rhs.interlaced_source_flag ) return false;
++ if(lhs.non_packed_constraint_flag != rhs.non_packed_constraint_flag ) return false;
++ if(lhs.frame_only_constraint_flag != rhs.frame_only_constraint_flag ) return false;
++ }
++
++ if(lhs.level_present_flag != rhs.level_present_flag) return false;
++ if(lhs.level_present_flag && lhs.level_idc != rhs.level_idc ) return false;
++
++ return true;
++}
++
++bool operator!=(const profile_data &lhs, const profile_data &rhs) {
++ if(&lhs == &rhs) return false;
++ return (!(lhs==rhs));
++}
++
++// class does not store max_sub_layers, so operator == cannot be done.
++bool isEqual(const profile_tier_level &lhs , const profile_tier_level &rhs, int sps_max_sub_layers ) {
++ if(&lhs == &rhs) return true;
++
++ if(lhs.general != rhs.general ) return false;
++ for(int i = 0 ; i < sps_max_sub_layers; i++ ) {
++ if(lhs.sub_layer[i] != rhs.sub_layer[i]) return false;
++ }
++ return true;
++}
++
++bool isEqual(const video_usability_information &lhs, const video_usability_information &rhs, const seq_parameter_set &sps) {
++ if(&lhs == &rhs) return true;
++
++ // not seen yet if(lhs.nal_hrd_parameters_present_flag != rhs.nal_hrd_parameters_present_flag ) return false;
++
++ // populated by video_usability_information::read()
++ if(lhs.aspect_ratio_info_present_flag != rhs.aspect_ratio_info_present_flag ) return false;
++ if(lhs.aspect_ratio_info_present_flag) {
++ if(lhs.sar_width != rhs.sar_width ) return false;
++ if(lhs.sar_height != rhs.sar_height ) return false;
++ }
++
++ if(lhs.overscan_info_present_flag != rhs.overscan_info_present_flag ) return false;
++ if(lhs.overscan_info_present_flag) {
++ if(lhs.overscan_appropriate_flag != rhs.overscan_appropriate_flag ) return false;
++ }
++
++ if(lhs.video_signal_type_present_flag != rhs.video_signal_type_present_flag ) return false;
++ if(lhs.video_signal_type_present_flag) {
++ if(lhs.video_format != rhs.video_format ) return false;
++ if(lhs.video_full_range_flag != rhs.video_full_range_flag) return false;
++ if(lhs.colour_description_present_flag != rhs.colour_description_present_flag) return false;
++ if(lhs.colour_primaries != rhs.colour_primaries ) return false;
++ if(lhs.transfer_characteristics != rhs.transfer_characteristics ) return false;
++ if(lhs.matrix_coeffs != rhs.matrix_coeffs ) return false;
++ }
++
++ if(lhs.chroma_loc_info_present_flag != rhs.chroma_loc_info_present_flag ) return false;
++ if(lhs.chroma_loc_info_present_flag) {
++ if(lhs.chroma_sample_loc_type_top_field != rhs.chroma_sample_loc_type_top_field ) return false;
++ if(lhs.chroma_sample_loc_type_bottom_field != rhs.chroma_sample_loc_type_bottom_field ) return false;
++ }
++ if(lhs.neutral_chroma_indication_flag != rhs.neutral_chroma_indication_flag ) return false;
++ if(lhs.field_seq_flag != rhs.field_seq_flag ) return false;
++ if(lhs.frame_field_info_present_flag != rhs.frame_field_info_present_flag ) return false;
++
++ if(lhs.default_display_window_flag != rhs.default_display_window_flag ) return false;
++ if(lhs.default_display_window_flag) {
++ if(lhs.def_disp_win_left_offset != rhs.def_disp_win_left_offset ) return false;
++ if(lhs.def_disp_win_right_offset != rhs.def_disp_win_right_offset ) return false;
++ if(lhs.def_disp_win_top_offset != rhs.def_disp_win_top_offset ) return false;
++ if(lhs.def_disp_win_bottom_offset != rhs.def_disp_win_bottom_offset ) return false;
++ }
++
++ if(lhs.vui_timing_info_present_flag != rhs.vui_timing_info_present_flag ) return false;
++ if(lhs.vui_timing_info_present_flag) {
++ if(lhs.vui_num_units_in_tick != rhs.vui_num_units_in_tick ) return false;
++ if(lhs.vui_time_scale != rhs.vui_time_scale ) return false;
++ if(lhs.vui_timing_info_present_flag != rhs.vui_timing_info_present_flag ) return false;
++ if(lhs.vui_timing_info_present_flag) {
++ if(lhs.vui_num_ticks_poc_diff_one != rhs.vui_num_ticks_poc_diff_one ) return false;
++ }
++ }
++
++ if(lhs.vui_hrd_parameters_present_flag != rhs.vui_hrd_parameters_present_flag ) return false;
++
++
++ if(lhs.vui_hrd_parameters_present_flag) {
++ // check things made by hrd_parametes
++
++ if(lhs.vui_hrd_parameters_present_flag != rhs.vui_hrd_parameters_present_flag ) return false;
++ if(lhs.vcl_hrd_parameters_present_flag != rhs.vcl_hrd_parameters_present_flag ) return false;
++
++ if(lhs.nal_hrd_parameters_present_flag || lhs.vcl_hrd_parameters_present_flag) {
++ if(lhs.sub_pic_hrd_params_present_flag != rhs.sub_pic_hrd_params_present_flag ) return false;
++ if(lhs.sub_pic_hrd_params_present_flag) {
++ if(lhs.tick_divisor_minus2 != rhs.tick_divisor_minus2 ) return false;
++ if(lhs.du_cpb_removal_delay_increment_length_minus1 != rhs.du_cpb_removal_delay_increment_length_minus1 ) return false;
++ if(lhs.sub_pic_cpb_params_in_pic_timing_sei_flag != rhs.sub_pic_cpb_params_in_pic_timing_sei_flag ) return false;
++ if(lhs.dpb_output_delay_du_length_minus1 != rhs.dpb_output_delay_du_length_minus1 ) return false;
++ }
++ if(lhs.bit_rate_scale != rhs.bit_rate_scale ) return false;
++ if(lhs.cpb_size_scale != rhs.cpb_size_scale ) return false;
++ if(lhs.sub_pic_hrd_params_present_flag) {
++ if(lhs.cpb_size_du_scale != rhs.cpb_size_du_scale ) return false;
++ }
++ if(lhs.initial_cpb_removal_delay_length_minus1 != rhs.initial_cpb_removal_delay_length_minus1 ) return false;
++ if(lhs.au_cpb_removal_delay_length_minus1 != rhs.au_cpb_removal_delay_length_minus1 ) return false;
++ if(lhs.dpb_output_delay_length_minus1 != rhs.dpb_output_delay_length_minus1 ) return false;
++ }
++
++ int i;
++ unsigned int j, nalOrVcl;
++
++ for (i = 0; i < sps.sps_max_sub_layers; i++) {
++ if(lhs.fixed_pic_rate_general_flag[i] != rhs.fixed_pic_rate_general_flag[i] ) return false;
++ if(lhs.fixed_pic_rate_general_flag[i]) {
++ if(lhs.elemental_duration_in_tc_minus1[i] != rhs.elemental_duration_in_tc_minus1[i] ) return false;
++ }
++ if(lhs.low_delay_hrd_flag[i] != rhs.low_delay_hrd_flag[i] ) return false;
++ if(lhs.cpb_cnt_minus1[i] != rhs.cpb_cnt_minus1[i] ) return false;
++
++ for (nalOrVcl = 0; nalOrVcl < 2; nalOrVcl++) {
++ if (((nalOrVcl == 0) && lhs.nal_hrd_parameters_present_flag) || ((nalOrVcl == 1) && lhs.vcl_hrd_parameters_present_flag)) {
++ for (j = 0; j <= lhs.cpb_cnt_minus1[i]; j++) {
++ if(lhs.bit_rate_value_minus1[i][j][nalOrVcl] != rhs.bit_rate_value_minus1[i][j][nalOrVcl]) return false;
++ if(lhs.cpb_size_value_minus1[i][j][nalOrVcl] != rhs.cpb_size_value_minus1[i][j][nalOrVcl]) return false;
++
++ if (lhs.sub_pic_hrd_params_present_flag) {
++ if(lhs.cpb_size_du_value_minus1[i][j][nalOrVcl] != rhs.cpb_size_du_value_minus1[i][j][nalOrVcl]) return false;
++ if(lhs.bit_rate_du_value_minus1[i][j][nalOrVcl] != rhs.bit_rate_du_value_minus1[i][j][nalOrVcl]) return false;
++ }
++ if( lhs.cbr_flag[i][j][nalOrVcl] != rhs.cbr_flag[i][j][nalOrVcl]) return false;
++ }
++ }
++ }
++ }
++ }
++ return true;
++}
++
++bool operator==(const sps_range_extension &lhs, const sps_range_extension &rhs) {
++ if(&lhs == &rhs) return true;
++ if(lhs.transform_skip_rotation_enabled_flag != rhs.transform_skip_rotation_enabled_flag ) return false;
++ if(lhs.transform_skip_context_enabled_flag != rhs.transform_skip_context_enabled_flag ) return false;
++ if(lhs.implicit_rdpcm_enabled_flag != rhs.implicit_rdpcm_enabled_flag ) return false;
++ if(lhs.explicit_rdpcm_enabled_flag != rhs.explicit_rdpcm_enabled_flag ) return false;
++ if(lhs.extended_precision_processing_flag != rhs.extended_precision_processing_flag ) return false;
++ if(lhs.intra_smoothing_disabled_flag != rhs.intra_smoothing_disabled_flag ) return false;
++ if(lhs.high_precision_offsets_enabled_flag != rhs.high_precision_offsets_enabled_flag ) return false;
++ if(lhs.persistent_rice_adaptation_enabled_flag != rhs.persistent_rice_adaptation_enabled_flag ) return false;
++ if(lhs.cabac_bypass_alignment_enabled_flag != rhs.cabac_bypass_alignment_enabled_flag ) return false;
++ return true;
++}
++
++bool operator!=(const sps_range_extension &lhs, const sps_range_extension &rhs) {
++ if(&lhs == &rhs) return false;
++ return !(lhs==rhs);
++}
++
++
++bool operator==(const seq_parameter_set &lhs, const seq_parameter_set &rhs) {
++
++ if(&lhs== &rhs) return true;
++
++ if(lhs.sps_read != rhs.sps_read) return false;
++
++ if(lhs.video_parameter_set_id != rhs.video_parameter_set_id) return false;
++ if(lhs.sps_max_sub_layers != rhs.sps_max_sub_layers) return false;
++ if(lhs.sps_temporal_id_nesting_flag != rhs.sps_temporal_id_nesting_flag) return false;
++
++ if(!isEqual(lhs.profile_tier_level_, rhs.profile_tier_level_, lhs.sps_max_sub_layers)) return false;
++
++ if(lhs.seq_parameter_set_id != rhs.seq_parameter_set_id) return false;
++ if(lhs.chroma_format_idc != rhs.chroma_format_idc) return false;
++
++ if(lhs.separate_colour_plane_flag != rhs.separate_colour_plane_flag) return false;
++ if(lhs.pic_width_in_luma_samples != rhs.pic_width_in_luma_samples) return false;
++ if(lhs.pic_height_in_luma_samples != rhs.pic_height_in_luma_samples) return false;
++ if(lhs.conformance_window_flag != rhs.conformance_window_flag) return false;
++
++ if(lhs.conformance_window_flag) {
++ if(lhs.conf_win_left_offset != rhs.conf_win_left_offset) return false;
++ if(lhs.conf_win_right_offset != rhs.conf_win_right_offset) return false;
++ if(lhs.conf_win_top_offset != rhs.conf_win_top_offset) return false;
++ if(lhs.conf_win_bottom_offset != rhs.conf_win_bottom_offset) return false;
++ }
++
++ if(lhs.bit_depth_luma != rhs.bit_depth_luma) return false;
++ if(lhs.bit_depth_chroma != rhs.bit_depth_chroma) return false;
++
++ if(lhs.log2_max_pic_order_cnt_lsb != rhs.log2_max_pic_order_cnt_lsb) return false;
++ if(lhs.sps_sub_layer_ordering_info_present_flag != rhs.sps_sub_layer_ordering_info_present_flag) return false;
++
++ if(memcmp(lhs.sps_max_dec_pic_buffering, rhs.sps_max_dec_pic_buffering, sizeof(rhs.sps_max_dec_pic_buffering))) return false;
++ if(memcmp(lhs.sps_max_num_reorder_pics, rhs.sps_max_num_reorder_pics, sizeof(rhs.sps_max_num_reorder_pics))) return false;
++ if(memcmp(lhs.sps_max_latency_increase_plus1, rhs.sps_max_latency_increase_plus1, sizeof(rhs.sps_max_latency_increase_plus1))) return false;
++
++ if(lhs.log2_min_luma_coding_block_size != rhs.log2_min_luma_coding_block_size) return false;
++ if(lhs.log2_diff_max_min_luma_coding_block_size != rhs.log2_diff_max_min_luma_coding_block_size) return false;
++ if(lhs.log2_min_transform_block_size != rhs.log2_min_transform_block_size) return false;
++ if(lhs.log2_diff_max_min_transform_block_size != rhs.log2_diff_max_min_transform_block_size) return false;
++ if(lhs.max_transform_hierarchy_depth_inter != rhs.max_transform_hierarchy_depth_inter) return false;
++ if(lhs.max_transform_hierarchy_depth_intra != rhs.max_transform_hierarchy_depth_intra) return false;
++
++ if(lhs.scaling_list_enable_flag != rhs.scaling_list_enable_flag) return false;
++ if(lhs.scaling_list_enable_flag) {
++ if(lhs.sps_scaling_list_data_present_flag != rhs.sps_scaling_list_data_present_flag) return false;
++ if(lhs.sps_scaling_list_data_present_flag) {
++ // compare only needed if present, otherwise it is the default scaling list.
++ if(memcmp(&lhs.scaling_list, &rhs.scaling_list, sizeof(rhs.scaling_list))) return false;
++ }
++ }
++
++ if(lhs.amp_enabled_flag != rhs.amp_enabled_flag) return false;
++ if(lhs.sample_adaptive_offset_enabled_flag != rhs.sample_adaptive_offset_enabled_flag) return false;
++ if(lhs.pcm_enabled_flag != rhs.pcm_enabled_flag) return false;
++
++ if(lhs.pcm_enabled_flag) {
++ if(lhs.pcm_sample_bit_depth_luma != rhs.pcm_sample_bit_depth_luma) return false;
++ if(lhs.pcm_sample_bit_depth_chroma != rhs.pcm_sample_bit_depth_chroma) return false;
++ if(lhs.log2_min_pcm_luma_coding_block_size != rhs.log2_min_pcm_luma_coding_block_size) return false;
++ if(lhs.log2_diff_max_min_pcm_luma_coding_block_size != rhs.log2_diff_max_min_pcm_luma_coding_block_size) return false;
++ if(lhs.pcm_loop_filter_disable_flag != rhs.pcm_loop_filter_disable_flag) return false;
++ }
++
++ // (longterm) reference pics likely to change with a new sps, so ignored here.
++
++ if(lhs.sps_temporal_mvp_enabled_flag != rhs.sps_temporal_mvp_enabled_flag) return false;
++ if(lhs.strong_intra_smoothing_enable_flag != rhs.strong_intra_smoothing_enable_flag) return false;
++
++ if(lhs.vui_parameters_present_flag != rhs.vui_parameters_present_flag) return false;
++ if(lhs.vui_parameters_present_flag) {
++ if(!isEqual(lhs.vui, rhs.vui, lhs )) return false;
++ }
++
++ if(lhs.sps_extension_present_flag != rhs.sps_extension_present_flag ) return false;
++ if(lhs.sps_extension_present_flag) {
++ if(lhs.sps_range_extension_flag != rhs.sps_range_extension_flag ) return false;
++ if(lhs.sps_multilayer_extension_flag != rhs.sps_multilayer_extension_flag ) return false;
++ if(lhs.sps_extension_6bits != rhs.sps_extension_6bits ) return false;
++ if(lhs.range_extension != rhs.range_extension) return false;
++ }
++
++ return true;
++}
++
+ de265_error decoder_context::read_sps_NAL(bitreader& reader)
+ {
+ logdebug(LogHeaders,"----> read SPS\n");
+@@ -560,6 +817,22 @@ de265_error decoder_context::read_sps_NAL(bitreader& reader)
+ new_sps->dump(param_sps_headers_fd);
+ }
+
++ if ( sps[ new_sps->seq_parameter_set_id ] ) {
++ auto old_sps = sps[ new_sps->seq_parameter_set_id ].get();
++ if ( *old_sps == *new_sps ) {
++ // printf(" **** keeping sps *****\n");
++ // the new sps is identical to the old one, so no replacing needed.
++ // however, reference pics and long-term reference pics might need updating.
++ old_sps->ref_pic_sets = new_sps->ref_pic_sets;
++ old_sps->long_term_ref_pics_present_flag = new_sps->long_term_ref_pics_present_flag;
++ memcpy(old_sps->lt_ref_pic_poc_lsb_sps, new_sps->lt_ref_pic_poc_lsb_sps, sizeof(old_sps->lt_ref_pic_poc_lsb_sps));
++ memcpy(old_sps->used_by_curr_pic_lt_sps_flag, new_sps->used_by_curr_pic_lt_sps_flag, sizeof(old_sps->used_by_curr_pic_lt_sps_flag));
++ return DE265_OK;
++ }
++ //printf(" **** replacing sps *****\n");
++
++ }
++
+ sps[ new_sps->seq_parameter_set_id ] = new_sps;
+
+ // Remove the all PPS that referenced the old SPS because parameters may have changed and we do not want to
+diff --git a/libde265/sps.cc b/libde265/sps.cc
+index f1c28255..31ce9470 100644
+--- a/libde265/sps.cc
++++ b/libde265/sps.cc
+@@ -287,6 +287,11 @@ de265_error seq_parameter_set::read(error_queue* errqueue, bitreader* br)
+ int firstLayer = (sps_sub_layer_ordering_info_present_flag ?
+ 0 : sps_max_sub_layers-1 );
+
++ // zero out so that comparing is easier.
++ memset(sps_max_dec_pic_buffering, 0 , sizeof(sps_max_dec_pic_buffering));
++ memset(sps_max_num_reorder_pics, 0 , sizeof(sps_max_num_reorder_pics));
++ memset(sps_max_latency_increase_plus1, 0 , sizeof(sps_max_latency_increase_plus1));
++
+ for (int i=firstLayer ; i <= sps_max_sub_layers-1; i++ ) {
+
+ // sps_max_dec_pic_buffering[i]
+@@ -347,6 +352,7 @@ de265_error seq_parameter_set::read(error_queue* errqueue, bitreader* br)
+ if (sps_scaling_list_data_present_flag) {
+
+ de265_error err;
++ memset(&scaling_list, 0 , sizeof(scaling_list)); // zero out, so that memcmp will do it to check for equality.
+ if ((err=read_scaling_list(br,this, &scaling_list, false)) != DE265_OK) {
+ return err;
+ }
--- /dev/null
+Description: Try to mitigate asan failures by rejecting reference pictures not created with the same sps.
+ The reference images might have different parameters (size, pixel depth, etc) and so different memory allocations,
+ leading to out of bound memory reads and writes.
+Origin: https://github.com/strukturag/libde265/pull/365
+Comment: Analysis of issue https://github.com/strukturag/libde265/issues/345#issuecomment-1346406079
+From 97dd15303085eae2695a511717bf3239e209df96 Mon Sep 17 00:00:00 2001
+From: Tobias Frost <tobi@debian.org>
+Date: Mon, 12 Dec 2022 14:03:12 +0100
+Subject: [PATCH] Try to mitigate asan failures.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+See #345 for my analysis and details…
+
+(This PR is just for discussion.)
+
+(The CVE references are obtained from the Debian security tracker,
+which links the issues.)
+
+This makes the following POCs stop failing:
+
+- poc3 (#337)
+- poc7-1 (#341) CVE-2022-43239 (note: does NOT fix poc7-2)
+- poc8-2, poc8-3, poc8-4 (#342) CVE-2022-43244 (note: does NOT fix poc8-1)
+- poc11-1, poc11-2 (#345) CVE-2022-43249
+- poc12 (#346)
+- poc13 (#347) CVE-2022-43252
+- poc16 (#350)
+---
+ libde265/motion.cc | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+Index: libde265/libde265/motion.cc
+===================================================================
+--- libde265.orig/libde265/motion.cc
++++ libde265/libde265/motion.cc
+@@ -361,6 +361,16 @@ void generate_inter_prediction_samples(b
+
+ logtrace(LogMotion, "refIdx: %d -> dpb[%d]\n", vi->refIdx[l], shdr->RefPicList[l][vi->refIdx[l]]);
+
++ if (refPic) {
++ auto nonconst_refPic = const_cast<de265_image*>(refPic); /* shared_ptr.get() chokes on const.*/
++ auto refsps = nonconst_refPic->get_shared_sps().get();
++ auto imgsps = img->get_shared_sps().get();
++ if(refsps != imgsps) {
++ // rejecting reference image created with different sps.
++ refPic = nullptr;
++ }
++ }
++
+ if (!refPic || refPic->PicState == UnusedForReference) {
+ img->integrity = INTEGRITY_DECODING_ERRORS;
+ ctx->add_warning(DE265_WARNING_NONEXISTING_REFERENCE_PICTURE_ACCESSED, false);
--- /dev/null
+only_export_decoder_api.patch
+disable_tools.patch
+reject_reference_pics_from_different_sps.patch
+use_sps_from_the_image.patch
+recycle_sps_if_possible.patch
+
+CVE-2023-27102.patch
+CVE-2023-27103.patch
+CVE-2023-43887.patch
+CVE-2023-47471.patch
+
+CVE-2023-49465.patch
+CVE-2023-49467.patch
+CVE-2023-49468.patch
+
+CVE-2023-51792.patch
+CVE-2026-33164+33165.patch
+CVE-2024-38949+CVE-2024-38950.patch
+CVE-2026-45382.patch
+CVE-2026-45383.patch
+CVE-2026-49295.patch
+CVE-2026-49337.patch
+CVE-2026-49346.patch
+CVE-2026-54240_CVE-2026-54241.patch
+TEMP-0000000-BB5891.patch
+TEMP-0000000-E66AA0.patch
--- /dev/null
+Description: Use sps of the image, not the sps of the pic parameter set (pps)
+ When decoding a slice, all decoding functions are using the sps of the target
+ image to determine the image properties, which are in the seqquence parameter
+ set) -- execpt generate_inter_prediction_samples(), which uses the sps from the
+ pps, which might have different properties and trick the decode to out-of-bound
+ memory accesses, leading to crashes.
+Origin: https://github.com/strukturag/libde265/pull/366
+From 36391cda3d4e4fb3269a2ce310e6e0f634729f0b Mon Sep 17 00:00:00 2001
+From: Tobias Frost <tobi@debian.org>
+Date: Mon, 12 Dec 2022 14:33:40 +0100
+Subject: [PATCH] Use the sps from the image
+
+(as e.g mc_chroma is using the sps to determine
+picture properties, like pic_width_in_luma_samples
+and pic_height_in_luma_samples, I *think* this is
+more correct.
+
+This PR is for discussion. (See #345.)
+It makes the failures go away, but that does not mean it's correct :)
+
+The following poc will be stop failing if (only) this
+patch is applied:
+
+ - poc2 #336 - CVE-2022-43238
+ - poc4 #338 - CVE-2022-43241
+ - poc6-1, poc6-2 #340 - CVE-2022-43242
+ - poc7-1, poc7-2 #341 - CVE-2022-43239
+ - poc8-1 #342 - CVE-2022-43244
+ - poc9-3 #343 - CVE-2022-43236
+ - poc10-2, poc10-3 #344 - CVE-2022-43237
+ - poc16 #350
+ - poc19 #353
+
+The following are still failing if only this patch is
+applied, but they stop failing if #365 is applied as well, but will
+still fail with ONLY #365 applied (IOW, both are needed)
+
+ - poc1 #335 - CVE-2022-43240
+ - poc3 #337 - CVE-2022-43235
+ - poc5 #339 - CVE-2022-43423
+ - poc9-1,poc9-2, poc9-4 #343 - CVE-2022-43236
+ - poc14 #348 - CVE-2022-43253
+ - poc15 #349 - CVE-2022-43248
+ - poc17-1, poc17-2 #351
+ - poc18 #352 - CVE-2022-43245
+---
+ libde265/motion.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: libde265/libde265/motion.cc
+===================================================================
+--- libde265.orig/libde265/motion.cc
++++ libde265/libde265/motion.cc
+@@ -290,7 +290,7 @@ void generate_inter_prediction_samples(b
+ int stride[3];
+
+ const pic_parameter_set* pps = shdr->pps.get();
+- const seq_parameter_set* sps = pps->sps.get();
++ const seq_parameter_set* sps = img->get_shared_sps().get();
+
+ if (sps->BitDepth_Y != img->get_bit_depth(0) ||
+ sps->BitDepth_C != img->get_bit_depth(1)) {
--- /dev/null
+#!/usr/bin/make -f
+#export DH_VERBOSE=1
+
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+
+%:
+ dh $@
+
+override_dh_auto_install:
+ dh_auto_install
+ cd $(CURDIR)/debian/tmp/usr/bin/ && mv dec265 libde265-dec265
+ if [ -e "$(CURDIR)/debian/tmp/usr/bin/sherlock265" ]; then \
+ cd $(CURDIR)/debian/tmp/usr/bin/ && mv sherlock265 \
+ libde265-sherlock265; \
+ fi
--- /dev/null
+3.0 (quilt)
--- /dev/null
+Bug-Database: https://github.com/strukturag/libde265/issues
+Repository: https://github.com/strukturag/libde265.git
+Repository-Browse: https://github.com/strukturag/libde265
+Bug-Submit: https://github.com/strukturag/libde265/issues/new
--- /dev/null
+version=3
+opts=filenamemangle=s/.+\/v?(\d\S*)\.tar\.gz/libde265-$1\.tar\.gz/,\
+downloadurlmangle=s/.+\/v?(\d\S*)\.tar\.gz/https:\/\/github\.com\/strukturag\/libde265\/releases\/download\/v$1\/libde265-$1\.tar\.gz/ \
+ https://github.com/strukturag/libde265/tags .*/v?(\d\S*)\.tar\.gz
projects / libde265.git / commitdiff