CVE-2026-45382: fix CTB OOB access when pps.sps mismatches active sps

Origin: upstream, https://github.com/strukturag/libde265/commit/c33b4f63ae9056b00f34a31874fed55cd0aa29c9
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9
Applied-Upstream: 1.0.19

Malformed PPS data creates an out-of-bounds index into the CtbAddrRStoTS
array, causing a heap-buffer-overflow read in decode_slice_unit_tiles.

Gbp-Pq: Name CVE-2026-45382.patch

diff --git a/libde265/decctx.cc b/libde265/decctx.cc
index 7c758fcb279e856977c8dbb0ea4645b5bdad8ea0..ea2e2136b6aaa162acbe41edc2059b046b4823ea 100644 (file)
--- a/libde265/decctx.cc
+++ b/libde265/decctx.cc
@@ -1317,6 +1317,11 @@ de265_error decoder_context::decode_slice_unit_WPP(image_unit* imgunit,
     tctx->img     = img;
     tctx->imgunit = imgunit;
     tctx->sliceunit= sliceunit;
+
+    if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
+      err = DE265_WARNING_SLICEHEADER_INVALID;
+      break;
+    }
     tctx->CtbAddrInTS = pps.CtbAddrRStoTS[ctbAddrRS];
 
     init_thread_context(tctx);
@@ -1394,6 +1399,12 @@ de265_error decoder_context::decode_slice_unit_tiles(image_unit* imgunit,
 
   // first CTB in this slice
   int ctbAddrRS = shdr->slice_segment_address;
+
+  // pps.TileIdRS and pps.CtbAddrRStoTS are both sized to PicSizeInCtbsY in
+  // set_derived_values(), so one bound covers both accesses below.
+  if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
+    return DE265_WARNING_SLICEHEADER_INVALID;
+  }
   int tileID = pps.TileIdRS[ctbAddrRS];
 
   for (int entryPt=0;entryPt<nTiles;entryPt++) {
@@ -1409,6 +1420,11 @@ de265_error decoder_context::decode_slice_unit_tiles(image_unit* imgunit,
       int ctbX = pps.colBd[tileID % pps.num_tile_columns];
       int ctbY = pps.rowBd[tileID / pps.num_tile_columns];
       ctbAddrRS = ctbY * ctbsWidth + ctbX;
+
+      if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
+        err = DE265_WARNING_SLICEHEADER_INVALID;
+        break;
+      }
     }
 
     // set thread context