CVE-2026-45383: prevent reading past end of CtbAddrRStoTS[] in WPP images

Origin: upstream, https://github.com/strukturag/libde265/commit/d1a2c3b4b751d21f44e8e82220fe9766c9d116ff
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38
Applied-Upstream: 1.0.19

In the WPP slice decoder ctbAddrRS = ctbRow * ctbsWidth can exceed the
allocated vector size, causing out-of-bounds reads.

Gbp-Pq: Name CVE-2026-45383.patch

diff --git a/libde265/decctx.cc b/libde265/decctx.cc
index 8820b1eab2e26f539bda266b388d675c055af6ec..55e4f49495e49c1c60555e2f78abe6b490235a71 100644 (file)
--- a/libde265/decctx.cc
+++ b/libde265/decctx.cc
@@ -1290,6 +1290,10 @@ de265_error decoder_context::decode_slice_unit_WPP(image_unit* imgunit,
   int ctbAddrRS = shdr->slice_segment_address;
   int ctbRow    = ctbAddrRS / ctbsWidth;
 
+  if (ctbRow + nRows > img->get_sps().PicHeightInCtbsY) {
+    return DE265_WARNING_SLICEHEADER_INVALID;
+  }
+
   for (int entryPt=0;entryPt<nRows;entryPt++) {
     // entry points other than the first start at CTB rows
     if (entryPt>0) {