CVE-2026-33164 + CVE-2026-33165: fix reallocation of metadata array...

Origin: https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg (CVE-2026-33165)
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r (CVE-2026-33164)
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131468 (CVE-2026-33165)
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131469 (CVE-2026-33164)

Imported from 1.0.11-0+deb11u4
(cherry picked from commit c7891e412106130b83f8e8ea8b7f907e9449b658)

Gbp-Pq: Name CVE-2026-33164+33165.patch

diff --git a/libde265/image.cc b/libde265/image.cc
index 057705ce1112fab75180c27f0ffd4fb5bb7cdb66..a376aaa3b1e5f02a0a7a6ad292f378c388023ca9 100644 (file)
--- a/libde265/image.cc
+++ b/libde265/image.cc
@@ -453,8 +453,9 @@ de265_error de265_image::alloc_image(int w,int h, enum de265_chroma c,
 
     // CTB info
 
-    if (ctb_info.width_in_units != sps->PicWidthInCtbsY ||
-        ctb_info.height_in_units != sps->PicHeightInCtbsY)
+    if (ctb_info.width_in_units  != sps->PicWidthInCtbsY  ||
+        ctb_info.height_in_units != sps->PicHeightInCtbsY ||
+        ctb_info.log2unitSize    != sps->Log2CtbSizeY)
       {
         delete[] ctb_progress;
 

diff --git a/libde265/image.h b/libde265/image.h
index 0a0c0e3225fe92463e8c1a4ff725e3f80c0e170e..7908fe3538598ff699e66e7c2d8ac78c5890986b 100644 (file)
--- a/libde265/image.h
+++ b/libde265/image.h
@@ -149,7 +149,7 @@ template <class DataUnit> class MetaDataArray
   // private:
   DataUnit* data;
   int data_size;
-  int log2unitSize;
+  uint8_t log2unitSize;
   int width_in_units;
   int height_in_units;
 };