[PATCH] h266parser: Fix out of bounds write when parsing pic_timing SEI

Gbp-Pq: Name CVE-2026-3081.patch

diff --git a/gst-libs/gst/codecparsers/gsth266parser.c b/gst-libs/gst/codecparsers/gsth266parser.c
index 3da42e9492de588eb88343ba1a9eaa7e7ac29cc5..7649e2ca0627a566d68a68bd1ff88a2bec376b38 100644 (file)
--- a/gst-libs/gst/codecparsers/gsth266parser.c
+++ b/gst-libs/gst/codecparsers/gsth266parser.c
@@ -1460,7 +1460,8 @@ gst_h266_parser_parse_pic_timing (GstH266PicTiming * pt,
 
   if (bp->du_hrd_params_present_flag &&
       bp->du_cpb_params_in_pic_timing_sei_flag) {
-    READ_UE (nr, pt->num_decoding_units_minus1);
+    READ_UE_MAX (nr, pt->num_decoding_units_minus1,
+        GST_H266_MAX_DECODING_UNITS_IN_PIC_TIMING - 1);
     if (pt->num_decoding_units_minus1 > 0) {
       READ_UINT8 (nr, pt->du_common_cpb_removal_delay_flag, 1);
       if (pt->du_common_cpb_removal_delay_flag) {

diff --git a/gst-libs/gst/codecparsers/gsth266parser.h b/gst-libs/gst/codecparsers/gsth266parser.h
index a9df8d86c725ca554f5aee168c8fa27c1d3acf0a..ddcce29bf88ce1f9cfbd27711dbe2c1add245c85 100644 (file)
--- a/gst-libs/gst/codecparsers/gsth266parser.h
+++ b/gst-libs/gst/codecparsers/gsth266parser.h
@@ -105,6 +105,11 @@ G_BEGIN_DECLS
    The min coding block size is 8, so min width or height is 8.
    The min CTU size is 32. */
 #define GST_H266_MAX_CTUS_IN_PICTURE (80216064 / 8 / 32)
+/* Practical limit for number of decoding units per picture.
+   The spec allows up to PicSizeInCtbsY which could be very large,
+   but 600 is a reasonable practical limit matching the array sizes
+   in GstH266PicTiming. */
+#define GST_H266_MAX_DECODING_UNITS_IN_PIC_TIMING 600
 
 /**
  * GST_H266_IS_NAL_TYPE_IDR:
@@ -3066,8 +3071,8 @@ struct _GstH266PicTiming {
   guint8 du_common_cpb_removal_delay_flag;
   guint8 du_common_cpb_removal_delay_increment_minus1[8];
   /* TODO: PicSizeInCtbsY could be very large */
-  guint32 num_nalus_in_du_minus1[600];
-  guint8 du_cpb_removal_delay_increment_minus1[600][8];
+  guint32 num_nalus_in_du_minus1[GST_H266_MAX_DECODING_UNITS_IN_PIC_TIMING];
+  guint8 du_cpb_removal_delay_increment_minus1[GST_H266_MAX_DECODING_UNITS_IN_PIC_TIMING][8];
   guint8 delay_for_concatenation_ensured_flag;
   guint8 display_elemental_periods_minus1;
 };