From: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Date: Sun, 20 Sep 2026 11:47:08 +0000 (+0200)
Subject: CVE-2026-45382: Heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated... 
X-Git-Tag: archive/raspbian/1.0.11-1+rpi1+deb12u3^2~8
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=04dc81994856239a6c0b65d92ffa43ff14391726;p=libde265.git

CVE-2026-45382: Heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometry

Origin: https://github.com/strukturag/libde265/commit/c33b4f63ae9056b00f34a31874fed55cd0aa29c9
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9

From c33b4f63ae9056b00f34a31874fed55cd0aa29c9 Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Sun, 10 May 2026 19:57:18 +0200
Subject: [PATCH] fix CTB OOB access when pps.sps mismatches active sps
 (GHSA-hwhx-x2mq-ccr9)


Gbp-Pq: Name CVE-2026-45382.patch
---

diff --git a/libde265/decctx.cc b/libde265/decctx.cc
index 0747c69..8820b1e 100644
--- a/libde265/decctx.cc
+++ b/libde265/decctx.cc
@@ -1316,6 +1316,11 @@ de265_error decoder_context::decode_slice_unit_WPP(image_unit* imgunit,
     tctx->img     = img;
     tctx->imgunit = imgunit;
     tctx->sliceunit= sliceunit;
+
+    if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
+      err = DE265_WARNING_SLICEHEADER_INVALID;
+      break;
+    }
     tctx->CtbAddrInTS = pps.CtbAddrRStoTS[ctbAddrRS];
 
     init_thread_context(tctx);
@@ -1393,6 +1398,12 @@ de265_error decoder_context::decode_slice_unit_tiles(image_unit* imgunit,
 
   // first CTB in this slice
   int ctbAddrRS = shdr->slice_segment_address;
+
+  // pps.TileIdRS and pps.CtbAddrRStoTS are both sized to PicSizeInCtbsY in
+  // set_derived_values(), so one bound covers both accesses below.
+  if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
+    return DE265_WARNING_SLICEHEADER_INVALID;
+  }
   int tileID = pps.TileIdRS[ctbAddrRS];
 
   for (int entryPt=0;entryPt<nTiles;entryPt++) {
@@ -1408,6 +1419,11 @@ de265_error decoder_context::decode_slice_unit_tiles(image_unit* imgunit,
       int ctbX = pps.colBd[tileID % pps.num_tile_columns];
       int ctbY = pps.rowBd[tileID / pps.num_tile_columns];
       ctbAddrRS = ctbY * ctbsWidth + ctbX;
+
+      if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
+        err = DE265_WARNING_SLICEHEADER_INVALID;
+        break;
+      }
     }
 
     // set thread context