From: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Date: Sun, 20 Sep 2026 11:47:08 +0000 (+0200)
Subject: CVE-2023-51792: check validity of conformance window parameters
X-Git-Tag: archive/raspbian/1.0.11-1+rpi1+deb12u3^2~11
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=19da41b9f8c7b25cd226804c21564e0e8ac8cc88;p=libde265.git

CVE-2023-51792: check validity of conformance window parameters

Origin: https://github.com/strukturag/libde265/commit/221e767136b8c46c748ae35b79ec9b976b3da301

Imported from 1.0.11-0+deb11u4
(cherry picked from commit 221e767136b8c46c748ae35b79ec9b976b3da301)

Gbp-Pq: Name CVE-2023-51792.patch
---

diff --git a/libde265/image.cc b/libde265/image.cc
index 39813b0..057705c 100644
--- a/libde265/image.cc
+++ b/libde265/image.cc
@@ -330,6 +330,14 @@ de265_error de265_image::alloc_image(int w,int h, enum de265_chroma c,
   int top    = sps ? sps->conf_win_top_offset : 0;
   int bottom = sps ? sps->conf_win_bottom_offset : 0;
 
+  if ((left+right)*WinUnitX >= width) {
+    return DE265_ERROR_CODED_PARAMETER_OUT_OF_RANGE;
+  }
+
+  if ((top+bottom)*WinUnitX >= height) {
+    return DE265_ERROR_CODED_PARAMETER_OUT_OF_RANGE;
+  }
+
   width_confwin = width - (left+right)*WinUnitX;
   height_confwin= height- (top+bottom)*WinUnitY;
   chroma_width_confwin = chroma_width -left-right;