From: Sebastian Dröge <sebastian@centricular.com>
Date: Tue, 9 Jun 2026 06:40:41 +0000 (+0300)
Subject: [PATCH] vajpegdecoder: Validate that enough data is available for the current JPEG... 
X-Git-Tag: archive/raspbian/1.26.2-3+rpi1+deb13u2^2~2
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=38a019511c535b5f7145afdb5763d9327f47bc94;p=gst-plugins-bad1.0.git

[PATCH] vajpegdecoder: Validate that enough data is available for the current JPEG segment


Gbp-Pq: Name CVE-2026-52719.patch
---

diff --git a/sys/va/gstjpegdecoder.c b/sys/va/gstjpegdecoder.c
index 2448c3cb..3fccf039 100644
--- a/sys/va/gstjpegdecoder.c
+++ b/sys/va/gstjpegdecoder.c
@@ -370,6 +370,18 @@ _get_marker_name (guint marker)
 }
 #endif
 
+static gboolean
+jpeg_segment_fits_input (const GstJpegSegment * seg, gsize size)
+{
+  if (seg->size < 0)
+    return FALSE;
+
+  if ((gsize) seg->offset > size)
+    return FALSE;
+
+  return (gsize) seg->size <= size - (gsize) seg->offset;
+}
+
 static GstFlowReturn
 gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
     GstVideoCodecFrame * frame)
@@ -399,6 +411,9 @@ gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
     if (!gst_jpeg_parse (&seg, map.data, map.size, offset))
       goto unmap_and_error;
 
+    if (!jpeg_segment_fits_input (&seg, map.size))
+      goto unmap_and_error;
+
     offset = seg.offset + seg.size;
     marker = seg.marker;
 
@@ -445,6 +460,9 @@ gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
           if (!gst_jpeg_parse (&seg_scan, map.data, map.size, offset))
             goto unmap_and_error;
 
+          if (!jpeg_segment_fits_input (&seg_scan, map.size))
+            goto unmap_and_error;
+
           if (seg_scan.marker < GST_JPEG_MARKER_RST_MIN
               || seg_scan.marker > GST_JPEG_MARKER_RST_MAX)
             break;