From: Tobias Frost Date: Sun, 20 Sep 2026 11:47:08 +0000 (+0200) Subject: libde265 (1.0.11-1+deb12u3) bookworm-security; urgency=high X-Git-Tag: archive/raspbian/1.0.11-1+rpi1+deb12u3^2~24 X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=75e22aeda74cd48c2a239fd548ffaa1f5cae15f1;p=libde265.git libde265 (1.0.11-1+deb12u3) bookworm-security; urgency=high * Non-maintainer upload by the LTS Team. * Backport fixes for: - CVE-2023-51792 - Buffer-Overflow - CVE-2026-33164 - DoS (crash) (Closes: #1131469) - CVE-2026-33165 - heap out-of-bounds write (Closes: #1131468) - CVE-2024-38949 - Heap Buffer Overflow (Closes: #1074416) - CVE-2024-38950 - Heap Buffer Overflow (same bug/patch as 2024-38949) - CVE-2024-45382 - Heap Buffer Read Overflow - CVE-2026-45383 - Heap Buffer Read Overflow - CVE-2026-49295 - Out-of-bounds write (Closes: #1140431) - CVE-2026-49337 - Unbounded memory accumulation (also #1140431) - CVE-2026-49346 - Heap buffer overflow (also #1140431) - CVE-2026-54240 - Heap Buffer Overflow - CVE-2026-54241 - Heap Buffer Overflow * Backport security fixes without CVE assigned yet: - GHSA-xp3h-6f5r-8cxp - Use after free / double free in concurrent execution enviornments (race conditions) - GHSA-mm7m-v26f-wf8x - heap-use-after-free [dgit import unpatched libde265 1.0.11-1+deb12u3] --- 75e22aeda74cd48c2a239fd548ffaa1f5cae15f1 diff --cc debian/.gitlab-ci.yml index 0000000,0000000..973f6d9 new file mode 100644 --- /dev/null +++ b/debian/.gitlab-ci.yml @@@ -1,0 -1,0 +1,14 @@@ ++# Copyright salsa-ci-team and others ++# SPDX-License-Identifier: FSFAP ++# Copying and distribution of this file, with or without modification, are ++# permitted in any medium without royalty provided the copyright notice and ++# this notice are preserved. This file is offered as-is, without any warranty. ++ ++include: ++ - https://salsa.debian.org/lts-team/pipeline/raw/master/vars/base.yml ++ ++variables: ++ RELEASE: 'bookworm' ++ SALSA_CI_DISABLE_LINTIAN: 1 ++ SALSA_CI_DISABLE_PIUPARTS: 1 ++ SALSA_CI_DISABLE_REPROTEST: 1 diff --cc debian/changelog index 0000000,0000000..1f4cc63 new file mode 100644 --- /dev/null +++ b/debian/changelog @@@ -1,0 -1,0 +1,229 @@@ ++libde265 (1.0.11-1+deb12u3) bookworm-security; urgency=high ++ ++ * Non-maintainer upload by the LTS Team. ++ * Backport fixes for: ++ - CVE-2023-51792 - Buffer-Overflow ++ - CVE-2026-33164 - DoS (crash) (Closes: #1131469) ++ - CVE-2026-33165 - heap out-of-bounds write (Closes: #1131468) ++ - CVE-2024-38949 - Heap Buffer Overflow (Closes: #1074416) ++ - CVE-2024-38950 - Heap Buffer Overflow (same bug/patch as 2024-38949) ++ - CVE-2024-45382 - Heap Buffer Read Overflow ++ - CVE-2026-45383 - Heap Buffer Read Overflow ++ - CVE-2026-49295 - Out-of-bounds write (Closes: #1140431) ++ - CVE-2026-49337 - Unbounded memory accumulation (also #1140431) ++ - CVE-2026-49346 - Heap buffer overflow (also #1140431) ++ - CVE-2026-54240 - Heap Buffer Overflow ++ - CVE-2026-54241 - Heap Buffer Overflow ++ * Backport security fixes without CVE assigned yet: ++ - GHSA-xp3h-6f5r-8cxp - Use after free / double free ++ in concurrent execution enviornments (race conditions) ++ - GHSA-mm7m-v26f-wf8x - heap-use-after-free ++ ++ -- Tobias Frost Sun, 20 Sep 2026 13:47:08 +0200 ++ ++libde265 (1.0.11-1+deb12u2) bookworm; urgency=medium ++ ++ * Non-maintainer upload by the LTS Team. ++ (Closes: #1059275) ++ * CVE-2023-49465 ++ heap-buffer-overflow in derive_spatial_luma_vector_prediction() ++ * CVE-2023-49467 ++ heap-buffer-overflow in derive_combined_bipredictive_merging_candidates() ++ * CVE-2023-49468 ++ global buffer overflow in read_coding_unit() ++ ++ -- Thorsten Alteholz Fri, 29 Dec 2023 23:03:02 +0100 ++ ++libde265 (1.0.11-1+deb12u1) bookworm; urgency=medium ++ ++ * Non-maintainer upload by the LTS Team. ++ * CVE-2023-27102 (Closes: #1033257) ++ fix segmentation violation in the ++ function decoder_context::process_slice_segment_header ++ * CVE-2023-27103 ++ fix heap buffer overflow in the ++ function derive_collocated_motion_vectors ++ * CVE-2023-43887 ++ fix buffer over-read in pic_parameter_set::dump ++ * CVE-2023-47471 (Closes: #1056187) ++ fix buffer overflow in the slice_segment_header function ++ ++ -- Thorsten Alteholz Sun, 26 Nov 2023 13:03:02 +0100 ++ ++libde265 (1.0.11-1) unstable; urgency=medium ++ ++ [ Tobias Frost ] ++ * Make my patch less noisy. ++ ++ [ Joachim Bauch ] ++ * New upstream version 1.0.11 ++ * Unpackaged upstream version 1.0.10 fixes the following CVEs, most caused ++ by the same underlying issue: ++ CVE-2020-21594, CVE-2020-21595, CVE-2020-21596, CVE-2020-21597, ++ CVE-2020-21598, CVE-2020-21599, CVE-2020-21600, CVE-2020-21601, ++ CVE-2020-21602, CVE-2020-21603, CVE-2020-21604, CVE-2020-21605, ++ CVE-2020-21606, CVE-2022-1253, CVE-2022-43236, CVE-2022-43237, ++ CVE-2022-43238, CVE-2022-43239, CVE-2022-43240, CVE-2022-43241, ++ CVE-2022-43242, CVE-2022-43243, CVE-2022-43244, CVE-2022-43245, ++ CVE-2022-43248, CVE-2022-43249, CVE-2022-43250, CVE-2022-43252, ++ CVE-2022-43253, CVE-2022-47655 ++ * Remove patch applied upstream. ++ * Update patches for new upstream version. ++ * Remove copyright entry for file no longer present in upstream. ++ * Update symbols for new upstream version. ++ * Bump "Standards-Version" to 4.6.2 ++ ++ -- Joachim Bauch Thu, 02 Feb 2023 16:06:20 +0100 ++ ++libde265 (1.0.9-1.1) unstable; urgency=medium ++ ++ * Non-maintainer upload. ++ * Apply patches to mitigate asan failures: ++ reject_reference_pics_from_different_sps.patch and ++ use_sps_from_the_image.patch. ++ * Combined, this two patches fixes: ++ - CVE-2022-43243, CVE-2022-43248, CVE-2022-43253 (Closes: #1025816) ++ - CVE-2022-43235, CVE-2022-43236, CVE-2022-43237, CVE-2022-43238, ++ CVE-2022-43239, CVE-2022-43240, CVE-2022-43241, CVE-2022-43242, ++ CVE-2022-43244, CVE-2022-43250, CVE-2022-43252 (Closes: #1027179) ++ - CVE-2022-47655 ++ * Additional patch recycle_sps_if_possible.patch to avoid over-rejecting ++ valid video streams due to reject_reference_pics_from_different_sps.patch. ++ * Modifying past changelog entries to indicate when vulnerabilities were ++ fixed: ++ - In 1.0.9-1, in total 11 CVE's. see #1004963 and #1014999 ++ - In 1.0.3-1, 1 CVE, see #1029396 ++ * drop unused Build-Depends: libjpeg-dev, libpng-dev and libxv-dev ++ (Closes: #981260) ++ ++ -- Tobias Frost Sun, 22 Jan 2023 13:19:20 +0100 ++ ++libde265 (1.0.9-1) unstable; urgency=medium ++ ++ * Add "Rules-Requires-Root: no". ++ * New upstream version 1.0.9. ++ Bisecting shows that this version fixed this CVES: ++ - CVE-2020-21598, CVE-2020-21600, CVE-2020-21602 (Closes: #1004963) ++ - CVE-2020-21595, CVE-2020-21597, CVE-2020-21599, CVE-2020-21601, ++ CVE-2020-21603, CVE-2020-21604, CVE-2020-21605, CVE-2020-21606 ++ (Closes: #1014999) ++ * Remove patches now part of upstream release. ++ * Bump "Standards-Version" to 4.6.1 ++ * Add patch to provide "gl_VISIBILITY" macro. ++ * Update symbols for new upstream version. ++ ++ -- Joachim Bauch Tue, 25 Oct 2022 10:15:37 +0200 ++ ++libde265 (1.0.8-1.1) unstable; urgency=medium ++ ++ * Non-maintainer upload. ++ * Import upstream fixes for CVE-tracked vulnerabilities ++ (Closes: #1014977) ++ - CVE-2022-1253 ++ - CVE-2021-36411 ++ - CVE-2021-36410 ++ - CVE-2021-36409 ++ - CVE-2021-36408 ++ - CVE-2021-35452 ++ ++ -- Philipp Kern Sun, 16 Oct 2022 15:26:20 +0200 ++ ++libde265 (1.0.8-1) unstable; urgency=medium ++ ++ * Update to debhelper compat level 13 and add debian/not-installed ++ * Imported Upstream version 1.0.8 ++ * Remove patch applied upstream. ++ * Bump "Standards-Version" to 4.5.1 ++ ++ -- Joachim Bauch Wed, 16 Dec 2020 16:32:29 +0100 ++ ++libde265 (1.0.7-1) unstable; urgency=medium ++ ++ [ Debian Janitor ] ++ * Set upstream metadata fields: Bug-Submit. ++ ++ [ Joachim Bauch ] ++ * Imported Upstream version 1.0.7 ++ * Update patches for new upstream version. ++ * Update symbols for new upstream version. ++ * Bump "Standards-Version" to 4.5.0 ++ ++ -- Joachim Bauch Fri, 25 Sep 2020 13:00:59 +0200 ++ ++libde265 (1.0.4-1) unstable; urgency=medium ++ ++ [ Ondřej Nový ] ++ * Use debhelper-compat instead of debian/compat ++ ++ [ Joachim Bauch ] ++ * Imported Upstream version 1.0.4 ++ * Enable hardening. ++ * Specify Build-Depends-Package in symbols. ++ * Ignore more internal STL symbols. ++ * Bump "Standards-Version" to 4.4.1 ++ * Update to debhelper compat level 12. ++ ++ [ Debian Janitor ] ++ * Set upstream metadata fields: Bug-Database, Repository, Repository- ++ Browse. ++ ++ [ Sebastian Ramacher ] ++ * debian/rules: Remove obsolete dh_strip override ++ ++ -- Joachim Bauch Fri, 20 Dec 2019 12:17:15 +0100 ++ ++libde265 (1.0.3-1) unstable; urgency=medium ++ ++ [ Ondřej Nový ] ++ * d/copyright: Use https protocol in Format field ++ * d/control: Set Vcs-* to salsa.debian.org ++ ++ [ Felipe Sateler ] ++ * Change maintainer address to debian-multimedia@lists.debian.org ++ ++ [ Joachim Bauch ] ++ * Imported Upstream version 1.0.3 ++ This version fixes CVE-2020-21594. (Closes: #1029396) ++ * Update patches for new upstream version. ++ * Update symbols for new upstream version. ++ * Update standards version and switch to debhelper 10. ++ ++ -- Joachim Bauch Thu, 19 Apr 2018 11:44:40 +0200 ++ ++libde265 (1.0.2-2) unstable; urgency=low ++ ++ [ Joachim Bauch ] ++ * Added patch by Andreas Cadhalpun to fix compilation with FFmpeg 2.9 ++ (Closes: #803834) ++ * Updated symbols file for new C++11 symbols. ++ ++ [ Sebastian Ramacher ] ++ * Migrate to automatic dbg packages. ++ * debian/control: Remove some unnecessary Build-Depends. ++ ++ -- Joachim Bauch Mon, 11 Jan 2016 19:12:19 +0100 ++ ++libde265 (1.0.2-1) unstable; urgency=low ++ ++ * Imported Upstream version 1.0.2 ++ * Added new files to copyright information. ++ * Only export decoder API and update symbols for new version. ++ ++ -- Joachim Bauch Thu, 16 Jul 2015 11:07:46 +0200 ++ ++libde265 (0.9-1) unstable; urgency=low ++ ++ * Updated symbols to make all "std::vector" symbols optional. ++ * Imported Upstream version 0.9 ++ * Removed deprecated patch to update symbols visibility. Changes were ++ applied upstream. ++ * Upstream supports compiling against Qt5, prefer that over Qt4. ++ * Added new symbols from new upstream release. ++ ++ -- Joachim Bauch Tue, 16 Sep 2014 18:47:14 +0200 ++ ++libde265 (0.8-1) unstable; urgency=low ++ ++ * Initial release. (Closes: #744190) ++ ++ -- Joachim Bauch Fri, 08 Aug 2014 17:23:37 +0200 diff --cc debian/clean index 0000000,0000000..8d0cb0f new file mode 100644 --- /dev/null +++ b/debian/clean @@@ -1,0 -1,0 +1,33 @@@ ++INSTALL ++Makefile.in ++acceleration-speed/Makefile.in ++aclocal.m4 ++compile ++config.guess ++config.h.in ++config.sub ++configure ++dec265/Makefile.in ++depcomp ++enc265/Makefile.in ++install-sh ++libde265/Makefile.in ++libde265/arm/Makefile.in ++libde265/encoder/Makefile.in ++libde265/encoder/algo/Makefile.in ++libde265/x86/Makefile.in ++ltmain.sh ++m4/libtool.m4 ++m4/ltoptions.m4 ++m4/ltsugar.m4 ++m4/ltversion.m4 ++m4/lt~obsolete.m4 ++missing ++sherlock265/Makefile.in ++tools/Makefile.in ++acceleration-speed/.deps/ ++acceleration-speed/Makefile ++enc265/.deps/ ++enc265/Makefile ++tools/.deps/ ++tools/Makefile diff --cc debian/control index 0000000,0000000..d29c476 new file mode 100644 --- /dev/null +++ b/debian/control @@@ -1,0 -1,0 +1,60 @@@ ++Source: libde265 ++Section: libs ++Priority: optional ++Maintainer: Debian Multimedia Maintainers ++Uploaders: ++ Alessio Treglia , ++ Joachim Bauch ++Build-Depends: ++ debhelper-compat (= 13), ++ qtbase5-dev | libqt4-dev, ++ libsdl-dev, ++ libswscale-dev, ++ libx11-dev, ++ libxext-dev, ++ pkg-config ++Rules-Requires-Root: no ++Standards-Version: 4.6.2 ++Homepage: https://github.com/strukturag/libde265 ++Vcs-Git: https://salsa.debian.org/multimedia-team/libde265.git ++Vcs-Browser: https://salsa.debian.org/multimedia-team/libde265 ++ ++Package: libde265-0 ++Architecture: any ++Multi-Arch: same ++Depends: ++ ${misc:Depends}, ++ ${shlibs:Depends} ++Description: Open H.265 video codec implementation ++ libde265 is an open source implementation of the H.265 video codec. ++ It is written from scratch in plain C for simplicity and efficiency. ++ Its simple API makes it easy to integrate it into other software. ++ ++Package: libde265-dev ++Section: libdevel ++Multi-Arch: same ++Architecture: any ++Depends: ++ libde265-0 (= ${binary:Version}), ++ ${misc:Depends} ++Description: Open H.265 video codec implementation - development files ++ libde265 is an open source implementation of the H.265 video codec. ++ It is written from scratch in plain C for simplicity and efficiency. ++ Its simple API makes it easy to integrate it into other software. ++ . ++ The development headers for compiling programs that use libde265 ++ are provided by this package. ++ ++Package: libde265-examples ++Section: video ++Architecture: any ++Depends: ++ libde265-0 (= ${binary:Version}), ++ ${misc:Depends}, ++ ${shlibs:Depends} ++Description: Open H.265 video codec implementation - examples ++ libde265 is an open source implementation of the H.265 video codec. ++ It is written from scratch in plain C for simplicity and efficiency. ++ Its simple API makes it easy to integrate it into other software. ++ . ++ Sample applications using libde265 are provided by this package. diff --cc debian/copyright index 0000000,0000000..091f5f7 new file mode 100644 --- /dev/null +++ b/debian/copyright @@@ -1,0 -1,0 +1,170 @@@ ++Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ ++Upstream-Name: libde265 ++Upstream-Contact: struktur AG ++Source: https://github.com/strukturag/libde265 ++ ++Files: * ++Copyright: ++ 2013-2014 struktur AG, Dirk Farin ++ 2013 openHEVC contributors ++License: LGPL-3+ ++ ++Files: dec265/dec265.cc ++ dec265/hdrcopy.cc ++ dec265/sdl.cc ++ dec265/sdl.hh ++ enc265/enc265.cc ++ sherlock265/VideoDecoder.cc ++ sherlock265/VideoDecoder.hh ++ sherlock265/VideoPlayer.cc ++ sherlock265/VideoPlayer.hh ++ sherlock265/VideoWidget.cc ++ sherlock265/VideoWidget.hh ++ sherlock265/sherlock265.cc ++ tools/bjoentegaard.cc ++ tools/block-rate-estim.cc ++ tools/gen-entropy-table.cc ++ tools/rd-curves.cc ++ tools/tests.cc ++ tools/yuv-distortion.cc ++Copyright: ++ 2013-2014 struktur AG, Dirk Farin ++ 2013-2014 struktur AG, Joachim Bauch ++ 1998-2013 Free Software Foundation, Inc ++License: GPL-3+ ++Comment: Please note that only the sample applications are GPL-3+ while ++ the decoding library itself is licensed as LGPL-3+. ++ ++Files: extra/getopt.c ++ extra/getopt.h ++ extra/getopt_long.c ++Copyright: 1987-1996 The Regents of the University of California ++License: BSD-4-clause ++ ++Files: libde265/md5.cc ++ libde265/md5.h ++Copyright: No copyright holder ++License: public-domain-1 ++ This software was written by Alexander Peslyak in 2001. No copyright is ++ claimed, and the software is hereby placed in the public domain. ++ In case this attempt to disclaim copyright and place the software in the ++ public domain is deemed null and void, then the software is ++ Copyright (c) 2001 Alexander Peslyak and it is hereby released to the ++ general public under the following terms: ++ . ++ Redistribution and use in source and binary forms, with or without ++ modification, are permitted. ++ . ++ There's ABSOLUTELY NO WARRANTY, express or implied. ++ . ++ (This is a heavily cut-down "BSD license".) ++ . ++ This differs from Colin Plumb's older public domain implementation in that ++ no exactly 32-bit integer data type is required (any 32-bit or wider ++ unsigned integer data type will do), there's no compile-time endianness ++ configuration, and the function prototypes match OpenSSL's. No code from ++ Colin Plumb's implementation has been reused; this comment merely compares ++ the properties of the two independent implementations. ++ . ++ The primary goals of this implementation are portability and ease of use. ++ It is meant to be fast, but not as fast as possible. Some known ++ optimizations are not included to reduce source code size and avoid ++ compile-time configuration. ++ ++Files: extra/win32cond.c ++ extra/win32cond.h ++Copyright: ++ 1993-2009 Douglas C. Schmidt and his research group at ++ Washington University, University of California, Irvine, and ++ Vanderbilt University ++License: other-1 ++ ACE(TM), TAO(TM), CIAO(TM), DAnCE>(TM), and CoSMIC(TM) (henceforth ++ referred to as "DOC software") are copyrighted by Douglas C. Schmidt ++ and his research group at Washington University, University of California, ++ Irvine, and Vanderbilt University, Copyright (c) 1993-2009, all rights ++ reserved. ++ . ++ Since DOC software is open-source, freely available software, you are free ++ to use, modify, copy, and distribute--perpetually and irrevocably--the DOC ++ software source code and object code produced from the source, as well as ++ copy and distribute modified versions of this software. You must, however, ++ include this copyright statement along with any code built using DOC ++ software that you release. ++ . ++ No copyright statement needs to be provided if you just ship binary ++ executables of your software products. ++ . ++ See "Strategies for Implementing POSIX Condition Variables on Win32" at ++ http://www.cs.wustl.edu/~schmidt/win32-cv-1.html ++ ++Files: debian/* ++Copyright: ++ 2014-2023 Joachim Bauch ++ 2014 Alessio Treglia ++License: LGPL-3+ ++ ++License: GPL-3+ ++ This program is free software: you can redistribute it and/or modify ++ it under the terms of the GNU General Public License as published by ++ the Free Software Foundation, either version 3 of the License, or ++ (at your option) any later version. ++ . ++ This program is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ GNU General Public License for more details. ++ . ++ On Debian systems the complete text of the GNU General Public License ++ can be found in the `/usr/share/common-licenses/GPL-3' file. ++ . ++ You should have received a copy of the GNU General Public License ++ along with this program. If not, see . ++ ++License: LGPL-3+ ++ This program is free software: you can redistribute it and/or modify ++ it under the terms of the GNU General Public License as published by ++ the Free Software Foundation, either version 3 of the License, or ++ (at your option) any later version. ++ . ++ This program is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ GNU General Public License for more details. ++ . ++ On Debian systems the complete text of the GNU Lesser General Public ++ License can be found in the `/usr/share/common-licenses/LGPL-3' file. ++ . ++ You should have received a copy of the GNU General Public License ++ along with this program. If not, see . ++ ++License: BSD-4-clause ++ Copyright (c) 1987, 1993, 1994 ++ The Regents of the University of California. All rights reserved. ++ . ++ Redistribution and use in source and binary forms, with or without ++ modification, are permitted provided that the following conditions ++ are met: ++ 1. Redistributions of source code must retain the above copyright ++ notice, this list of conditions and the following disclaimer. ++ 2. Redistributions in binary form must reproduce the above copyright ++ notice, this list of conditions and the following disclaimer in the ++ documentation and/or other materials provided with the distribution. ++ 3. All advertising materials mentioning features or use of this software ++ must display the following acknowledgement: ++ This product includes software developed by the University of ++ California, Berkeley and its contributors. ++ 4. Neither the name of the University nor the names of its contributors ++ may be used to endorse or promote products derived from this software ++ without specific prior written permission. ++ . ++ THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND ++ ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE ++ IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ++ ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE ++ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL ++ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS ++ OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ++ HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT ++ LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY ++ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF ++ SUCH DAMAGE. diff --cc debian/gbp.conf index 0000000,0000000..7184ea5 new file mode 100644 --- /dev/null +++ b/debian/gbp.conf @@@ -1,0 -1,0 +1,3 @@@ ++[DEFAULT] ++debian-branch = debian/bookworm ++pristine-tar = True diff --cc debian/libde265-0.install index 0000000,0000000..3de3b10 new file mode 100644 --- /dev/null +++ b/debian/libde265-0.install @@@ -1,0 -1,0 +1,1 @@@ ++usr/lib/*/*.so.* diff --cc debian/libde265-0.symbols index 0000000,0000000..a84c2a0 new file mode 100644 --- /dev/null +++ b/debian/libde265-0.symbols @@@ -1,0 -1,0 +1,78 @@@ ++libde265.so.0 libde265-0 #MINVER# ++* Build-Depends-Package: libde265-dev ++ (optional|c++|regex)"^std::_Sp_counted_base<.*@Base$" 1.0.2 ++ (optional|c++|regex)"^std::_Sp_counted_ptr<.*@Base$" 1.0.3 ++ (optional|c++|regex)"^std::_Sp_make_shared_tag.*@Base$" 1.0.4 ++ (optional|c++|regex)"^std::_Vector_base<.*@Base$" 1.0.7 ++ (optional|c++|regex)"^std::__cxx11::basic_string<.*@Base$" 1.0.9 ++ (optional|c++|regex)"^std::__cxx11::basic_stringbuf<.*@Base$" 1.0.2 ++ (optional|c++|regex)"^std::vector<.*@Base$" 1.0.2 ++ (optional|c++|regex)"^typeinfo for std::.*@Base$" 1.0.2 ++ (optional|c++|regex)"^typeinfo name for std::.*@Base$" 1.0.2 ++ (optional|c++|regex)"^void std::vector<.*@Base$" 1.0.2 ++ (optional=only used internally by dec265|c++)"MSE(unsigned char const*, int, unsigned char const*, int, int, int)@Base" 1.0.2 ++ (optional=only used internally by dec265|c++)"PSNR(double)@Base" 1.0.2 ++ (optional=only used by the non-final encoder api)de265_alloc_image_plane@Base 1.0.2 ++ de265_change_framerate@Base 0.8 ++ de265_decode@Base 0.8 ++ de265_decode_data@Base 0.8 ++ de265_disable_logging@Base 0.8 ++ de265_flush_data@Base 0.8 ++ de265_free@Base 0.8 ++ de265_free_decoder@Base 0.8 ++ (optional=only used by the non-final encoder api)de265_free_image_plane@Base 1.0.2 ++ de265_get_bits_per_pixel@Base 1.0.2 ++ de265_get_chroma_format@Base 0.8 ++ de265_get_current_TID@Base 0.8 ++ de265_get_default_image_allocation_functions@Base 0.8 ++ de265_get_error_text@Base 0.8 ++ de265_get_highest_TID@Base 0.8 ++ de265_get_image_NAL_header@Base 0.8 ++ de265_get_image_PTS@Base 0.8 ++ de265_get_image_colour_primaries@Base 1.0.7 ++ de265_get_image_full_range_flag@Base 1.0.7 ++ de265_get_image_height@Base 0.8 ++ de265_get_image_matrix_coefficients@Base 1.0.7 ++ de265_get_image_plane@Base 0.8 ++ de265_get_image_plane_user_data@Base 0.8 ++ de265_get_image_transfer_characteristics@Base 1.0.7 ++ de265_get_image_user_data@Base 0.8 ++ de265_get_image_width@Base 0.8 ++ de265_get_next_picture@Base 0.8 ++ de265_get_number_of_NAL_units_pending@Base 0.8 ++ de265_get_number_of_input_bytes_pending@Base 0.8 ++ de265_get_parameter_bool@Base 0.8 ++ de265_get_version@Base 0.8 ++ de265_get_version_number@Base 0.8 ++ de265_get_version_number_maintenance@Base 1.0.2 ++ de265_get_version_number_major@Base 1.0.2 ++ de265_get_version_number_minor@Base 1.0.2 ++ de265_get_warning@Base 0.8 ++ de265_init@Base 0.8 ++ de265_isOK@Base 0.8 ++ de265_new_decoder@Base 0.8 ++ de265_peek_next_picture@Base 0.8 ++ de265_push_NAL@Base 0.8 ++ de265_push_data@Base 0.8 ++ de265_push_end_of_NAL@Base 0.8 ++ de265_push_end_of_frame@Base 0.9 ++ de265_release_next_picture@Base 0.8 ++ de265_reset@Base 0.8 ++ de265_set_framerate_ratio@Base 0.8 ++ de265_set_image_allocation_functions@Base 0.8 ++ de265_set_image_plane@Base 0.8 ++ de265_set_image_user_data@Base 0.9 ++ de265_set_limit_TID@Base 0.8 ++ de265_set_parameter_bool@Base 0.8 ++ de265_set_parameter_int@Base 0.8 ++ de265_set_verbosity@Base 0.8 ++ de265_start_worker_threads@Base 0.8 ++ (optional=only used internally by sherlock265)draw_CB_grid@Base 0.8 ++ (optional=only used internally by sherlock265)draw_Motion@Base 0.8 ++ (optional=only used internally by sherlock265)draw_PB_grid@Base 0.8 ++ (optional=only used internally by sherlock265)draw_PB_pred_modes@Base 0.8 ++ (optional=only used internally by sherlock265)draw_QuantPY@Base 0.8 ++ (optional=only used internally by sherlock265)draw_Slices@Base 0.8 ++ (optional=only used internally by sherlock265)draw_TB_grid@Base 0.8 ++ (optional=only used internally by sherlock265)draw_Tiles@Base 0.8 ++ (optional=only used internally by sherlock265)draw_intra_pred_modes@Base 0.8 diff --cc debian/libde265-dev.docs index 0000000,0000000..b43bf86 new file mode 100644 --- /dev/null +++ b/debian/libde265-dev.docs @@@ -1,0 -1,0 +1,1 @@@ ++README.md diff --cc debian/libde265-dev.install index 0000000,0000000..60fe5cb new file mode 100644 --- /dev/null +++ b/debian/libde265-dev.install @@@ -1,0 -1,0 +1,3 @@@ ++usr/include/* ++usr/lib/*/*.so ++usr/lib/*/pkgconfig/* diff --cc debian/libde265-examples.install index 0000000,0000000..1df36c6 new file mode 100644 --- /dev/null +++ b/debian/libde265-examples.install @@@ -1,0 -1,0 +1,1 @@@ ++usr/bin/* diff --cc debian/not-installed index 0000000,0000000..86d06e2 new file mode 100644 --- /dev/null +++ b/debian/not-installed @@@ -1,0 -1,0 +1,2 @@@ ++usr/lib/*/libde265.a ++usr/lib/*/libde265.la diff --cc debian/patches/CVE-2023-27102.patch index 0000000,0000000..b182cc5 new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2023-27102.patch @@@ -1,0 -1,0 +1,23 @@@ ++commit 0b1752abff97cb542941d317a0d18aa50cb199b1 ++Author: Dirk Farin ++Date: Sat Mar 4 10:32:43 2023 +0100 ++ ++ check whether referenced PPS exists (fixes #393) ++ ++Index: libde265-1.0.11/libde265/decctx.cc ++=================================================================== ++--- libde265-1.0.11.orig/libde265/decctx.cc 2023-11-19 19:08:18.703219858 +0100 +++++ libde265-1.0.11/libde265/decctx.cc 2023-11-19 19:08:18.703219858 +0100 ++@@ -2276,9 +2276,10 @@ ++ // get PPS and SPS for this slice ++ ++ int pps_id = hdr->slice_pic_parameter_set_id; ++- if (pps[pps_id]->pps_read==false) { +++ if (pps[pps_id]==nullptr || pps[pps_id]->pps_read==false) { ++ logerror(LogHeaders, "PPS %d has not been read\n", pps_id); ++- assert(false); // TODO +++ img->decctx->add_warning(DE265_WARNING_NONEXISTING_PPS_REFERENCED, false); +++ return false; ++ } ++ ++ current_pps = pps[pps_id]; diff --cc debian/patches/CVE-2023-27103.patch index 0000000,0000000..94f009b new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2023-27103.patch @@@ -1,0 -1,0 +1,54 @@@ ++commit d6bf73e765b7a23627bfd7a8645c143fd9097995 ++Author: Dirk Farin ++Date: Sat Mar 4 10:27:59 2023 +0100 ++ ++ check for valid slice header index access (fixes #394) ++ ++Index: libde265-1.0.11/libde265/de265.cc ++=================================================================== ++--- libde265-1.0.11.orig/libde265/de265.cc 2023-11-19 19:08:22.851224558 +0100 +++++ libde265-1.0.11/libde265/de265.cc 2023-11-19 19:08:22.847224554 +0100 ++@@ -174,6 +174,8 @@ ++ return "Bit-depth of current image does not match SPS"; ++ case DE265_WARNING_REFERENCE_IMAGE_CHROMA_FORMAT_DOES_NOT_MATCH: ++ return "Chroma format of reference image does not match current image"; +++ case DE265_WARNING_INVALID_SLICE_HEADER_INDEX_ACCESS: +++ return "Access with invalid slice header index"; ++ ++ default: return "unknown error"; ++ } ++Index: libde265-1.0.11/libde265/de265.h ++=================================================================== ++--- libde265-1.0.11.orig/libde265/de265.h 2023-11-19 19:08:22.851224558 +0100 +++++ libde265-1.0.11/libde265/de265.h 2023-11-19 19:08:22.847224554 +0100 ++@@ -145,7 +145,8 @@ ++ DE265_WARNING_REFERENCE_IMAGE_SIZE_DOES_NOT_MATCH_SPS=1029, ++ DE265_WARNING_CHROMA_OF_CURRENT_IMAGE_DOES_NOT_MATCH_SPS=1030, ++ DE265_WARNING_BIT_DEPTH_OF_CURRENT_IMAGE_DOES_NOT_MATCH_SPS=1031, ++- DE265_WARNING_REFERENCE_IMAGE_CHROMA_FORMAT_DOES_NOT_MATCH=1032 +++ DE265_WARNING_REFERENCE_IMAGE_CHROMA_FORMAT_DOES_NOT_MATCH=1032, +++ DE265_WARNING_INVALID_SLICE_HEADER_INDEX_ACCESS=1033 ++ } de265_error; ++ ++ LIBDE265_API const char* de265_get_error_text(de265_error err); ++Index: libde265-1.0.11/libde265/motion.cc ++=================================================================== ++--- libde265-1.0.11.orig/libde265/motion.cc 2023-11-19 19:08:22.851224558 +0100 +++++ libde265-1.0.11/libde265/motion.cc 2023-11-19 19:08:22.847224554 +0100 ++@@ -1266,6 +1266,16 @@ ++ ++ ++ +++ int slice_hdr_idx = colImg->get_SliceHeaderIndex(xColPb,yColPb); +++ if (slice_hdr_idx >= colImg->slices.size()) { +++ ctx->add_warning(DE265_WARNING_INVALID_SLICE_HEADER_INDEX_ACCESS, false); +++ +++ *out_availableFlagLXCol = 0; +++ out_mvLXCol->x = 0; +++ out_mvLXCol->y = 0; +++ return; +++ } +++ ++ const slice_segment_header* colShdr = colImg->slices[ colImg->get_SliceHeaderIndex(xColPb,yColPb) ]; ++ ++ if (shdr->LongTermRefPic[X][refIdxLX] != diff --cc debian/patches/CVE-2023-43887.patch index 0000000,0000000..56be7c1 new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2023-43887.patch @@@ -1,0 -1,0 +1,32 @@@ ++commit 63b596c915977f038eafd7647d1db25488a8c133 ++Author: Dirk Farin ++Date: Fri Sep 1 21:18:48 2023 +0200 ++ ++ fix #418 ++ ++Index: libde265-1.0.11/libde265/decctx.cc ++=================================================================== ++--- libde265-1.0.11.orig/libde265/decctx.cc 2023-11-21 19:05:15.995562788 +0100 +++++ libde265-1.0.11/libde265/decctx.cc 2023-11-21 19:05:15.991562787 +0100 ++@@ -854,16 +854,17 @@ ++ std::shared_ptr new_pps = std::make_shared(); ++ ++ bool success = new_pps->read(&reader,this); +++ if (!success) { +++ return DE265_WARNING_PPS_HEADER_INVALID; +++ } ++ ++ if (param_pps_headers_fd>=0) { ++ new_pps->dump(param_pps_headers_fd); ++ } ++ ++- if (success) { ++- pps[ (int)new_pps->pic_parameter_set_id ] = new_pps; ++- } +++ pps[ (int)new_pps->pic_parameter_set_id ] = new_pps; ++ ++- return success ? DE265_OK : DE265_WARNING_PPS_HEADER_INVALID; +++ return DE265_OK; ++ } ++ ++ de265_error decoder_context::read_sei_NAL(bitreader& reader, bool suffix) diff --cc debian/patches/CVE-2023-47471.patch index 0000000,0000000..34290fb new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2023-47471.patch @@@ -1,0 -1,0 +1,35 @@@ ++commit e36b4a1b0bafa53df47514c419d5be3e8916ebc7 ++Author: Dirk Farin ++Date: Sat Nov 4 15:20:50 2023 +0100 ++ ++ null-pointer check in debug output (fixes #426) ++ ++diff --git a/libde265/slice.cc b/libde265/slice.cc ++index 280b7417..435123dc 100644 ++--- a/libde265/slice.cc +++++ b/libde265/slice.cc ++@@ -1277,14 +1277,23 @@ void slice_segment_header::dump_slice_segment_header(const decoder_context* ctx, ++ #define LOG3(t,d1,d2,d3) log2fh(fh, t,d1,d2,d3) ++ #define LOG4(t,d1,d2,d3,d4) log2fh(fh, t,d1,d2,d3,d4) ++ +++ LOG0("----------------- SLICE -----------------\n"); +++ ++ const pic_parameter_set* pps = ctx->get_pps(slice_pic_parameter_set_id); +++ if (!pps) { +++ LOG0("invalid PPS referenced\n"); +++ return; +++ } ++ assert(pps->pps_read); // TODO: error handling ++ ++ const seq_parameter_set* sps = ctx->get_sps((int)pps->seq_parameter_set_id); +++ if (!sps) { +++ LOG0("invalid SPS referenced\n"); +++ return; +++ } ++ assert(sps->sps_read); // TODO: error handling ++ ++ ++- LOG0("----------------- SLICE -----------------\n"); ++ LOG1("first_slice_segment_in_pic_flag : %d\n", first_slice_segment_in_pic_flag); ++ if (ctx->get_nal_unit_type() >= NAL_UNIT_BLA_W_LP && ++ ctx->get_nal_unit_type() <= NAL_UNIT_RESERVED_IRAP_VCL23) { diff --cc debian/patches/CVE-2023-49465.patch index 0000000,0000000..f6a4851 new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2023-49465.patch @@@ -1,0 -1,0 +1,26 @@@ ++commit 1475c7d2f0a6dc35c27e18abc4db9679bfd32568 ++Author: Dirk Farin ++Date: Thu Nov 23 19:43:55 2023 +0100 ++ ++ possible fix for #435 ++ ++Index: libde265-1.0.11/libde265/motion.cc ++=================================================================== ++--- libde265-1.0.11.orig/libde265/motion.cc 2023-12-26 00:54:05.172996659 +0100 +++++ libde265-1.0.11/libde265/motion.cc 2023-12-26 00:54:05.168996661 +0100 ++@@ -1859,7 +1859,14 @@ ++ logmvcand(vi); ++ ++ const de265_image* imgX = NULL; ++- if (vi.predFlag[X]) imgX = ctx->get_image(shdr->RefPicList[X][ vi.refIdx[X] ]); +++ if (vi.predFlag[X]) { +++ if (vi.refIdx[X] < 0 || vi.refIdx[X] >= MAX_NUM_REF_PICS) { +++ return; +++ } +++ +++ imgX = ctx->get_image(shdr->RefPicList[X][ vi.refIdx[X] ]); +++ } +++ ++ const de265_image* imgY = NULL; ++ if (vi.predFlag[Y]) imgY = ctx->get_image(shdr->RefPicList[Y][ vi.refIdx[Y] ]); ++ diff --cc debian/patches/CVE-2023-49467.patch index 0000000,0000000..8af159d new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2023-49467.patch @@@ -1,0 -1,0 +1,22 @@@ ++commit 7e4faf254bbd2e52b0f216cb987573a2cce97b54 ++Author: Dirk Farin ++Date: Thu Nov 23 19:38:34 2023 +0100 ++ ++ prevent endless loop for #434 input ++ ++diff --git a/libde265/slice.cc b/libde265/slice.cc ++index 435123dc..3a8a8de1 100644 ++--- a/libde265/slice.cc +++++ b/libde265/slice.cc ++@@ -2582,6 +2582,11 @@ static int decode_rqt_root_cbf(thread_context* tctx) ++ ++ static int decode_ref_idx_lX(thread_context* tctx, int numRefIdxLXActive) ++ { +++ // prevent endless loop when 'numRefIdxLXActive' is invalid +++ if (numRefIdxLXActive <= 1) { +++ return 0; +++ } +++ ++ logtrace(LogSlice,"# ref_idx_lX\n"); ++ ++ int cMax = numRefIdxLXActive-1; diff --cc debian/patches/CVE-2023-49468.patch index 0000000,0000000..3dda7c8 new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2023-49468.patch @@@ -1,0 -1,0 +1,26 @@@ ++commit 3e822a3ccf88df1380b165d6ce5a00494a27ceeb ++Author: Dirk Farin ++Date: Thu Nov 23 19:11:34 2023 +0100 ++ ++ fix #432 (undefined IPM) ++ ++diff --git a/libde265/image.h b/libde265/image.h ++index 0b536054..0a0c0e32 100644 ++--- a/libde265/image.h +++++ b/libde265/image.h ++@@ -624,7 +624,14 @@ public: ++ ++ enum IntraPredMode get_IntraPredMode(int x,int y) const ++ { ++- return (enum IntraPredMode)intraPredMode.get(x,y); +++ uint8_t ipm = intraPredMode.get(x,y); +++ +++ // sanitize values if IPM is uninitialized (because of earlier read error) +++ if (ipm > 34) { +++ ipm = 0; +++ } +++ +++ return static_cast(ipm); ++ } ++ ++ enum IntraPredMode get_IntraPredMode_atIndex(int idx) const diff --cc debian/patches/CVE-2023-51792.patch index 0000000,0000000..39f6d7c new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2023-51792.patch @@@ -1,0 -1,0 +1,32 @@@ ++Description: CVE-2023-51792: check validity of conformance window parameters ++ Imported from 1.0.11-0+deb11u4 ++Origin: https://github.com/strukturag/libde265/commit/221e767136b8c46c748ae35b79ec9b976b3da301 ++ ++From: Dirk Farin ++Date: Sat, 4 Nov 2023 15:13:36 +0100 ++Subject: check validity of conformance window parameters (fixes #427) ++ ++(cherry picked from commit 221e767136b8c46c748ae35b79ec9b976b3da301) ++--- ++ libde265/image.cc | 8 ++++++++ ++ 1 file changed, 8 insertions(+) ++ ++diff --git a/libde265/image.cc b/libde265/image.cc ++index 39813b0..057705c 100644 ++--- a/libde265/image.cc +++++ b/libde265/image.cc ++@@ -330,6 +330,14 @@ de265_error de265_image::alloc_image(int w,int h, enum de265_chroma c, ++ int top = sps ? sps->conf_win_top_offset : 0; ++ int bottom = sps ? sps->conf_win_bottom_offset : 0; ++ +++ if ((left+right)*WinUnitX >= width) { +++ return DE265_ERROR_CODED_PARAMETER_OUT_OF_RANGE; +++ } +++ +++ if ((top+bottom)*WinUnitX >= height) { +++ return DE265_ERROR_CODED_PARAMETER_OUT_OF_RANGE; +++ } +++ ++ width_confwin = width - (left+right)*WinUnitX; ++ height_confwin= height- (top+bottom)*WinUnitY; ++ chroma_width_confwin = chroma_width -left-right; diff --cc debian/patches/CVE-2024-38949+CVE-2024-38950.patch index 0000000,0000000..67698c6 new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2024-38949+CVE-2024-38950.patch @@@ -1,0 -1,0 +1,147 @@@ ++Description: CVE-2024-38949 (Heap Buffer Overflow) and CVE-2024-38950 (crash) ++ as the version in bookworm is still using SDL1.2, the resize() function has ++ been backported for SDL1.2. ++ The display444as420() does not need backporting, as with SDL1.2 the faulty ++ pointer arimethic is not needed, SDL has separate buffers. ++Author: Tobias Frost ++Origin: https://github.com/strukturag/libde265/commit/4089de0845e0009e019be4ca5cbebaf2aee0a8ce ++Bug: https://github.com/strukturag/libde265/issues/460 ++Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1074416 ++ ++From 4089de0845e0009e019be4ca5cbebaf2aee0a8ce Mon Sep 17 00:00:00 2001 ++From: Dirk Farin ++Date: Sun, 10 May 2026 22:37:53 +0200 ++Subject: [PATCH] dec265: fix SDL OOB on 4:4:4 streams and mid-stream ++ resolution change (closes #460) ++ ++--- ++ dec265/dec265.cc | 22 ++++++++++++---------- ++ dec265/sdl-display.cc | 39 ++++++++++++++++++++++++++++++++++++++- ++ dec265/sdl-display.h | 1 + ++ 3 files changed, 51 insertions(+), 11 deletions(-) ++ ++--- a/dec265/dec265.cc +++++ b/dec265/dec265.cc ++@@ -261,17 +261,20 @@ ++ ++ de265_chroma chroma = de265_get_chroma_format(img); ++ +++ enum SDL_YUV_Display::SDL_Chroma sdlChroma; +++ switch (chroma) { +++ case de265_chroma_420: sdlChroma = SDL_YUV_Display::SDL_CHROMA_420; break; +++ case de265_chroma_422: sdlChroma = SDL_YUV_Display::SDL_CHROMA_422; break; +++ case de265_chroma_444: sdlChroma = SDL_YUV_Display::SDL_CHROMA_444; break; +++ case de265_chroma_mono: sdlChroma = SDL_YUV_Display::SDL_CHROMA_MONO; break; +++ default: sdlChroma = SDL_YUV_Display::SDL_CHROMA_MONO; +++ } +++ ++ if (!sdl_active) { ++ sdl_active=true; ++- enum SDL_YUV_Display::SDL_Chroma sdlChroma; ++- switch (chroma) { ++- case de265_chroma_420: sdlChroma = SDL_YUV_Display::SDL_CHROMA_420; break; ++- case de265_chroma_422: sdlChroma = SDL_YUV_Display::SDL_CHROMA_422; break; ++- case de265_chroma_444: sdlChroma = SDL_YUV_Display::SDL_CHROMA_444; break; ++- case de265_chroma_mono: sdlChroma = SDL_YUV_Display::SDL_CHROMA_MONO; break; ++- } ++- ++- sdlWin.init(width,height, sdlChroma); +++ if (!sdlWin.init(width,height, sdlChroma)) return true; +++ } else { +++ if (!sdlWin.resize(width,height, sdlChroma)) return true; ++ } ++ ++ int stride,chroma_stride; ++--- a/dec265/sdl.cc +++++ b/dec265/sdl.cc ++@@ -96,6 +96,80 @@ ++ return true; ++ } ++ +++ +++ +++bool SDL_YUV_Display::resize(int frame_width, int frame_height, enum SDL_Chroma chroma) +++{ +++ if (!mWindowOpen) { +++ return init(frame_width, frame_height, chroma); +++ } +++ +++ // reduce image size to a multiple of 8, same rounding as init() +++ frame_width &= ~7; +++ frame_height &= ~7; +++ +++ if (frame_width == rect.w && frame_height == rect.h && mChroma == chroma) { +++ return true; +++ } +++ +++ mChroma = chroma; +++ +++ // The overlay is tied to the old dimensions/pixel format; it has to be +++ // freed and recreated at the new size (SDL 1.2 has no in-place resize). +++ if (mYUVOverlay) { +++ SDL_FreeYUVOverlay(mYUVOverlay); +++ mYUVOverlay = NULL; +++ } +++ +++ const SDL_VideoInfo* info = SDL_GetVideoInfo(); +++ if (!info) { +++ printf("SDL_GetVideoInfo() failed: %s\n", SDL_GetError()); +++ mWindowOpen = false; +++ return false; +++ } +++ +++ Uint8 bpp = info->vfmt->BitsPerPixel; +++ +++ Uint32 vflags; +++ if (info->hw_available) +++ vflags = SDL_HWSURFACE; +++ else +++ vflags = SDL_SWSURFACE; +++ +++ mScreen = SDL_SetVideoMode(frame_width, frame_height, bpp, vflags); +++ if (mScreen == NULL) { +++ printf("SDL: Couldn't set video mode to %dx%d,%d bpp: %s", +++ frame_width, frame_height, bpp, SDL_GetError()); +++ mWindowOpen = false; +++ return false; +++ } +++ +++ uint32_t pixelFormat; +++ switch (mChroma) { +++ case SDL_CHROMA_MONO: pixelFormat = SDL_YV12_OVERLAY; break; +++ case SDL_CHROMA_420: pixelFormat = SDL_YV12_OVERLAY; break; +++ case SDL_CHROMA_422: pixelFormat = SDL_YUY2_OVERLAY; break; +++ case SDL_CHROMA_444: pixelFormat = SDL_YV12_OVERLAY; break; +++ default: pixelFormat = SDL_YV12_OVERLAY; break; +++ } +++ +++ mYUVOverlay = SDL_CreateYUVOverlay(frame_width, frame_height, pixelFormat, mScreen); +++ if (mYUVOverlay == NULL) { +++ printf("SDL: Couldn't recreate SDL YUV overlay: %s", SDL_GetError()); +++ mWindowOpen = false; +++ return false; +++ } +++ +++ rect.x = 0; +++ rect.y = 0; +++ rect.w = frame_width; +++ rect.h = frame_height; +++ +++ return true; +++} +++ +++ +++ ++ void SDL_YUV_Display::display(const unsigned char *Y, ++ const unsigned char *U, ++ const unsigned char *V, ++--- a/dec265/sdl.hh +++++ b/dec265/sdl.hh ++@@ -39,6 +39,7 @@ ++ }; ++ ++ bool init(int frame_width, int frame_height, enum SDL_Chroma chroma = SDL_CHROMA_420); +++ bool resize(int frame_width, int frame_height, enum SDL_Chroma chroma); ++ void display(const unsigned char *Y, const unsigned char *U, const unsigned char *V, ++ int stride, int chroma_stride); ++ void close(); diff --cc debian/patches/CVE-2026-33164+33165.patch index 0000000,0000000..7441017 new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2026-33164+33165.patch @@@ -1,0 -1,0 +1,49 @@@ ++Description: CVE-2026-33164 + CVE-2026-33165: fix reallocation of metadata array... ++ Imported from 1.0.11-0+deb11u4 ++Origin: https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658 ++Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg (CVE-2026-33165) ++Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r (CVE-2026-33164) ++Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131468 (CVE-2026-33165) ++Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131469 (CVE-2026-33164) ++ ++ ++From: Dirk Farin ++Date: Sun, 15 Mar 2026 22:58:39 +0100 ++Subject: fix reallocation of metadata array when ctb size changes (thanks to ++ Ana K.) ++ ++(cherry picked from commit c7891e412106130b83f8e8ea8b7f907e9449b658) ++--- ++ libde265/image.cc | 5 +++-- ++ libde265/image.h | 2 +- ++ 2 files changed, 4 insertions(+), 3 deletions(-) ++ ++diff --git a/libde265/image.cc b/libde265/image.cc ++index 057705c..a376aaa 100644 ++--- a/libde265/image.cc +++++ b/libde265/image.cc ++@@ -453,8 +453,9 @@ de265_error de265_image::alloc_image(int w,int h, enum de265_chroma c, ++ ++ // CTB info ++ ++- if (ctb_info.width_in_units != sps->PicWidthInCtbsY || ++- ctb_info.height_in_units != sps->PicHeightInCtbsY) +++ if (ctb_info.width_in_units != sps->PicWidthInCtbsY || +++ ctb_info.height_in_units != sps->PicHeightInCtbsY || +++ ctb_info.log2unitSize != sps->Log2CtbSizeY) ++ { ++ delete[] ctb_progress; ++ ++diff --git a/libde265/image.h b/libde265/image.h ++index 0a0c0e3..7908fe3 100644 ++--- a/libde265/image.h +++++ b/libde265/image.h ++@@ -149,7 +149,7 @@ template class MetaDataArray ++ // private: ++ DataUnit* data; ++ int data_size; ++- int log2unitSize; +++ uint8_t log2unitSize; ++ int width_in_units; ++ int height_in_units; ++ }; diff --cc debian/patches/CVE-2026-45382.patch index 0000000,0000000..f149f26 new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2026-45382.patch @@@ -1,0 -1,0 +1,58 @@@ ++Description: CVE-2026-45382: Heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometry ++Origin: https://github.com/strukturag/libde265/commit/c33b4f63ae9056b00f34a31874fed55cd0aa29c9 ++Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9 ++ ++From c33b4f63ae9056b00f34a31874fed55cd0aa29c9 Mon Sep 17 00:00:00 2001 ++From: Dirk Farin ++Date: Sun, 10 May 2026 19:57:18 +0200 ++Subject: [PATCH] fix CTB OOB access when pps.sps mismatches active sps ++ (GHSA-hwhx-x2mq-ccr9) ++ ++--- ++ libde265/decctx.cc | 16 ++++++++++++++++ ++ 1 file changed, 16 insertions(+) ++ ++diff --git a/libde265/decctx.cc b/libde265/decctx.cc ++index 70968c1f..45d04665 100644 ++--- a/libde265/decctx.cc +++++ b/libde265/decctx.cc ++@@ -861,6 +861,11 @@ de265_error decoder_context::decode_slice_unit_WPP(image_unit* imgunit, ++ tctx->img = img; ++ tctx->imgunit = imgunit; ++ tctx->sliceunit= sliceunit; +++ +++ if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) { +++ err = DE265_WARNING_SLICEHEADER_INVALID; +++ break; +++ } ++ tctx->CtbAddrInTS = pps.CtbAddrRStoTS[ctbAddrRS]; ++ ++ init_thread_context(tctx); ++@@ -937,6 +942,12 @@ de265_error decoder_context::decode_slice_unit_tiles(image_unit* imgunit, ++ ++ // first CTB in this slice ++ int ctbAddrRS = shdr->slice_segment_address; +++ +++ // pps.TileIdRS and pps.CtbAddrRStoTS are both sized to PicSizeInCtbsY in +++ // set_derived_values(), so one bound covers both accesses below. +++ if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) { +++ return DE265_WARNING_SLICEHEADER_INVALID; +++ } ++ int tileID = pps.TileIdRS[ctbAddrRS]; ++ ++ for (int entryPt=0;entryPt= pps.CtbAddrRStoTS.size()) { +++ err = DE265_WARNING_SLICEHEADER_INVALID; +++ break; +++ } ++ } ++ ++ // set thread context ++-- ++2.55.0 ++ diff --cc debian/patches/CVE-2026-45383.patch index 0000000,0000000..d2de205 new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2026-45383.patch @@@ -1,0 -1,0 +1,22 @@@ ++Description: CVE-2026-45383: prevent reading past end of CtbAddrRStoTS[] in WPP images ++ In the WPP slice decoder ctbAddrRS = ctbRow * ctbsWidth can exceed the ++ allocated vector size, causing out-of-bounds reads. ++Origin: upstream, https://github.com/strukturag/libde265/commit/d1a2c3b4b751d21f44e8e82220fe9766c9d116ff ++Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38 ++Applied-Upstream: 1.0.19 ++ ++diff --git a/libde265/decctx.cc b/libde265/decctx.cc ++index ea2e2136..ed8709d8 100644 ++--- a/libde265/decctx.cc +++++ b/libde265/decctx.cc ++@@ -1291,6 +1291,10 @@ de265_error decoder_context::decode_slice_unit_WPP(image_unit* imgunit, ++ int ctbAddrRS = shdr->slice_segment_address; ++ int ctbRow = ctbAddrRS / ctbsWidth; ++ +++ if (ctbRow + nRows > img->get_sps().PicHeightInCtbsY) { +++ return DE265_WARNING_SLICEHEADER_INVALID; +++ } +++ ++ for (int entryPt=0;entryPt0) { diff --cc debian/patches/CVE-2026-49295.patch index 0000000,0000000..c90ec0c new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2026-49295.patch @@@ -1,0 -1,0 +1,36 @@@ ++Description: CVE-2026-49295: bound aggregate short-term RPS size ++ Missing aggregate bound check on predicted reference picture set entries ++ allows exceeding the 16-entry array, an out-of-bounds array write in ++ process_reference_picture_set(). ++Origin: upstream, https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b ++Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594 ++Bug-Debian: https://bugs.debian.org/1140431 ++Applied-Upstream: 1.1.0 ++ ++diff --git a/libde265/refpic.cc b/libde265/refpic.cc ++index 77cc719e..ab7de2a6 100644 ++--- a/libde265/refpic.cc +++++ b/libde265/refpic.cc ++@@ -318,6 +318,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue, ++ ++ out_set->compute_derived_values(); ++ +++ // The unused short-term references are all collected into a single PocStFoll array +++ // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set). +++ // While each individual list is bounded above, the predicted-RPS construction can +++ // append the current-picture delta to an already-full source set, pushing the +++ // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds +++ // write when filling PocStFoll. +++ if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) { +++ out_set->NumNegativePics = 0; +++ out_set->NumPositivePics = 0; +++ out_set->NumDeltaPocs = 0; +++ out_set->NumPocTotalCurr_shortterm_only = 0; +++ +++ errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false); +++ return false; +++ } +++ ++ return true; ++ } ++ diff --cc debian/patches/CVE-2026-49337.patch index 0000000,0000000..9da98e5 new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2026-49337.patch @@@ -1,0 -1,0 +1,48 @@@ ++Description: CVE-2026-49337: free orphaned slice header when no active image unit ++ Slice headers attached to finished pictures without an active image unit ++ were retained forever; a crafted NAL sequence can grow memory without ++ bound during continuous streaming. ++Origin: upstream, https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9 ++Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm ++Bug-Debian: https://bugs.debian.org/1140431 ++Applied-Upstream: 1.1.0 ++Comment: Backport: on 1.0.15 the pre-existing unconditional add_slice_segment_header() call must be removed (upstream moves it into the guarded block); keeping both would double-free every slice header. ++ ++diff --git a/libde265/decctx.cc b/libde265/decctx.cc ++index ed8709d8..8383dd2b 100644 ++--- a/libde265/decctx.cc +++++ b/libde265/decctx.cc ++@@ -928,8 +928,6 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na ++ return err; ++ } ++ ++- this->img->add_slice_segment_header(shdr); ++- ++ skip_bits(&reader,1); // TODO: why? ++ prepare_for_CABAC(&reader); ++ ++@@ -957,6 +955,13 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na ++ ++ if ( ! image_units.empty() ) { ++ +++ // Hand the slice header to the picture (which takes ownership and frees it +++ // on release). Only do this when there is an active image unit to decode +++ // the slice; otherwise the header would be retained on img->slices forever, +++ // which a crafted stream of non-first slice NALs can exploit to grow memory +++ // without bound. +++ this->img->add_slice_segment_header(shdr); +++ ++ slice_unit* sliceunit = new slice_unit(this); ++ sliceunit->nal = nal; ++ sliceunit->shdr = shdr; ++@@ -967,6 +972,10 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na ++ ++ image_units.back()->slice_units.push_back(sliceunit); ++ } +++ else { +++ nal_parser.free_NAL_unit(nal); +++ delete shdr; +++ } ++ ++ bool did_work; ++ err = decode_some(&did_work); diff --cc debian/patches/CVE-2026-49346.patch index 0000000,0000000..59b9611 new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2026-49346.patch @@@ -1,0 -1,0 +1,98 @@@ ++Description: CVE-2026-49346: fix integer overflow in image plane allocation size ++ Large SPS dimensions with 16-bit bit depth overflow the 32-bit allocation ++ size in de265_image_get_buffer(); the wrapped ~1 KB allocation is later ++ written with the full plane size, corrupting the heap. ++Origin: upstream, https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8 ++Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86 ++Bug-Debian: https://bugs.debian.org/1140431 ++Applied-Upstream: 1.1.0 ++ ++diff --git a/libde265/image.cc b/libde265/image.cc ++index 0ae77511..9ddfed2c 100644 ++--- a/libde265/image.cc +++++ b/libde265/image.cc ++@@ -71,10 +71,11 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx, ++ void* inputdata, int inputstride, void *userdata) ++ { ++ int alignment = STANDARD_ALIGNMENT; ++- int stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment; ++- int height = img->get_height(cIdx); +++ uint32_t stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment; +++ uint32_t height = img->get_height(cIdx); ++ ++- uint8_t* p = (uint8_t *)ALLOC_ALIGNED_16(stride * height + MEMORY_PADDING); +++ // size computed in size_t: stride*height can exceed UINT32_MAX for large planes +++ uint8_t* p = static_cast(ALLOC_ALIGNED_16(static_cast(stride) * height + MEMORY_PADDING)); ++ ++ if (p==NULL) { return NULL; } ++ ++@@ -82,13 +83,15 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx, ++ ++ // copy input data if provided ++ ++- if (inputdata != NULL) { ++- if (inputstride == stride) { ++- memcpy(p, inputdata, stride*height); +++ if (inputdata != nullptr) { +++ if (inputstride == static_cast(stride)) { +++ memcpy(p, inputdata, static_cast(stride) * height); ++ } ++ else { ++- for (int y=0;y(y) * stride, +++ static_cast(inputdata) + static_cast(inputstride) * y, +++ inputstride); ++ } ++ } ++ } ++@@ -108,30 +111,35 @@ LIBDE265_API void de265_free_image_plane(struct de265_image* img, int cIdx) ++ static int de265_image_get_buffer(de265_decoder_context* ctx, ++ de265_image_spec* spec, de265_image* img, void* userdata) ++ { ++- const int rawChromaWidth = spec->width / img->SubWidthC; ++- const int rawChromaHeight = spec->height / img->SubHeightC; +++ const uint32_t rawChromaWidth = spec->width / img->SubWidthC; +++ const uint32_t rawChromaHeight = spec->height / img->SubHeightC; ++ ++- int luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment; ++- int chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment; +++ uint32_t luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment; +++ uint32_t chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment; ++ ++ assert(img->BitDepth_Y >= 8 && img->BitDepth_Y <= 16); ++ assert(img->BitDepth_C >= 8 && img->BitDepth_C <= 16); ++ ++- int luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8); ++- int chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8); +++ uint32_t luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8); +++ uint32_t chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8); ++ ++- int luma_height = spec->height; ++- int chroma_height = rawChromaHeight; +++ uint32_t luma_height = spec->height; +++ uint32_t chroma_height = rawChromaHeight; ++ ++ bool alloc_failed = false; ++ ++- uint8_t* p[3] = { 0,0,0 }; ++- p[0] = (uint8_t *)ALLOC_ALIGNED_16(luma_height * luma_bpl + MEMORY_PADDING); ++- if (p[0]==NULL) { alloc_failed=true; } +++ // Compute the plane sizes in size_t. Each operand fits in uint32_t, but the +++ // height * bytes-per-line product can exceed UINT32_MAX for large frames, so +++ // the multiplication must be done in 64 bits. Computing it in 32 bits wraps +++ // the allocation size to a small value while fill_image() later writes the +++ // real (size_t) size -> heap buffer overflow (GHSA-vv8h-932h-7r86). +++ uint8_t* p[3] = { nullptr,nullptr,nullptr }; +++ p[0] = static_cast(ALLOC_ALIGNED_16(static_cast(luma_height) * luma_bpl + MEMORY_PADDING)); +++ if (p[0]==nullptr) { alloc_failed=true; } ++ ++ if (img->get_chroma_format() != de265_chroma_mono) { ++- p[1] = (uint8_t *)ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING); ++- p[2] = (uint8_t *)ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING); +++ p[1] = static_cast(ALLOC_ALIGNED_16(static_cast(chroma_height) * chroma_bpl + MEMORY_PADDING)); +++ p[2] = static_cast(ALLOC_ALIGNED_16(static_cast(chroma_height) * chroma_bpl + MEMORY_PADDING)); ++ ++ if (p[1]==NULL || p[2]==NULL) { alloc_failed=true; } ++ } diff --cc debian/patches/CVE-2026-54240_CVE-2026-54241.patch index 0000000,0000000..80f17a2 new file mode 100644 --- /dev/null +++ b/debian/patches/CVE-2026-54240_CVE-2026-54241.patch @@@ -1,0 -1,0 +1,394 @@@ ++Description: CVE-2026-54240, CVE-2026-54241: fix pixel-accessor integer overflow ++ The image pixel accessors computed xpos + ypos*stride in signed 32-bit ++ arithmetic; frames with width*height > INT32_MAX wrap the offset and the ++ returned pointer lands far outside the buffer (OOB read/write). Widen ++ stride/offset math to 64 bits and store validated SPS dimensions in ++ uint16_t. ++Origin: upstream, https://github.com/strukturag/libde265/commit/bdca87569b9c63c2a7054d90ae4462dbb78d159a ++Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3 ++Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr ++Applied-Upstream: 1.1.1 ++ ++diff --git a/libde265/de265.cc b/libde265/de265.cc ++index 6ff01918..571ed06b 100644 ++--- a/libde265/de265.cc +++++ b/libde265/de265.cc ++@@ -672,7 +672,7 @@ LIBDE265_API const uint8_t* de265_get_image_plane(const de265_image* img, int ch ++ ++ uint8_t* data = img->pixels_confwin[channel]; ++ ++- if (stride) *stride = img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8); +++ if (stride) *stride = static_cast(img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8)); ++ ++ return data; ++ } ++diff --git a/libde265/image-io.cc b/libde265/image-io.cc ++index 49837837..c6370bcd 100644 ++--- a/libde265/image-io.cc +++++ b/libde265/image-io.cc ++@@ -73,7 +73,7 @@ de265_image* ImageSource_YUV::read_next_image() ++ // --- load image --- ++ ++ uint8_t* p; ++- int stride; +++ ptrdiff_t stride; ++ ++ p = img->get_image_plane(0); stride = img->get_image_stride(0); ++ for (int y=0;yget_width(); ++ int height= img->get_height(); ++diff --git a/libde265/image.cc b/libde265/image.cc ++index 9ddfed2c..9beeb07e 100644 ++--- a/libde265/image.cc +++++ b/libde265/image.cc ++@@ -183,7 +183,7 @@ de265_image_allocation de265_image::default_image_allocation = { ++ }; ++ ++ ++-void de265_image::set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata) +++void de265_image::set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata) ++ { ++ pixels[cIdx] = mem; ++ plane_user_data[cIdx] = userdata; ++diff --git a/libde265/image.h b/libde265/image.h ++index 0a0c0e32..c514429d 100644 ++--- a/libde265/image.h +++++ b/libde265/image.h ++@@ -26,6 +26,7 @@ ++ #endif ++ ++ #include +++#include ++ #include ++ #include ++ #include ++@@ -254,11 +255,11 @@ struct de265_image { ++ /* */ uint8_t* get_image_plane(int cIdx) { return pixels[cIdx]; } ++ const uint8_t* get_image_plane(int cIdx) const { return pixels[cIdx]; } ++ ++- void set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata); +++ void set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata); ++ ++ uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos) ++ { ++- int stride = get_image_stride(cIdx); +++ ptrdiff_t stride = get_image_stride(cIdx); ++ return pixels[cIdx] + xpos + ypos*stride; ++ } ++ ++@@ -267,38 +268,38 @@ struct de265_image { ++ template ++ pixel_t* get_image_plane_at_pos_NEW(int cIdx, int xpos,int ypos) ++ { ++- int stride = get_image_stride(cIdx); +++ ptrdiff_t stride = get_image_stride(cIdx); ++ return (pixel_t*)(pixels[cIdx] + (xpos + ypos*stride)*sizeof(pixel_t)); ++ } ++ ++ const uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos) const ++ { ++- int stride = get_image_stride(cIdx); +++ ptrdiff_t stride = get_image_stride(cIdx); ++ return pixels[cIdx] + xpos + ypos*stride; ++ } ++ ++ void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos) ++ { ++- int stride = get_image_stride(cIdx); +++ ptrdiff_t stride = get_image_stride(cIdx); ++ return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]); ++ } ++ ++ const void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos) const ++ { ++- int stride = get_image_stride(cIdx); +++ ptrdiff_t stride = get_image_stride(cIdx); ++ return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]); ++ } ++ ++ /* Number of pixels in one row (not number of bytes). ++ */ ++- int get_image_stride(int cIdx) const +++ ptrdiff_t get_image_stride(int cIdx) const ++ { ++ if (cIdx==0) return stride; ++ else return chroma_stride; ++ } ++ ++- int get_luma_stride() const { return stride; } ++- int get_chroma_stride() const { return chroma_stride; } +++ ptrdiff_t get_luma_stride() const { return stride; } +++ ptrdiff_t get_chroma_stride() const { return chroma_stride; } ++ ++ int get_width (int cIdx=0) const { return cIdx==0 ? width : chroma_width; } ++ int get_height(int cIdx=0) const { return cIdx==0 ? height : chroma_height; } ++@@ -352,8 +353,8 @@ private: ++ ++ int width, height; // size in luma pixels ++ ++- int chroma_width, chroma_height; ++- int stride, chroma_stride; +++ int chroma_width = 0, chroma_height = 0; +++ ptrdiff_t stride = 0, chroma_stride = 0; ++ ++ public: ++ uint8_t BitDepth_Y, BitDepth_C; ++diff --git a/libde265/intrapred.h b/libde265/intrapred.h ++index 5c997908..2b224879 100644 ++--- a/libde265/intrapred.h +++++ b/libde265/intrapred.h ++@@ -533,7 +533,7 @@ void intra_border_computer::fill_from_image() ++ assert(nT<=32); ++ ++ pixel_t* image; ++- int stride; +++ ptrdiff_t stride; ++ image = (pixel_t*)img->get_image_plane(cIdx); ++ stride = img->get_image_stride(cIdx); ++ ++diff --git a/libde265/motion.cc b/libde265/motion.cc ++index 0ddfaabd..35030064 100644 ++--- a/libde265/motion.cc +++++ b/libde265/motion.cc ++@@ -50,7 +50,7 @@ void mc_luma(const base_context* ctx, ++ const seq_parameter_set* sps, int mv_x, int mv_y, ++ int xP,int yP, ++ int16_t* out, int out_stride, ++- const pixel_t* ref, int ref_stride, +++ const pixel_t* ref, ptrdiff_t ref_stride, ++ int nPbW, int nPbH, int bitDepth_L) ++ { ++ int xFracL = mv_x & 3; ++@@ -129,7 +129,7 @@ void mc_luma(const base_context* ctx, ++ pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+7)]; ++ ++ const pixel_t* src_ptr; ++- int src_stride; +++ ptrdiff_t src_stride; ++ ++ if (-extra_left + xIntOffsL >= 0 && ++ -extra_top + yIntOffsL >= 0 && ++@@ -176,7 +176,7 @@ void mc_chroma(const base_context* ctx, ++ int mv_x, int mv_y, ++ int xP,int yP, ++ int16_t* out, int out_stride, ++- const pixel_t* ref, int ref_stride, +++ const pixel_t* ref, ptrdiff_t ref_stride, ++ int nPbWC, int nPbHC, int bit_depth_C) ++ { ++ // chroma sample interpolation process (8.5.3.2.2.2) ++@@ -222,7 +222,7 @@ void mc_chroma(const base_context* ctx, ++ pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+3)]; ++ ++ const pixel_t* src_ptr; ++- int src_stride; +++ ptrdiff_t src_stride; ++ ++ int extra_top = 1; ++ int extra_left = 1; ++diff --git a/libde265/sao.cc b/libde265/sao.cc ++index 1b88a102..92125db0 100644 ++--- a/libde265/sao.cc +++++ b/libde265/sao.cc ++@@ -28,8 +28,8 @@ ++ template ++ void apply_sao_internal(de265_image* img, int xCtb,int yCtb, ++ const slice_segment_header* shdr, int cIdx, int nSW,int nSH, ++- const pixel_t* in_img, int in_stride, ++- /* */ pixel_t* out_img, int out_stride) +++ const pixel_t* in_img, ptrdiff_t in_stride, +++ /* */ pixel_t* out_img, ptrdiff_t out_stride) ++ { ++ const sao_info* saoinfo = img->get_sao_info(xCtb,yCtb); ++ ++@@ -77,7 +77,7 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb, ++ ++ if (SaoTypeIdx==2) { ++ int hPos[2], vPos[2]; ++- int vPosStride[2]; // vPos[] multiplied by image stride +++ ptrdiff_t vPosStride[2]; // vPos[] multiplied by image stride ++ int SaoEoClass = (saoinfo->SaoEoClass >> (2*cIdx)) & 0x3; ++ ++ switch (SaoEoClass) { ++@@ -277,8 +277,8 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb, ++ template ++ void apply_sao(de265_image* img, int xCtb,int yCtb, ++ const slice_segment_header* shdr, int cIdx, int nSW,int nSH, ++- const pixel_t* in_img, int in_stride, ++- /* */ pixel_t* out_img, int out_stride) +++ const pixel_t* in_img, ptrdiff_t in_stride, +++ /* */ pixel_t* out_img, ptrdiff_t out_stride) ++ { ++ if (img->high_bit_depth(cIdx)) { ++ apply_sao_internal(img,xCtb,yCtb, shdr,cIdx,nSW,nSH, ++@@ -343,8 +343,8 @@ void apply_sample_adaptive_offset_sequential(de265_image* img) ++ return; ++ } ++ ++- int lumaImageSize = img->get_image_stride(0) * img->get_height(0) * img->get_bytes_per_pixel(0); ++- int chromaImageSize = img->get_image_stride(1) * img->get_height(1) * img->get_bytes_per_pixel(1); +++ size_t lumaImageSize = static_cast(img->get_image_stride(0)) * img->get_height(0) * img->get_bytes_per_pixel(0); +++ size_t chromaImageSize = static_cast(img->get_image_stride(1)) * img->get_height(1) * img->get_bytes_per_pixel(1); ++ ++ uint8_t* inputCopy = new uint8_t[ libde265_max(lumaImageSize, chromaImageSize) ]; ++ if (inputCopy == NULL) { ++@@ -358,10 +358,10 @@ void apply_sample_adaptive_offset_sequential(de265_image* img) ++ ++ for (int cIdx=0;cIdxget_image_stride(cIdx); +++ ptrdiff_t stride = img->get_image_stride(cIdx); ++ int height = img->get_height(cIdx); ++ ++- memcpy(inputCopy, img->get_image_plane(cIdx), stride * height * img->get_bytes_per_pixel(cIdx)); +++ memcpy(inputCopy, img->get_image_plane(cIdx), static_cast(stride) * height * img->get_bytes_per_pixel(cIdx)); ++ ++ for (int yCtb=0; yCtb(data); +++ ptrdiff_t stride16 = stride / 2; ++ for (int y=0; y> 8 ) ^ ( y >> 8 ); ++@@ -222,7 +225,7 @@ static inline uint16_t crc_process_byte_parallel(uint16_t crc, uint8_t byte) ++ (t << 12)) & 0xFFFF; ++ } ++ ++-static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride, int bit_depth) +++static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,ptrdiff_t stride, int bit_depth) ++ { ++ raw_hash_data raw_data(w,stride); ++ ++@@ -248,7 +251,7 @@ static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride ++ } ++ ++ ++-static void compute_MD5(uint8_t* data,int w,int h,int stride, uint8_t* result, int bit_depth) +++static void compute_MD5(uint8_t* data,int w,int h,ptrdiff_t stride, uint8_t* result, int bit_depth) ++ { ++ MD5_CTX md5; ++ MD5_Init(&md5); ++@@ -287,7 +290,8 @@ static de265_error process_sei_decoded_picture_hash(const sei_message* sei, de26 ++ int nHashes = img->get_sps().chroma_format_idc==0 ? 1 : 3; ++ for (int i=0;iget_width(i); ++ h = img->get_height(i); ++@@ -339,7 +343,7 @@ static de265_error process_sei_decoded_picture_hash(const sei_message* sei, de26 ++ ++ case sei_decoded_picture_hash_type_checksum: ++ { ++- uint32_t chksum = compute_checksum_8bit(data,w,h,stride, img->get_bit_depth(i)); +++ uint32_t chksum = compute_checksum(data,w,h,stride, img->get_bit_depth(i)); ++ ++ if (chksum != seihash->checksum[i]) { ++ /* ++diff --git a/libde265/sps.cc b/libde265/sps.cc ++index 0652e426..29409fc5 100644 ++--- a/libde265/sps.cc +++++ b/libde265/sps.cc ++@@ -521,7 +521,7 @@ de265_error seq_parameter_set::compute_derived_values(bool sanitize_values) ++ PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY); ++ PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY; ++ PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY; ++- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples; +++ PicSizeInSamplesY = static_cast(pic_width_in_luma_samples) * pic_height_in_luma_samples; ++ ++ if (chroma_format_idc==0 || separate_colour_plane_flag) { ++ CtbWidthC = 0; ++@@ -1276,7 +1276,7 @@ de265_error seq_parameter_set::write(error_queue* errqueue, CABAC_encoder& out) ++ PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY); ++ PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY; ++ PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY; ++- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples; +++ PicSizeInSamplesY = static_cast(pic_width_in_luma_samples) * pic_height_in_luma_samples; ++ if (chroma_format_idc==0 || separate_colour_plane_flag) { ++ CtbWidthC = 0; ++ CtbHeightC = 0; ++diff --git a/libde265/sps.h b/libde265/sps.h ++index 9759bae0..18be31b2 100644 ++--- a/libde265/sps.h +++++ b/libde265/sps.h ++@@ -39,6 +39,13 @@ class error_queue; ++ #define MAX_PICTURE_WIDTH 65535 ++ #define MAX_PICTURE_HEIGHT 65535 ++ +++// pic_width/height_in_luma_samples are stored as uint16_t and PicSizeInSamplesY as uint32_t, +++// so these limits must keep width/height in 16 bits and their product in 32 bits. +++static_assert(MAX_PICTURE_WIDTH <= 0xFFFF, "picture width must fit in uint16_t"); +++static_assert(MAX_PICTURE_HEIGHT <= 0xFFFF, "picture height must fit in uint16_t"); +++static_assert((uint64_t)MAX_PICTURE_WIDTH * MAX_PICTURE_HEIGHT <= 0xFFFFFFFFu, +++ "total luma sample count must fit in uint32_t"); +++ ++ enum { ++ CHROMA_MONO = 0, ++ CHROMA_420 = 1, ++@@ -110,10 +117,10 @@ public: ++ int seq_parameter_set_id; ++ int chroma_format_idc; ++ ++- char separate_colour_plane_flag; ++- int pic_width_in_luma_samples; ++- int pic_height_in_luma_samples; ++- char conformance_window_flag; +++ bool separate_colour_plane_flag; +++ uint16_t pic_width_in_luma_samples; // <= MAX_PICTURE_WIDTH (validated on parse) +++ uint16_t pic_height_in_luma_samples; // <= MAX_PICTURE_HEIGHT (validated on parse) +++ bool conformance_window_flag; ++ ++ int conf_win_left_offset; ++ int conf_win_right_offset; diff --cc debian/patches/TEMP-0000000-BB5891.patch index 0000000,0000000..5134d93 new file mode 100644 --- /dev/null +++ b/debian/patches/TEMP-0000000-BB5891.patch @@@ -1,0 -1,0 +1,207 @@@ ++Description: Double Free / Use after Free ++ Concurrent Execution using Shared Resource with Imprope ++ Synchronization ('Race Condition') and Use After Free and Double Free in ++ libde265. ++ There is no CVE assigned yet. ++Origin: https://github.com/strukturag/libde265/commit/eb346780796055d9f9aac62d725d3170aa60c7b4 ++Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-xp3h-6f5r-8cxp ++Comment: As the version in bookworm does not have StatCoeff_models, those ++ patch parts have been omitted. ++ ++From eb346780796055d9f9aac62d725d3170aa60c7b4 Mon Sep 17 00:00:00 2001 ++From: Dirk Farin ++Date: Wed, 2 Sep 2026 20:09:20 +0200 ++Subject: [PATCH] Fix WPP CABAC context handoff race (GHSA-xp3h-6f5r-8cxp) ++ ++In WPP-threaded decoding, each CTB row task hands its saved CABAC ++context (imgunit->ctx_models[row]) to the row below through ++context_model_table, a hand-rolled refcounted handle whose model and ++refcnt pointers are mutated together by copy, assignment, release(), ++and decouple(). The producer/consumer handoff relied on ++wait_for_progress()/set_progress() to order the accesses, but that ++lock's fast path read a plain non-atomic int with no acquire/release ++barrier, so writes to a row slot were not reliably published across ++threads. Under a crafted stream this let two tasks touch the same ++slot's ownership metadata concurrently, corrupting it and causing ++heap-use-after-free / double-free (confirmed via AddressSanitizer, ++reproducing the double-free in context_model_table::release() at ++the exact reported sites). ++ ++Add a mutex to image_unit guarding the whole copy/release (consumer) ++and assign/decouple (producer) sequence for a row slot, so ownership ++transitions are mutually exclusive. Also make de265_progress_lock's ++progress counter atomic with acquire/release ordering, closing the ++underlying missing-barrier gap that the same fast path exposes to ++every other wait_for_progress() consumer (deblocking, SAO, motion ++readiness). ++ ++Verified: unpatched build reliably double-frees under ASan within a ++few hundred fuzzer iterations; the fixed build stayed clean across ++thousands of iterations of the same reproducers. Decode output is ++unchanged (girlshy.h265 hash matches single- and multi-threaded). ++--- ++ libde265/decctx.h | 19 +++++++++++++++++++ ++ libde265/slice.cc | 40 +++++++++++++++++++++++++++++----------- ++ libde265/threads.cc | 18 +++++++++++------- ++ libde265/threads.h | 11 +++++++++-- ++ 4 files changed, 68 insertions(+), 20 deletions(-) ++ ++--- a/libde265/decctx.h +++++ b/libde265/decctx.h ++@@ -36,6 +36,7 @@ ++ #include "libde265/nal-parser.h" ++ ++ #include +++#include ++ ++ #define DE265_MAX_VPS_SETS 16 // this is the maximum as defined in the standard ++ #define DE265_MAX_SPS_SETS 16 // this is the maximum as defined in the standard ++@@ -267,6 +268,22 @@ ++ There is one saved model for the initialization of each CTB row. ++ The array is unused for non-WPP streams. */ ++ std::vector ctx_models; // TODO: move this into image ? +++ +++ /* Serializes the producer/consumer handoff of the saved WPP row state +++ (ctx_models[] together with StatCoeff_models[]). +++ Each context_model_table is a reference-counted handle whose model +++ pointer, refcnt pointer, and the referenced count are all mutated +++ together by copy construction, assignment, release(), and decouple(). +++ In WPP mode the producer row task stores its context into ctx_models[row] +++ while the consumer row task below copies it out and releases the slot. +++ The progress-lock fast path does not provide an acquire/release barrier +++ around this compound object, so without an explicit lock the two tasks +++ can concurrently mutate the same ownership metadata, corrupting it and +++ causing use-after-free / double-free (GHSA-xp3h-6f5r-8cxp). +++ Holding this mutex across the whole copy/assign/release/decouple of a +++ row slot (on both the producer and consumer side) both excludes +++ concurrent mutation and publishes the writes to the other thread. */ +++ std::mutex ctx_models_mutex; ++ }; ++ ++ ++--- a/libde265/slice.cc +++++ b/libde265/slice.cc ++@@ -4710,9 +4710,18 @@ ++ // we have to wait until the context model data is there ++ tctx->img->wait_for_progress(tctx->task, 1,tctx->CtbY-1,CTB_PROGRESS_PREFILTER); ++ ++- // copy CABAC model from previous CTB row ++- tctx->ctx_model = tctx->imgunit->ctx_models[(tctx->CtbY-1)]; ++- tctx->imgunit->ctx_models[(tctx->CtbY-1)].release(); // not used anymore +++ // Copy CABAC model from the previous CTB row. +++ // The whole handoff of this row slot must be serialized against the +++ // producer that stores into the same slot, because context_model_table +++ // is a reference-counted handle whose ownership metadata is mutated as +++ // a unit by the copy/release below (GHSA-xp3h-6f5r-8cxp). +++ { +++ std::lock_guard lock(tctx->imgunit->ctx_models_mutex); +++ +++ // copy CABAC model from previous CTB row +++ tctx->ctx_model = tctx->imgunit->ctx_models[(tctx->CtbY-1)]; +++ tctx->imgunit->ctx_models[(tctx->CtbY-1)].release(); // not used anymore +++ } ++ } ++ else { ++ tctx->img->wait_for_progress(tctx->task, 0,tctx->CtbY-1,CTB_PROGRESS_PREFILTER); ++@@ -4766,9 +4775,18 @@ ++ return Decode_Error; ++ } ++ ++- tctx->imgunit->ctx_models[ctby] = tctx->ctx_model; ++- tctx->imgunit->ctx_models[ctby].decouple(); // store an independent copy ++- } +++ // Store an independent copy of the CABAC model (and StatCoeff state) for +++ // the row below to pick up. Serialize the whole store against the +++ // consumer that copies/releases the same slot: context_model_table is a +++ // reference-counted handle whose ownership metadata is mutated as a unit +++ // by the assignment/decouple below (GHSA-xp3h-6f5r-8cxp). +++ { +++ std::lock_guard lock(tctx->imgunit->ctx_models_mutex); +++ +++ tctx->imgunit->ctx_models[ctby] = tctx->ctx_model; +++ tctx->imgunit->ctx_models[ctby].decouple(); // store an independent copy +++ } +++ } ++ ++ ++ // end of slice segment ? ++--- a/libde265/threads.cc +++++ b/libde265/threads.cc ++@@ -87,7 +87,7 @@ ++ ++ de265_progress_lock::de265_progress_lock() ++ { ++- mProgress = 0; +++ mProgress.store(0, std::memory_order_relaxed); ++ ++ de265_mutex_init(&mutex); ++ de265_cond_init(&cond); ++@@ -101,12 +101,15 @@ ++ ++ void de265_progress_lock::wait_for_progress(int progress) ++ { ++- if (mProgress >= progress) { +++ // Fast path: acquire-load pairs with the release-store in set_progress()/ +++ // increase_progress() so that everything the signalling thread wrote before +++ // reaching this progress value is visible once we observe it here. +++ if (mProgress.load(std::memory_order_acquire) >= progress) { ++ return; ++ } ++ ++ de265_mutex_lock(&mutex); ++- while (mProgress < progress) { +++ while (mProgress.load(std::memory_order_acquire) < progress) { ++ de265_cond_wait(&cond, &mutex); ++ } ++ de265_mutex_unlock(&mutex); ++@@ -116,8 +119,8 @@ ++ { ++ de265_mutex_lock(&mutex); ++ ++- if (progress>mProgress) { ++- mProgress = progress; +++ if (progress > mProgress.load(std::memory_order_relaxed)) { +++ mProgress.store(progress, std::memory_order_release); ++ ++ de265_cond_broadcast(&cond, &mutex); ++ } ++@@ -129,7 +132,8 @@ ++ { ++ de265_mutex_lock(&mutex); ++ ++- mProgress += progress; +++ mProgress.store(mProgress.load(std::memory_order_relaxed) + progress, +++ std::memory_order_release); ++ de265_cond_broadcast(&cond, &mutex); ++ ++ de265_mutex_unlock(&mutex); ++@@ -137,7 +141,7 @@ ++ ++ int de265_progress_lock::get_progress() const ++ { ++- return mProgress; +++ return mProgress.load(std::memory_order_acquire); ++ } ++ ++ ++--- a/libde265/threads.h +++++ b/libde265/threads.h ++@@ -81,10 +81,16 @@ ++ void set_progress(int progress); ++ void increase_progress(int progress); ++ int get_progress() const; ++- void reset(int value=0) { mProgress=value; } +++ void reset(int value=0) { mProgress.store(value, std::memory_order_release); } ++ ++ private: ++- int mProgress; +++ // Read lock-free on the fast paths of wait_for_progress()/get_progress() +++ // while written under 'mutex'. It must be atomic so those reads are not a +++ // data race, and it carries acquire/release ordering so that the state a +++ // producer wrote before signalling progress (e.g. the saved WPP row context) +++ // is published to a consumer that observes the progress value without taking +++ // the mutex (GHSA-xp3h-6f5r-8cxp). +++ std::atomic mProgress; ++ ++ // private data ++ diff --cc debian/patches/TEMP-0000000-E66AA0.patch index 0000000,0000000..04e2d8d new file mode 100644 --- /dev/null +++ b/debian/patches/TEMP-0000000-E66AA0.patch @@@ -1,0 -1,0 +1,58 @@@ ++Description: heap-use-after-free in decoder_context::reset() via dangling previous_slice_header ++ The issue does not have yet an CVE number assigned. ++Origin: https://github.com/strukturag/libde265/commit/07bc500d45f781a7e2915afb7eebc2d6d9a541c9 ++Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-mm7m-v26f-wf8x ++ ++From 07bc500d45f781a7e2915afb7eebc2d6d9a541c9 Mon Sep 17 00:00:00 2001 ++From: Dirk Farin ++Date: Wed, 2 Sep 2026 23:55:01 +0200 ++Subject: [PATCH] Fix heap-use-after-free in decoder_context::reset() ++ (GHSA-mm7m-v26f-wf8x) ++MIME-Version: 1.0 ++Content-Type: text/plain; charset=UTF-8 ++Content-Transfer-Encoding: 8bit ++ ++decoder_context::reset() calls dpb.clear() which frees all de265_image objects ++and their owned slice_segment_header structs. However, reset() never nulls the ++previous_slice_header pointer, leaving a dangling reference into freed memory. ++ ++When the next NAL unit after reset() is a dependent slice, slice_segment_header::read() ++at slice.cc:435 executes: ++ *this = *ctx->previous_slice_header; ++ ++This copies from freed 1464-byte struct — heap-use-after-free (CWE-416). ++ ++The in-stream case was already guarded by commit 12ba88ec (decctx.cc:556 nulls ++previous_slice_header on first slice of new picture). This fix applies the same ++invariant to the reset() path: only a slice header still retained by a live image ++may remain as previous_slice_header. ++--- ++ libde265/decctx.cc | 10 ++++++++++ ++ 1 file changed, 10 insertions(+) ++ ++--- a/libde265/decctx.cc +++++ b/libde265/decctx.cc ++@@ -201,7 +201,6 @@ ++ set_acceleration_functions(de265_acceleration_AUTO); ++ } ++ ++- ++ decoder_context::decoder_context() ++ { ++ //memset(ctx, 0, sizeof(decoder_context)); ++@@ -396,6 +395,15 @@ ++ ++ img = NULL; ++ +++ // Drop the back-reference to the previous picture's slice header before the +++ // DPB is cleared below. dpb.clear() releases the images, which own and free +++ // their slice_segment_header structs (see de265_image::release()). Leaving +++ // previous_slice_header pointing into that freed storage lets a following +++ // dependent slice read from it (slice.cc: '*this = *ctx->previous_slice_header'), +++ // a heap-use-after-free. This mirrors the in-stream new-picture guard in +++ // read_slice_NAL(): only a slice header still retained by a live image may +++ // remain as previous_slice_header. +++ previous_slice_header = nullptr; ++ ++ // TODO: remove all pending image_units ++ diff --cc debian/patches/disable_tools.patch index 0000000,0000000..506b19d new file mode 100644 --- /dev/null +++ b/debian/patches/disable_tools.patch @@@ -1,0 -1,0 +1,41 @@@ ++Description: Disable building of some internal tools that no longer link ++ because internal symbols are no longer exported. ++Author: Joachim Bauch ++--- a/dec265/Makefile.am +++++ b/dec265/Makefile.am ++@@ -1,5 +1,5 @@ ++ ++-bin_PROGRAMS = dec265 hdrcopy +++bin_PROGRAMS = dec265 ++ ++ AM_CPPFLAGS = -I$(top_srcdir)/libde265 -I$(top_srcdir) ++ ++@@ -9,12 +9,6 @@ ++ dec265_LDADD = ../libde265/libde265.la -lstdc++ ++ dec265_SOURCES = dec265.cc ++ ++-hdrcopy_DEPENDENCIES = ../libde265/libde265.la ++-hdrcopy_CXXFLAGS = ++-hdrcopy_LDFLAGS = ++-hdrcopy_LDADD = ../libde265/libde265.la -lstdc++ ++-hdrcopy_SOURCES = hdrcopy.cc ++- ++ if HAVE_VIDEOGFX ++ dec265_CXXFLAGS += $(VIDEOGFX_CFLAGS) ++ dec265_LDFLAGS += $(VIDEOGFX_LIBS) ++--- a/Makefile.am +++++ b/Makefile.am ++@@ -8,13 +8,6 @@ ++ SUBDIRS+=dec265 ++ endif ++ ++-if ENABLE_ENCODER ++-SUBDIRS+=enc265 ++-endif ++- ++-SUBDIRS+=tools ++-SUBDIRS+=acceleration-speed ++- ++ if ENABLE_SHERLOCK265 ++ SUBDIRS+=sherlock265 ++ endif diff --cc debian/patches/only_export_decoder_api.patch index 0000000,0000000..53b25ce new file mode 100644 --- /dev/null +++ b/debian/patches/only_export_decoder_api.patch @@@ -1,0 -1,0 +1,285 @@@ ++Description: Only export symbols defined in the decoder API. ++ The encoder API is not final yet, so upstream exports all symbols to make ++ development easier. For packaging we only want to expose the public API. ++Author: Joachim Bauch ++--- a/libde265/encoder/Makefile.am +++++ b/libde265/encoder/Makefile.am ++@@ -12,6 +12,18 @@ ++ encpicbuf.h encpicbuf.cc \ ++ sop.h sop.cc ++ +++libde265_encoder_la_CFLAGS = \ +++ $(CFLAG_VISIBILITY) \ +++ -DLIBDE265_EXPORTS +++libde265_encoder_la_CXXFLAGS += \ +++ $(CFLAG_VISIBILITY) \ +++ -DLIBDE265_EXPORTS +++ +++if HAVE_VISIBILITY +++ libde265_encoder_la_CFLAGS += -DHAVE_VISIBILITY +++ libde265_encoder_la_CXXFLAGS += -DHAVE_VISIBILITY +++endif +++ ++ SUBDIRS=algo ++ libde265_encoder_la_LIBADD = algo/libde265_encoder_algo.la ++ ++--- a/libde265/encoder/algo/Makefile.am +++++ b/libde265/encoder/algo/Makefile.am ++@@ -17,5 +17,13 @@ ++ tb-rateestim.h tb-rateestim.cc \ ++ pb-mv.h pb-mv.cc ++ +++libde265_encoder_algo_la_CXXFLAGS += \ +++ $(CFLAG_VISIBILITY) \ +++ -DLIBDE265_EXPORTS +++ +++if HAVE_VISIBILITY +++ libde265_encoder_algo_la_CXXFLAGS += -DHAVE_VISIBILITY +++endif +++ ++ EXTRA_DIST = \ ++ CMakeLists.txt ++--- a/configure.ac +++++ b/configure.ac ++@@ -56,9 +56,7 @@ ++ fi ++ changequote([,])dnl ++ ++-dnl gl_VISIBILITY ++-dnl : In encoder branch, we still export all library symbols : ++-HAVE_VISIBILITY=0 +++gl_VISIBILITY ++ AM_CONDITIONAL([HAVE_VISIBILITY], [test "x$HAVE_VISIBILITY" != "x0"]) ++ ++ # Checks for header files. ++--- a/libde265/image-io.cc +++++ b/libde265/image-io.cc ++@@ -186,7 +186,7 @@ ++ } ++ ++ ++-LIBDE265_API PacketSink_File::~PacketSink_File() +++PacketSink_File::~PacketSink_File() ++ { ++ if (mFH) { ++ fclose(mFH); ++@@ -194,7 +194,7 @@ ++ } ++ ++ ++-LIBDE265_API void PacketSink_File::set_filename(const char* filename) +++void PacketSink_File::set_filename(const char* filename) ++ { ++ assert(mFH==NULL); ++ ++@@ -202,7 +202,7 @@ ++ } ++ ++ ++-LIBDE265_API void PacketSink_File::send_packet(const uint8_t* data, int n) +++void PacketSink_File::send_packet(const uint8_t* data, int n) ++ { ++ uint8_t startCode[3]; ++ startCode[0] = 0; ++--- a/libde265/image-io.h +++++ b/libde265/image-io.h ++@@ -30,17 +30,17 @@ ++ class ImageSource ++ { ++ public: ++- LIBDE265_API ImageSource(); ++- virtual LIBDE265_API ~ImageSource() { } +++ ImageSource(); +++ virtual ~ImageSource() { } ++ ++ //enum ImageStatus { Available, Waiting, EndOfVideo }; ++ ++ //virtual ImageStatus get_status() = 0; ++- virtual LIBDE265_API de265_image* get_image(bool block=true) = 0; ++- virtual LIBDE265_API void skip_frames(int n) = 0; +++ virtual de265_image* get_image(bool block=true) = 0; +++ virtual void skip_frames(int n) = 0; ++ ++- virtual LIBDE265_API int get_width() const = 0; ++- virtual LIBDE265_API int get_height() const = 0; +++ virtual int get_width() const = 0; +++ virtual int get_height() const = 0; ++ }; ++ ++ ++@@ -48,17 +48,17 @@ ++ class ImageSource_YUV : public ImageSource ++ { ++ public: ++- LIBDE265_API ImageSource_YUV(); ++- virtual LIBDE265_API ~ImageSource_YUV(); +++ ImageSource_YUV(); +++ virtual ~ImageSource_YUV(); ++ ++- bool LIBDE265_API set_input_file(const char* filename, int w,int h); +++ bool set_input_file(const char* filename, int w,int h); ++ ++ //virtual ImageStatus get_status(); ++- virtual LIBDE265_API de265_image* get_image(bool block=true); ++- virtual LIBDE265_API void skip_frames(int n); +++ virtual de265_image* get_image(bool block=true); +++ virtual void skip_frames(int n); ++ ++- virtual LIBDE265_API int get_width() const { return width; } ++- virtual LIBDE265_API int get_height() const { return height; } +++ virtual int get_width() const { return width; } +++ virtual int get_height() const { return height; } ++ ++ private: ++ FILE* mFH; ++@@ -74,20 +74,20 @@ ++ class ImageSink ++ { ++ public: ++- virtual LIBDE265_API ~ImageSink() { } +++ virtual ~ImageSink() { } ++ ++- virtual LIBDE265_API void send_image(const de265_image* img) = 0; +++ virtual void send_image(const de265_image* img) = 0; ++ }; ++ ++ class ImageSink_YUV : public ImageSink ++ { ++ public: ++- LIBDE265_API ImageSink_YUV() : mFH(NULL) { } ++- LIBDE265_API ~ImageSink_YUV(); +++ ImageSink_YUV() : mFH(NULL) { } +++ ~ImageSink_YUV(); ++ ++- bool LIBDE265_API set_filename(const char* filename); +++ bool set_filename(const char* filename); ++ ++- virtual LIBDE265_API void send_image(const de265_image* img); +++ virtual void send_image(const de265_image* img); ++ ++ private: ++ FILE* mFH; ++@@ -98,21 +98,21 @@ ++ class PacketSink ++ { ++ public: ++- virtual LIBDE265_API ~PacketSink() { } +++ virtual ~PacketSink() { } ++ ++- virtual LIBDE265_API void send_packet(const uint8_t* data, int n) = 0; +++ virtual void send_packet(const uint8_t* data, int n) = 0; ++ }; ++ ++ ++ class PacketSink_File : public PacketSink ++ { ++ public: ++- LIBDE265_API PacketSink_File(); ++- virtual LIBDE265_API ~PacketSink_File(); +++ PacketSink_File(); +++ virtual ~PacketSink_File(); ++ ++- LIBDE265_API void set_filename(const char* filename); +++ void set_filename(const char* filename); ++ ++- virtual LIBDE265_API void send_packet(const uint8_t* data, int n); +++ virtual void send_packet(const uint8_t* data, int n); ++ ++ private: ++ FILE* mFH; ++--- a/libde265/configparam.h +++++ b/libde265/configparam.h ++@@ -95,7 +95,7 @@ ++ bool hasLongOption() const { return true; } //mLongOption!=NULL; } ++ std::string getLongOption() const { return mLongOption ? std::string(mLongOption) : get_name(); } ++ ++- virtual LIBDE265_API bool processCmdLineArguments(char** argv, int* argc, int idx) { return false; } +++ virtual bool processCmdLineArguments(char** argv, int* argc, int idx) { return false; } ++ ++ ++ ++@@ -132,7 +132,7 @@ ++ virtual std::string get_default_string() const { return default_value ? "true":"false"; } ++ ++ virtual std::string getTypeDescr() const { return "(boolean)"; } ++- virtual LIBDE265_API bool processCmdLineArguments(char** argv, int* argc, int idx) { set(true); return true; } +++ virtual bool processCmdLineArguments(char** argv, int* argc, int idx) { set(true); return true; } ++ ++ bool set(bool v) { value_set=true; value=v; return true; } ++ ++@@ -162,10 +162,10 @@ ++ virtual bool has_default() const { return default_set; } ++ ++ void set_default(std::string v) { default_value=v; default_set=true; } ++- virtual LIBDE265_API std::string get_default_string() const { return default_value; } +++ virtual std::string get_default_string() const { return default_value; } ++ ++- virtual LIBDE265_API std::string getTypeDescr() const { return "(string)"; } ++- virtual LIBDE265_API bool processCmdLineArguments(char** argv, int* argc, int idx); +++ virtual std::string getTypeDescr() const { return "(string)"; } +++ virtual bool processCmdLineArguments(char** argv, int* argc, int idx); ++ ++ bool set(std::string v) { value_set=true; value=v; return true; } ++ ++@@ -201,10 +201,10 @@ ++ virtual bool has_default() const { return default_set; } ++ ++ void set_default(int v) { default_value=v; default_set=true; } ++- virtual LIBDE265_API std::string get_default_string() const; +++ virtual std::string get_default_string() const; ++ ++- virtual LIBDE265_API std::string getTypeDescr() const; ++- virtual LIBDE265_API bool processCmdLineArguments(char** argv, int* argc, int idx); +++ virtual std::string getTypeDescr() const; +++ virtual bool processCmdLineArguments(char** argv, int* argc, int idx); ++ ++ bool set(int v) { ++ if (is_valid(v)) { value_set=true; value=v; return true; } ++@@ -239,7 +239,7 @@ ++ virtual std::vector get_choice_names() const = 0; ++ ++ virtual std::string getTypeDescr() const; ++- virtual LIBDE265_API bool processCmdLineArguments(char** argv, int* argc, int idx); +++ virtual bool processCmdLineArguments(char** argv, int* argc, int idx); ++ ++ const char** get_choices_string_table() const; ++ ++@@ -368,10 +368,10 @@ ++ config_parameters() : param_string_table(NULL) { } ++ ~config_parameters() { delete[] param_string_table; } ++ ++- void LIBDE265_API add_option(option_base* o); +++ void add_option(option_base* o); ++ ++- void LIBDE265_API print_params() const; ++- bool LIBDE265_API parse_command_line_params(int* argc, char** argv, int* first_idx=NULL, +++ void print_params() const; +++ bool parse_command_line_params(int* argc, char** argv, int* first_idx=NULL, ++ bool ignore_unknown_options=false); ++ ++ ++--- a/libde265/quality.h +++++ b/libde265/quality.h ++@@ -26,11 +26,11 @@ ++ #include ++ ++ ++-LIBDE265_API uint32_t SSD(const uint8_t* img, int imgStride, +++uint32_t SSD(const uint8_t* img, int imgStride, ++ const uint8_t* ref, int refStride, ++ int width, int height); ++ ++-LIBDE265_API uint32_t SAD(const uint8_t* img, int imgStride, +++uint32_t SAD(const uint8_t* img, int imgStride, ++ const uint8_t* ref, int refStride, ++ int width, int height); ++ ++@@ -41,7 +41,7 @@ ++ LIBDE265_API double PSNR(double mse); ++ ++ ++-LIBDE265_API uint32_t compute_distortion_ssd(const de265_image* img1, const de265_image* img2, +++uint32_t compute_distortion_ssd(const de265_image* img1, const de265_image* img2, ++ int x0, int y0, int log2size, int cIdx); ++ ++ #endif diff --cc debian/patches/recycle_sps_if_possible.patch index 0000000,0000000..5ce2fe5 new file mode 100644 --- /dev/null +++ b/debian/patches/recycle_sps_if_possible.patch @@@ -1,0 -1,0 +1,340 @@@ ++Description: Don't update sps if they are only repeated ++Origin: https://github.com/strukturag/libde265/pull/372 ++From 51f07f132f29832e025a8b913b61cbd20257c5fc Mon Sep 17 00:00:00 2001 ++From: Tobias Frost ++Date: Fri, 13 Jan 2023 12:22:45 +0100 ++Subject: [PATCH] Don't update sps if they are only repeated ++ ++This is an attempt to improve the mitigations from #365 and #366 and picks up an idea I described at #345: ++ ++> One way would be just to look at the pointers of the SPS (fast and easy, but ++> may reject more than required), or investigate if the SPS used for the image ++> generations are "compatible". ++ ++This changes do exactly this: It (very conservativly) checks if the old and new sps have ++identical information -- except the reference picture set, which I believe is supposed ++to be updated by new sps'). If they are basically identical, the old sps will be ++used instead of the new one, (of course, reference image set is updated from the new one) ++ ++I'm using standalone operator== and helper functions to avoid changing ABI of the library; ++if an ABI bump would be done, of course this should go to the respective classes. ++--- ++ libde265/decctx.cc | 273 +++++++++++++++++++++++++++++++++++++++++++++ ++ libde265/sps.cc | 6 + ++ 2 files changed, 279 insertions(+) ++ ++diff --git a/libde265/decctx.cc b/libde265/decctx.cc ++index 6701725f..0000b25d 100644 ++--- a/libde265/decctx.cc +++++ b/libde265/decctx.cc ++@@ -545,6 +545,263 @@ de265_error decoder_context::read_vps_NAL(bitreader& reader) ++ return DE265_OK; ++ } ++ +++// implemented as freestanding functions to avoid changing API +++ +++bool operator==(const profile_data &lhs, const profile_data &rhs) { +++ if(&lhs == &rhs) return true; +++ if(lhs.profile_present_flag != rhs.profile_present_flag ) return false; +++ if(lhs.profile_present_flag) { +++ if(lhs.profile_space != rhs.profile_space ) return false; +++ if(lhs.tier_flag != rhs.tier_flag ) return false; +++ if(lhs.profile_idc != rhs.profile_idc ) return false; +++ +++ if(memcmp(lhs.profile_compatibility_flag, rhs.profile_compatibility_flag, sizeof(rhs.profile_compatibility_flag)) ) return false; +++ +++ if(lhs.progressive_source_flag != rhs.progressive_source_flag ) return false; +++ if(lhs.interlaced_source_flag != rhs.interlaced_source_flag ) return false; +++ if(lhs.non_packed_constraint_flag != rhs.non_packed_constraint_flag ) return false; +++ if(lhs.frame_only_constraint_flag != rhs.frame_only_constraint_flag ) return false; +++ } +++ +++ if(lhs.level_present_flag != rhs.level_present_flag) return false; +++ if(lhs.level_present_flag && lhs.level_idc != rhs.level_idc ) return false; +++ +++ return true; +++} +++ +++bool operator!=(const profile_data &lhs, const profile_data &rhs) { +++ if(&lhs == &rhs) return false; +++ return (!(lhs==rhs)); +++} +++ +++// class does not store max_sub_layers, so operator == cannot be done. +++bool isEqual(const profile_tier_level &lhs , const profile_tier_level &rhs, int sps_max_sub_layers ) { +++ if(&lhs == &rhs) return true; +++ +++ if(lhs.general != rhs.general ) return false; +++ for(int i = 0 ; i < sps_max_sub_layers; i++ ) { +++ if(lhs.sub_layer[i] != rhs.sub_layer[i]) return false; +++ } +++ return true; +++} +++ +++bool isEqual(const video_usability_information &lhs, const video_usability_information &rhs, const seq_parameter_set &sps) { +++ if(&lhs == &rhs) return true; +++ +++ // not seen yet if(lhs.nal_hrd_parameters_present_flag != rhs.nal_hrd_parameters_present_flag ) return false; +++ +++ // populated by video_usability_information::read() +++ if(lhs.aspect_ratio_info_present_flag != rhs.aspect_ratio_info_present_flag ) return false; +++ if(lhs.aspect_ratio_info_present_flag) { +++ if(lhs.sar_width != rhs.sar_width ) return false; +++ if(lhs.sar_height != rhs.sar_height ) return false; +++ } +++ +++ if(lhs.overscan_info_present_flag != rhs.overscan_info_present_flag ) return false; +++ if(lhs.overscan_info_present_flag) { +++ if(lhs.overscan_appropriate_flag != rhs.overscan_appropriate_flag ) return false; +++ } +++ +++ if(lhs.video_signal_type_present_flag != rhs.video_signal_type_present_flag ) return false; +++ if(lhs.video_signal_type_present_flag) { +++ if(lhs.video_format != rhs.video_format ) return false; +++ if(lhs.video_full_range_flag != rhs.video_full_range_flag) return false; +++ if(lhs.colour_description_present_flag != rhs.colour_description_present_flag) return false; +++ if(lhs.colour_primaries != rhs.colour_primaries ) return false; +++ if(lhs.transfer_characteristics != rhs.transfer_characteristics ) return false; +++ if(lhs.matrix_coeffs != rhs.matrix_coeffs ) return false; +++ } +++ +++ if(lhs.chroma_loc_info_present_flag != rhs.chroma_loc_info_present_flag ) return false; +++ if(lhs.chroma_loc_info_present_flag) { +++ if(lhs.chroma_sample_loc_type_top_field != rhs.chroma_sample_loc_type_top_field ) return false; +++ if(lhs.chroma_sample_loc_type_bottom_field != rhs.chroma_sample_loc_type_bottom_field ) return false; +++ } +++ if(lhs.neutral_chroma_indication_flag != rhs.neutral_chroma_indication_flag ) return false; +++ if(lhs.field_seq_flag != rhs.field_seq_flag ) return false; +++ if(lhs.frame_field_info_present_flag != rhs.frame_field_info_present_flag ) return false; +++ +++ if(lhs.default_display_window_flag != rhs.default_display_window_flag ) return false; +++ if(lhs.default_display_window_flag) { +++ if(lhs.def_disp_win_left_offset != rhs.def_disp_win_left_offset ) return false; +++ if(lhs.def_disp_win_right_offset != rhs.def_disp_win_right_offset ) return false; +++ if(lhs.def_disp_win_top_offset != rhs.def_disp_win_top_offset ) return false; +++ if(lhs.def_disp_win_bottom_offset != rhs.def_disp_win_bottom_offset ) return false; +++ } +++ +++ if(lhs.vui_timing_info_present_flag != rhs.vui_timing_info_present_flag ) return false; +++ if(lhs.vui_timing_info_present_flag) { +++ if(lhs.vui_num_units_in_tick != rhs.vui_num_units_in_tick ) return false; +++ if(lhs.vui_time_scale != rhs.vui_time_scale ) return false; +++ if(lhs.vui_timing_info_present_flag != rhs.vui_timing_info_present_flag ) return false; +++ if(lhs.vui_timing_info_present_flag) { +++ if(lhs.vui_num_ticks_poc_diff_one != rhs.vui_num_ticks_poc_diff_one ) return false; +++ } +++ } +++ +++ if(lhs.vui_hrd_parameters_present_flag != rhs.vui_hrd_parameters_present_flag ) return false; +++ +++ +++ if(lhs.vui_hrd_parameters_present_flag) { +++ // check things made by hrd_parametes +++ +++ if(lhs.vui_hrd_parameters_present_flag != rhs.vui_hrd_parameters_present_flag ) return false; +++ if(lhs.vcl_hrd_parameters_present_flag != rhs.vcl_hrd_parameters_present_flag ) return false; +++ +++ if(lhs.nal_hrd_parameters_present_flag || lhs.vcl_hrd_parameters_present_flag) { +++ if(lhs.sub_pic_hrd_params_present_flag != rhs.sub_pic_hrd_params_present_flag ) return false; +++ if(lhs.sub_pic_hrd_params_present_flag) { +++ if(lhs.tick_divisor_minus2 != rhs.tick_divisor_minus2 ) return false; +++ if(lhs.du_cpb_removal_delay_increment_length_minus1 != rhs.du_cpb_removal_delay_increment_length_minus1 ) return false; +++ if(lhs.sub_pic_cpb_params_in_pic_timing_sei_flag != rhs.sub_pic_cpb_params_in_pic_timing_sei_flag ) return false; +++ if(lhs.dpb_output_delay_du_length_minus1 != rhs.dpb_output_delay_du_length_minus1 ) return false; +++ } +++ if(lhs.bit_rate_scale != rhs.bit_rate_scale ) return false; +++ if(lhs.cpb_size_scale != rhs.cpb_size_scale ) return false; +++ if(lhs.sub_pic_hrd_params_present_flag) { +++ if(lhs.cpb_size_du_scale != rhs.cpb_size_du_scale ) return false; +++ } +++ if(lhs.initial_cpb_removal_delay_length_minus1 != rhs.initial_cpb_removal_delay_length_minus1 ) return false; +++ if(lhs.au_cpb_removal_delay_length_minus1 != rhs.au_cpb_removal_delay_length_minus1 ) return false; +++ if(lhs.dpb_output_delay_length_minus1 != rhs.dpb_output_delay_length_minus1 ) return false; +++ } +++ +++ int i; +++ unsigned int j, nalOrVcl; +++ +++ for (i = 0; i < sps.sps_max_sub_layers; i++) { +++ if(lhs.fixed_pic_rate_general_flag[i] != rhs.fixed_pic_rate_general_flag[i] ) return false; +++ if(lhs.fixed_pic_rate_general_flag[i]) { +++ if(lhs.elemental_duration_in_tc_minus1[i] != rhs.elemental_duration_in_tc_minus1[i] ) return false; +++ } +++ if(lhs.low_delay_hrd_flag[i] != rhs.low_delay_hrd_flag[i] ) return false; +++ if(lhs.cpb_cnt_minus1[i] != rhs.cpb_cnt_minus1[i] ) return false; +++ +++ for (nalOrVcl = 0; nalOrVcl < 2; nalOrVcl++) { +++ if (((nalOrVcl == 0) && lhs.nal_hrd_parameters_present_flag) || ((nalOrVcl == 1) && lhs.vcl_hrd_parameters_present_flag)) { +++ for (j = 0; j <= lhs.cpb_cnt_minus1[i]; j++) { +++ if(lhs.bit_rate_value_minus1[i][j][nalOrVcl] != rhs.bit_rate_value_minus1[i][j][nalOrVcl]) return false; +++ if(lhs.cpb_size_value_minus1[i][j][nalOrVcl] != rhs.cpb_size_value_minus1[i][j][nalOrVcl]) return false; +++ +++ if (lhs.sub_pic_hrd_params_present_flag) { +++ if(lhs.cpb_size_du_value_minus1[i][j][nalOrVcl] != rhs.cpb_size_du_value_minus1[i][j][nalOrVcl]) return false; +++ if(lhs.bit_rate_du_value_minus1[i][j][nalOrVcl] != rhs.bit_rate_du_value_minus1[i][j][nalOrVcl]) return false; +++ } +++ if( lhs.cbr_flag[i][j][nalOrVcl] != rhs.cbr_flag[i][j][nalOrVcl]) return false; +++ } +++ } +++ } +++ } +++ } +++ return true; +++} +++ +++bool operator==(const sps_range_extension &lhs, const sps_range_extension &rhs) { +++ if(&lhs == &rhs) return true; +++ if(lhs.transform_skip_rotation_enabled_flag != rhs.transform_skip_rotation_enabled_flag ) return false; +++ if(lhs.transform_skip_context_enabled_flag != rhs.transform_skip_context_enabled_flag ) return false; +++ if(lhs.implicit_rdpcm_enabled_flag != rhs.implicit_rdpcm_enabled_flag ) return false; +++ if(lhs.explicit_rdpcm_enabled_flag != rhs.explicit_rdpcm_enabled_flag ) return false; +++ if(lhs.extended_precision_processing_flag != rhs.extended_precision_processing_flag ) return false; +++ if(lhs.intra_smoothing_disabled_flag != rhs.intra_smoothing_disabled_flag ) return false; +++ if(lhs.high_precision_offsets_enabled_flag != rhs.high_precision_offsets_enabled_flag ) return false; +++ if(lhs.persistent_rice_adaptation_enabled_flag != rhs.persistent_rice_adaptation_enabled_flag ) return false; +++ if(lhs.cabac_bypass_alignment_enabled_flag != rhs.cabac_bypass_alignment_enabled_flag ) return false; +++ return true; +++} +++ +++bool operator!=(const sps_range_extension &lhs, const sps_range_extension &rhs) { +++ if(&lhs == &rhs) return false; +++ return !(lhs==rhs); +++} +++ +++ +++bool operator==(const seq_parameter_set &lhs, const seq_parameter_set &rhs) { +++ +++ if(&lhs== &rhs) return true; +++ +++ if(lhs.sps_read != rhs.sps_read) return false; +++ +++ if(lhs.video_parameter_set_id != rhs.video_parameter_set_id) return false; +++ if(lhs.sps_max_sub_layers != rhs.sps_max_sub_layers) return false; +++ if(lhs.sps_temporal_id_nesting_flag != rhs.sps_temporal_id_nesting_flag) return false; +++ +++ if(!isEqual(lhs.profile_tier_level_, rhs.profile_tier_level_, lhs.sps_max_sub_layers)) return false; +++ +++ if(lhs.seq_parameter_set_id != rhs.seq_parameter_set_id) return false; +++ if(lhs.chroma_format_idc != rhs.chroma_format_idc) return false; +++ +++ if(lhs.separate_colour_plane_flag != rhs.separate_colour_plane_flag) return false; +++ if(lhs.pic_width_in_luma_samples != rhs.pic_width_in_luma_samples) return false; +++ if(lhs.pic_height_in_luma_samples != rhs.pic_height_in_luma_samples) return false; +++ if(lhs.conformance_window_flag != rhs.conformance_window_flag) return false; +++ +++ if(lhs.conformance_window_flag) { +++ if(lhs.conf_win_left_offset != rhs.conf_win_left_offset) return false; +++ if(lhs.conf_win_right_offset != rhs.conf_win_right_offset) return false; +++ if(lhs.conf_win_top_offset != rhs.conf_win_top_offset) return false; +++ if(lhs.conf_win_bottom_offset != rhs.conf_win_bottom_offset) return false; +++ } +++ +++ if(lhs.bit_depth_luma != rhs.bit_depth_luma) return false; +++ if(lhs.bit_depth_chroma != rhs.bit_depth_chroma) return false; +++ +++ if(lhs.log2_max_pic_order_cnt_lsb != rhs.log2_max_pic_order_cnt_lsb) return false; +++ if(lhs.sps_sub_layer_ordering_info_present_flag != rhs.sps_sub_layer_ordering_info_present_flag) return false; +++ +++ if(memcmp(lhs.sps_max_dec_pic_buffering, rhs.sps_max_dec_pic_buffering, sizeof(rhs.sps_max_dec_pic_buffering))) return false; +++ if(memcmp(lhs.sps_max_num_reorder_pics, rhs.sps_max_num_reorder_pics, sizeof(rhs.sps_max_num_reorder_pics))) return false; +++ if(memcmp(lhs.sps_max_latency_increase_plus1, rhs.sps_max_latency_increase_plus1, sizeof(rhs.sps_max_latency_increase_plus1))) return false; +++ +++ if(lhs.log2_min_luma_coding_block_size != rhs.log2_min_luma_coding_block_size) return false; +++ if(lhs.log2_diff_max_min_luma_coding_block_size != rhs.log2_diff_max_min_luma_coding_block_size) return false; +++ if(lhs.log2_min_transform_block_size != rhs.log2_min_transform_block_size) return false; +++ if(lhs.log2_diff_max_min_transform_block_size != rhs.log2_diff_max_min_transform_block_size) return false; +++ if(lhs.max_transform_hierarchy_depth_inter != rhs.max_transform_hierarchy_depth_inter) return false; +++ if(lhs.max_transform_hierarchy_depth_intra != rhs.max_transform_hierarchy_depth_intra) return false; +++ +++ if(lhs.scaling_list_enable_flag != rhs.scaling_list_enable_flag) return false; +++ if(lhs.scaling_list_enable_flag) { +++ if(lhs.sps_scaling_list_data_present_flag != rhs.sps_scaling_list_data_present_flag) return false; +++ if(lhs.sps_scaling_list_data_present_flag) { +++ // compare only needed if present, otherwise it is the default scaling list. +++ if(memcmp(&lhs.scaling_list, &rhs.scaling_list, sizeof(rhs.scaling_list))) return false; +++ } +++ } +++ +++ if(lhs.amp_enabled_flag != rhs.amp_enabled_flag) return false; +++ if(lhs.sample_adaptive_offset_enabled_flag != rhs.sample_adaptive_offset_enabled_flag) return false; +++ if(lhs.pcm_enabled_flag != rhs.pcm_enabled_flag) return false; +++ +++ if(lhs.pcm_enabled_flag) { +++ if(lhs.pcm_sample_bit_depth_luma != rhs.pcm_sample_bit_depth_luma) return false; +++ if(lhs.pcm_sample_bit_depth_chroma != rhs.pcm_sample_bit_depth_chroma) return false; +++ if(lhs.log2_min_pcm_luma_coding_block_size != rhs.log2_min_pcm_luma_coding_block_size) return false; +++ if(lhs.log2_diff_max_min_pcm_luma_coding_block_size != rhs.log2_diff_max_min_pcm_luma_coding_block_size) return false; +++ if(lhs.pcm_loop_filter_disable_flag != rhs.pcm_loop_filter_disable_flag) return false; +++ } +++ +++ // (longterm) reference pics likely to change with a new sps, so ignored here. +++ +++ if(lhs.sps_temporal_mvp_enabled_flag != rhs.sps_temporal_mvp_enabled_flag) return false; +++ if(lhs.strong_intra_smoothing_enable_flag != rhs.strong_intra_smoothing_enable_flag) return false; +++ +++ if(lhs.vui_parameters_present_flag != rhs.vui_parameters_present_flag) return false; +++ if(lhs.vui_parameters_present_flag) { +++ if(!isEqual(lhs.vui, rhs.vui, lhs )) return false; +++ } +++ +++ if(lhs.sps_extension_present_flag != rhs.sps_extension_present_flag ) return false; +++ if(lhs.sps_extension_present_flag) { +++ if(lhs.sps_range_extension_flag != rhs.sps_range_extension_flag ) return false; +++ if(lhs.sps_multilayer_extension_flag != rhs.sps_multilayer_extension_flag ) return false; +++ if(lhs.sps_extension_6bits != rhs.sps_extension_6bits ) return false; +++ if(lhs.range_extension != rhs.range_extension) return false; +++ } +++ +++ return true; +++} +++ ++ de265_error decoder_context::read_sps_NAL(bitreader& reader) ++ { ++ logdebug(LogHeaders,"----> read SPS\n"); ++@@ -560,6 +817,22 @@ de265_error decoder_context::read_sps_NAL(bitreader& reader) ++ new_sps->dump(param_sps_headers_fd); ++ } ++ +++ if ( sps[ new_sps->seq_parameter_set_id ] ) { +++ auto old_sps = sps[ new_sps->seq_parameter_set_id ].get(); +++ if ( *old_sps == *new_sps ) { +++ // printf(" **** keeping sps *****\n"); +++ // the new sps is identical to the old one, so no replacing needed. +++ // however, reference pics and long-term reference pics might need updating. +++ old_sps->ref_pic_sets = new_sps->ref_pic_sets; +++ old_sps->long_term_ref_pics_present_flag = new_sps->long_term_ref_pics_present_flag; +++ memcpy(old_sps->lt_ref_pic_poc_lsb_sps, new_sps->lt_ref_pic_poc_lsb_sps, sizeof(old_sps->lt_ref_pic_poc_lsb_sps)); +++ memcpy(old_sps->used_by_curr_pic_lt_sps_flag, new_sps->used_by_curr_pic_lt_sps_flag, sizeof(old_sps->used_by_curr_pic_lt_sps_flag)); +++ return DE265_OK; +++ } +++ //printf(" **** replacing sps *****\n"); +++ +++ } +++ ++ sps[ new_sps->seq_parameter_set_id ] = new_sps; ++ ++ // Remove the all PPS that referenced the old SPS because parameters may have changed and we do not want to ++diff --git a/libde265/sps.cc b/libde265/sps.cc ++index f1c28255..31ce9470 100644 ++--- a/libde265/sps.cc +++++ b/libde265/sps.cc ++@@ -287,6 +287,11 @@ de265_error seq_parameter_set::read(error_queue* errqueue, bitreader* br) ++ int firstLayer = (sps_sub_layer_ordering_info_present_flag ? ++ 0 : sps_max_sub_layers-1 ); ++ +++ // zero out so that comparing is easier. +++ memset(sps_max_dec_pic_buffering, 0 , sizeof(sps_max_dec_pic_buffering)); +++ memset(sps_max_num_reorder_pics, 0 , sizeof(sps_max_num_reorder_pics)); +++ memset(sps_max_latency_increase_plus1, 0 , sizeof(sps_max_latency_increase_plus1)); +++ ++ for (int i=firstLayer ; i <= sps_max_sub_layers-1; i++ ) { ++ ++ // sps_max_dec_pic_buffering[i] ++@@ -347,6 +352,7 @@ de265_error seq_parameter_set::read(error_queue* errqueue, bitreader* br) ++ if (sps_scaling_list_data_present_flag) { ++ ++ de265_error err; +++ memset(&scaling_list, 0 , sizeof(scaling_list)); // zero out, so that memcmp will do it to check for equality. ++ if ((err=read_scaling_list(br,this, &scaling_list, false)) != DE265_OK) { ++ return err; ++ } diff --cc debian/patches/reject_reference_pics_from_different_sps.patch index 0000000,0000000..f0beac6 new file mode 100644 --- /dev/null +++ b/debian/patches/reject_reference_pics_from_different_sps.patch @@@ -1,0 -1,0 +1,54 @@@ ++Description: Try to mitigate asan failures by rejecting reference pictures not created with the same sps. ++ The reference images might have different parameters (size, pixel depth, etc) and so different memory allocations, ++ leading to out of bound memory reads and writes. ++Origin: https://github.com/strukturag/libde265/pull/365 ++Comment: Analysis of issue https://github.com/strukturag/libde265/issues/345#issuecomment-1346406079 ++From 97dd15303085eae2695a511717bf3239e209df96 Mon Sep 17 00:00:00 2001 ++From: Tobias Frost ++Date: Mon, 12 Dec 2022 14:03:12 +0100 ++Subject: [PATCH] Try to mitigate asan failures. ++MIME-Version: 1.0 ++Content-Type: text/plain; charset=UTF-8 ++Content-Transfer-Encoding: 8bit ++ ++See #345 for my analysis and details… ++ ++(This PR is just for discussion.) ++ ++(The CVE references are obtained from the Debian security tracker, ++which links the issues.) ++ ++This makes the following POCs stop failing: ++ ++- poc3 (#337) ++- poc7-1 (#341) CVE-2022-43239 (note: does NOT fix poc7-2) ++- poc8-2, poc8-3, poc8-4 (#342) CVE-2022-43244 (note: does NOT fix poc8-1) ++- poc11-1, poc11-2 (#345) CVE-2022-43249 ++- poc12 (#346) ++- poc13 (#347) CVE-2022-43252 ++- poc16 (#350) ++--- ++ libde265/motion.cc | 10 ++++++++++ ++ 1 file changed, 10 insertions(+) ++ ++Index: libde265/libde265/motion.cc ++=================================================================== ++--- libde265.orig/libde265/motion.cc +++++ libde265/libde265/motion.cc ++@@ -361,6 +361,16 @@ void generate_inter_prediction_samples(b ++ ++ logtrace(LogMotion, "refIdx: %d -> dpb[%d]\n", vi->refIdx[l], shdr->RefPicList[l][vi->refIdx[l]]); ++ +++ if (refPic) { +++ auto nonconst_refPic = const_cast(refPic); /* shared_ptr.get() chokes on const.*/ +++ auto refsps = nonconst_refPic->get_shared_sps().get(); +++ auto imgsps = img->get_shared_sps().get(); +++ if(refsps != imgsps) { +++ // rejecting reference image created with different sps. +++ refPic = nullptr; +++ } +++ } +++ ++ if (!refPic || refPic->PicState == UnusedForReference) { ++ img->integrity = INTEGRITY_DECODING_ERRORS; ++ ctx->add_warning(DE265_WARNING_NONEXISTING_REFERENCE_PICTURE_ACCESSED, false); diff --cc debian/patches/series index 0000000,0000000..7d2182d new file mode 100644 --- /dev/null +++ b/debian/patches/series @@@ -1,0 -1,0 +1,26 @@@ ++only_export_decoder_api.patch ++disable_tools.patch ++reject_reference_pics_from_different_sps.patch ++use_sps_from_the_image.patch ++recycle_sps_if_possible.patch ++ ++CVE-2023-27102.patch ++CVE-2023-27103.patch ++CVE-2023-43887.patch ++CVE-2023-47471.patch ++ ++CVE-2023-49465.patch ++CVE-2023-49467.patch ++CVE-2023-49468.patch ++ ++CVE-2023-51792.patch ++CVE-2026-33164+33165.patch ++CVE-2024-38949+CVE-2024-38950.patch ++CVE-2026-45382.patch ++CVE-2026-45383.patch ++CVE-2026-49295.patch ++CVE-2026-49337.patch ++CVE-2026-49346.patch ++CVE-2026-54240_CVE-2026-54241.patch ++TEMP-0000000-BB5891.patch ++TEMP-0000000-E66AA0.patch diff --cc debian/patches/use_sps_from_the_image.patch index 0000000,0000000..63bd704 new file mode 100644 --- /dev/null +++ b/debian/patches/use_sps_from_the_image.patch @@@ -1,0 -1,0 +1,62 @@@ ++Description: Use sps of the image, not the sps of the pic parameter set (pps) ++ When decoding a slice, all decoding functions are using the sps of the target ++ image to determine the image properties, which are in the seqquence parameter ++ set) -- execpt generate_inter_prediction_samples(), which uses the sps from the ++ pps, which might have different properties and trick the decode to out-of-bound ++ memory accesses, leading to crashes. ++Origin: https://github.com/strukturag/libde265/pull/366 ++From 36391cda3d4e4fb3269a2ce310e6e0f634729f0b Mon Sep 17 00:00:00 2001 ++From: Tobias Frost ++Date: Mon, 12 Dec 2022 14:33:40 +0100 ++Subject: [PATCH] Use the sps from the image ++ ++(as e.g mc_chroma is using the sps to determine ++picture properties, like pic_width_in_luma_samples ++and pic_height_in_luma_samples, I *think* this is ++more correct. ++ ++This PR is for discussion. (See #345.) ++It makes the failures go away, but that does not mean it's correct :) ++ ++The following poc will be stop failing if (only) this ++patch is applied: ++ ++ - poc2 #336 - CVE-2022-43238 ++ - poc4 #338 - CVE-2022-43241 ++ - poc6-1, poc6-2 #340 - CVE-2022-43242 ++ - poc7-1, poc7-2 #341 - CVE-2022-43239 ++ - poc8-1 #342 - CVE-2022-43244 ++ - poc9-3 #343 - CVE-2022-43236 ++ - poc10-2, poc10-3 #344 - CVE-2022-43237 ++ - poc16 #350 ++ - poc19 #353 ++ ++The following are still failing if only this patch is ++applied, but they stop failing if #365 is applied as well, but will ++still fail with ONLY #365 applied (IOW, both are needed) ++ ++ - poc1 #335 - CVE-2022-43240 ++ - poc3 #337 - CVE-2022-43235 ++ - poc5 #339 - CVE-2022-43423 ++ - poc9-1,poc9-2, poc9-4 #343 - CVE-2022-43236 ++ - poc14 #348 - CVE-2022-43253 ++ - poc15 #349 - CVE-2022-43248 ++ - poc17-1, poc17-2 #351 ++ - poc18 #352 - CVE-2022-43245 ++--- ++ libde265/motion.cc | 2 +- ++ 1 file changed, 1 insertion(+), 1 deletion(-) ++ ++Index: libde265/libde265/motion.cc ++=================================================================== ++--- libde265.orig/libde265/motion.cc +++++ libde265/libde265/motion.cc ++@@ -290,7 +290,7 @@ void generate_inter_prediction_samples(b ++ int stride[3]; ++ ++ const pic_parameter_set* pps = shdr->pps.get(); ++- const seq_parameter_set* sps = pps->sps.get(); +++ const seq_parameter_set* sps = img->get_shared_sps().get(); ++ ++ if (sps->BitDepth_Y != img->get_bit_depth(0) || ++ sps->BitDepth_C != img->get_bit_depth(1)) { diff --cc debian/rules index 0000000,0000000..56a92e7 new file mode 100755 --- /dev/null +++ b/debian/rules @@@ -1,0 -1,0 +1,15 @@@ ++#!/usr/bin/make -f ++#export DH_VERBOSE=1 ++ ++export DEB_BUILD_MAINT_OPTIONS = hardening=+all ++ ++%: ++ dh $@ ++ ++override_dh_auto_install: ++ dh_auto_install ++ cd $(CURDIR)/debian/tmp/usr/bin/ && mv dec265 libde265-dec265 ++ if [ -e "$(CURDIR)/debian/tmp/usr/bin/sherlock265" ]; then \ ++ cd $(CURDIR)/debian/tmp/usr/bin/ && mv sherlock265 \ ++ libde265-sherlock265; \ ++ fi diff --cc debian/source/format index 0000000,0000000..163aaf8 new file mode 100644 --- /dev/null +++ b/debian/source/format @@@ -1,0 -1,0 +1,1 @@@ ++3.0 (quilt) diff --cc debian/upstream/metadata index 0000000,0000000..6552684 new file mode 100644 --- /dev/null +++ b/debian/upstream/metadata @@@ -1,0 -1,0 +1,4 @@@ ++Bug-Database: https://github.com/strukturag/libde265/issues ++Repository: https://github.com/strukturag/libde265.git ++Repository-Browse: https://github.com/strukturag/libde265 ++Bug-Submit: https://github.com/strukturag/libde265/issues/new diff --cc debian/watch index 0000000,0000000..1f72711 new file mode 100644 --- /dev/null +++ b/debian/watch @@@ -1,0 -1,0 +1,4 @@@ ++version=3 ++opts=filenamemangle=s/.+\/v?(\d\S*)\.tar\.gz/libde265-$1\.tar\.gz/,\ ++downloadurlmangle=s/.+\/v?(\d\S*)\.tar\.gz/https:\/\/github\.com\/strukturag\/libde265\/releases\/download\/v$1\/libde265-$1\.tar\.gz/ \ ++ https://github.com/strukturag/libde265/tags .*/v?(\d\S*)\.tar\.gz