From: Sebastian Dröge <sebastian@centricular.com>
Date: Wed, 15 Apr 2026 08:35:47 +0000 (+0300)
Subject: [PATCH] h266parser: Avoid out-of-bounds write when parsing PPS tile slices
X-Git-Tag: archive/raspbian/1.26.2-3+rpi1+deb13u2^2~1
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=80948176f90d2f1a3b001c1518d9554936130cbd;p=gst-plugins-bad1.0.git

[PATCH] h266parser: Avoid out-of-bounds write when parsing PPS tile slices


Gbp-Pq: Name CVE-2026-53701.patch
---

diff --git a/gst-libs/gst/codecparsers/gsth266parser.c b/gst-libs/gst/codecparsers/gsth266parser.c
index 5cf4b1c2..6d2dc1b4 100644
--- a/gst-libs/gst/codecparsers/gsth266parser.c
+++ b/gst-libs/gst/codecparsers/gsth266parser.c
@@ -3538,6 +3538,11 @@ gst_h266_parser_parse_picture_partition (GstH266SPS * sps,
             guint16 slice_height_in_ctus;
 
             for (j = 0; j < pps->num_exp_slices_in_tile[i]; j++) {
+              if (i + j >= pps->num_slices_in_pic_minus1) {
+                GST_WARNING ("Too may slices %d", i + j + 1);
+                goto error;
+              }
+
               READ_UE_MAX (nr, pps->exp_slice_height_in_ctus_minus1[i][j],
                   pps->tile_row_height_minus1[tile_y]);