From: Sebastian Dröge <sebastian@centricular.com>
Date: Wed, 17 Jun 2026 07:03:36 +0000 (+0300)
Subject: [PATCH] h266parser: Check aspect ratio index against lookup table length
X-Git-Tag: archive/raspbian/1.26.2-3+rpi1+deb13u3^2~1
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=9c615eba36c108f3ee4cf1bc56a3639e044c1c4b;p=gst-plugins-bad1.0.git

[PATCH] h266parser: Check aspect ratio index against lookup table length


Gbp-Pq: Name CVE-2026-12891.patch
---

diff --git a/gst-libs/gst/codecparsers/gsth266parser.c b/gst-libs/gst/codecparsers/gsth266parser.c
index 6d2dc1b4..c95880c1 100644
--- a/gst-libs/gst/codecparsers/gsth266parser.c
+++ b/gst-libs/gst/codecparsers/gsth266parser.c
@@ -486,9 +486,13 @@ gst_h266_parse_vui_parameters (GstH266VUIParams * vui, NalReader * nr)
       READ_UINT16 (nr, vui->sar_height, 16);
       vui->par_n = vui->sar_width;
       vui->par_d = vui->sar_height;
-    } else {
+    } else if (vui->aspect_ratio_idc <= 16) {
       vui->par_n = aspect_ratios[vui->aspect_ratio_idc].par_n;
       vui->par_d = aspect_ratios[vui->aspect_ratio_idc].par_d;
+    } else {
+      GST_WARNING ("Invalid bitstream: aspect_ratio_idc set "
+          "to value %d (must be 0-16 or %d)",
+          vui->aspect_ratio_idc, EXTENDED_SAR);
     }
   } else {
     vui->aspect_ratio_constant_flag = 0;