From: Sebastian Dröge <sebastian@centricular.com>
Date: Tue, 16 Jun 2026 12:23:13 +0000 (+0300)
Subject: [PATCH] h264parse: Check for enough slice header data being available
X-Git-Tag: archive/raspbian/1.26.2-3+rpi1+deb13u3^2~2
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=a0f407b15953190406bb61079af5391180adcc5d;p=gst-plugins-bad1.0.git

[PATCH] h264parse: Check for enough slice header data being available


Gbp-Pq: Name CVE-2026-12892.patch
---

diff --git a/gst/videoparsers/gsth264parse.c b/gst/videoparsers/gsth264parse.c
index cfdd64df..d17cb0fa 100644
--- a/gst/videoparsers/gsth264parse.c
+++ b/gst/videoparsers/gsth264parse.c
@@ -1105,7 +1105,8 @@ gst_h264_parse_process_nal (GstH264Parse * h264parse, GstH264NalUnit * nalu)
       h264parse->picture_start = TRUE;
 
       /* don't need to parse the whole slice (header) here */
-      if (*(nalu->data + nalu->offset + nalu->header_bytes) & 0x80) {
+      if (nalu->size > nalu->header_bytes &&
+          *(nalu->data + nalu->offset + nalu->header_bytes) & 0x80) {
         /* means first_mb_in_slice == 0 */
         /* real frame data */
         GST_DEBUG_OBJECT (h264parse, "first_mb_in_slice = 0");