From: Carlos Bentzen <cadubentzen@igalia.com>
Date: Fri, 20 Feb 2026 16:40:24 +0000 (+0100)
Subject: [PATCH] h266parser: Fix APS ID bounds check in APS parsing
X-Git-Tag: archive/raspbian/1.26.2-3+rpi1+deb13u1^2~3
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=a8f2e19532bab40d0c712b8adc71f3259ee6f07d;p=gst-plugins-bad1.0.git

[PATCH] h266parser: Fix APS ID bounds check in APS parsing


Gbp-Pq: Name CVE-2026-3086.patch
---

diff --git a/gst-libs/gst/codecparsers/gsth266parser.c b/gst-libs/gst/codecparsers/gsth266parser.c
index 7649e2ca..5cf4b1c2 100644
--- a/gst-libs/gst/codecparsers/gsth266parser.c
+++ b/gst-libs/gst/codecparsers/gsth266parser.c
@@ -4389,7 +4389,7 @@ gst_h266_parse_aps (GstH266Parser * parser, GstH266NalUnit * nalu,
   READ_UINT8 (&nr, params_type, 3);
   aps->params_type = params_type;
   READ_UINT8 (&nr, aps->aps_id, 5);
-  CHECK_ALLOWED_MAX (aps->aps_id, GST_H266_MAX_APS_COUNT);
+  CHECK_ALLOWED_MAX (aps->aps_id, GST_H266_MAX_APS_COUNT - 1);
   READ_UINT8 (&nr, aps->chroma_present_flag, 1);
 
   switch (aps->params_type) {