From: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Date: Sun, 20 Sep 2026 11:47:08 +0000 (+0200)
Subject: CVE-2026-33164 + CVE-2026-33165: fix reallocation of metadata array...
X-Git-Tag: archive/raspbian/1.0.11-1+rpi1+deb12u3^2~10
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=d91484d8f576388f738de99e55762627aacfc3ea;p=libde265.git

CVE-2026-33164 + CVE-2026-33165: fix reallocation of metadata array...

Origin: https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg (CVE-2026-33165)
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r (CVE-2026-33164)
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131468 (CVE-2026-33165)
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131469 (CVE-2026-33164)

Imported from 1.0.11-0+deb11u4
(cherry picked from commit c7891e412106130b83f8e8ea8b7f907e9449b658)

Gbp-Pq: Name CVE-2026-33164+33165.patch
---

diff --git a/libde265/image.cc b/libde265/image.cc
index 057705c..a376aaa 100644
--- a/libde265/image.cc
+++ b/libde265/image.cc
@@ -453,8 +453,9 @@ de265_error de265_image::alloc_image(int w,int h, enum de265_chroma c,
 
     // CTB info
 
-    if (ctb_info.width_in_units != sps->PicWidthInCtbsY ||
-        ctb_info.height_in_units != sps->PicHeightInCtbsY)
+    if (ctb_info.width_in_units  != sps->PicWidthInCtbsY  ||
+        ctb_info.height_in_units != sps->PicHeightInCtbsY ||
+        ctb_info.log2unitSize    != sps->Log2CtbSizeY)
       {
         delete[] ctb_progress;
 
diff --git a/libde265/image.h b/libde265/image.h
index 0a0c0e3..7908fe3 100644
--- a/libde265/image.h
+++ b/libde265/image.h
@@ -149,7 +149,7 @@ template <class DataUnit> class MetaDataArray
   // private:
   DataUnit* data;
   int data_size;
-  int log2unitSize;
+  uint8_t log2unitSize;
   int width_in_units;
   int height_in_units;
 };