From: Carlos Bentzen <cadubentzen@igalia.com>
Date: Fri, 20 Feb 2026 12:34:50 +0000 (+0100)
Subject: [PATCH] h266parser: Fix out of bounds write when parsing pic_timing SEI
X-Git-Tag: archive/raspbian/1.26.2-3+rpi1+deb13u1^2~4
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=e8927415f81a7e34386d6408c89334a1e5e60200;p=gst-plugins-bad1.0.git

[PATCH] h266parser: Fix out of bounds write when parsing pic_timing SEI


Gbp-Pq: Name CVE-2026-3081.patch
---

diff --git a/gst-libs/gst/codecparsers/gsth266parser.c b/gst-libs/gst/codecparsers/gsth266parser.c
index 3da42e94..7649e2ca 100644
--- a/gst-libs/gst/codecparsers/gsth266parser.c
+++ b/gst-libs/gst/codecparsers/gsth266parser.c
@@ -1460,7 +1460,8 @@ gst_h266_parser_parse_pic_timing (GstH266PicTiming * pt,
 
   if (bp->du_hrd_params_present_flag &&
       bp->du_cpb_params_in_pic_timing_sei_flag) {
-    READ_UE (nr, pt->num_decoding_units_minus1);
+    READ_UE_MAX (nr, pt->num_decoding_units_minus1,
+        GST_H266_MAX_DECODING_UNITS_IN_PIC_TIMING - 1);
     if (pt->num_decoding_units_minus1 > 0) {
       READ_UINT8 (nr, pt->du_common_cpb_removal_delay_flag, 1);
       if (pt->du_common_cpb_removal_delay_flag) {
diff --git a/gst-libs/gst/codecparsers/gsth266parser.h b/gst-libs/gst/codecparsers/gsth266parser.h
index a9df8d86..ddcce29b 100644
--- a/gst-libs/gst/codecparsers/gsth266parser.h
+++ b/gst-libs/gst/codecparsers/gsth266parser.h
@@ -105,6 +105,11 @@ G_BEGIN_DECLS
    The min coding block size is 8, so min width or height is 8.
    The min CTU size is 32. */
 #define GST_H266_MAX_CTUS_IN_PICTURE (80216064 / 8 / 32)
+/* Practical limit for number of decoding units per picture.
+   The spec allows up to PicSizeInCtbsY which could be very large,
+   but 600 is a reasonable practical limit matching the array sizes
+   in GstH266PicTiming. */
+#define GST_H266_MAX_DECODING_UNITS_IN_PIC_TIMING 600
 
 /**
  * GST_H266_IS_NAL_TYPE_IDR:
@@ -3066,8 +3071,8 @@ struct _GstH266PicTiming {
   guint8 du_common_cpb_removal_delay_flag;
   guint8 du_common_cpb_removal_delay_increment_minus1[8];
   /* TODO: PicSizeInCtbsY could be very large */
-  guint32 num_nalus_in_du_minus1[600];
-  guint8 du_cpb_removal_delay_increment_minus1[600][8];
+  guint32 num_nalus_in_du_minus1[GST_H266_MAX_DECODING_UNITS_IN_PIC_TIMING];
+  guint8 du_cpb_removal_delay_increment_minus1[GST_H266_MAX_DECODING_UNITS_IN_PIC_TIMING][8];
   guint8 delay_for_concatenation_ensured_flag;
   guint8 display_elemental_periods_minus1;
 };