From 1cc6923884c622109bf40ea09796e3cc0fc85bcd Mon Sep 17 00:00:00 2001
From: Tobias Frost <tobi@debian.org>
Date: Sun, 20 Sep 2026 13:47:08 +0200
Subject: [PATCH] CVE-2024-38949 (Heap Buffer Overflow) and CVE-2024-38950
 (crash)

Origin: https://github.com/strukturag/libde265/commit/4089de0845e0009e019be4ca5cbebaf2aee0a8ce
Bug: https://github.com/strukturag/libde265/issues/460
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1074416

as the version in bookworm is still using SDL1.2, the resize() function has
been backported for SDL1.2.
The display444as420() does not need backporting, as with SDL1.2 the faulty
pointer arimethic is not needed, SDL has separate buffers.
From 4089de0845e0009e019be4ca5cbebaf2aee0a8ce Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Sun, 10 May 2026 22:37:53 +0200
Subject: [PATCH] dec265: fix SDL OOB on 4:4:4 streams and mid-stream
 resolution change (closes #460)


Gbp-Pq: Name CVE-2024-38949+CVE-2024-38950.patch
---
 dec265/dec265.cc | 21 ++++++++------
 dec265/sdl.cc    | 74 ++++++++++++++++++++++++++++++++++++++++++++++++
 dec265/sdl.hh    |  1 +
 3 files changed, 87 insertions(+), 9 deletions(-)

diff --git a/dec265/dec265.cc b/dec265/dec265.cc
index 8ddecfc..f8b044b 100644
--- a/dec265/dec265.cc
+++ b/dec265/dec265.cc
@@ -261,17 +261,20 @@ bool display_sdl(const struct de265_image* img)
 
   de265_chroma chroma = de265_get_chroma_format(img);
 
+  enum SDL_YUV_Display::SDL_Chroma sdlChroma;
+  switch (chroma) {
+  case de265_chroma_420:  sdlChroma = SDL_YUV_Display::SDL_CHROMA_420;  break;
+  case de265_chroma_422:  sdlChroma = SDL_YUV_Display::SDL_CHROMA_422;  break;
+  case de265_chroma_444:  sdlChroma = SDL_YUV_Display::SDL_CHROMA_444;  break;
+  case de265_chroma_mono: sdlChroma = SDL_YUV_Display::SDL_CHROMA_MONO; break;
+    default: sdlChroma = SDL_YUV_Display::SDL_CHROMA_MONO;
+  }
+
   if (!sdl_active) {
     sdl_active=true;
-    enum SDL_YUV_Display::SDL_Chroma sdlChroma;
-    switch (chroma) {
-    case de265_chroma_420:  sdlChroma = SDL_YUV_Display::SDL_CHROMA_420;  break;
-    case de265_chroma_422:  sdlChroma = SDL_YUV_Display::SDL_CHROMA_422;  break;
-    case de265_chroma_444:  sdlChroma = SDL_YUV_Display::SDL_CHROMA_444;  break;
-    case de265_chroma_mono: sdlChroma = SDL_YUV_Display::SDL_CHROMA_MONO; break;
-    }
-
-    sdlWin.init(width,height, sdlChroma);
+    if (!sdlWin.init(width,height, sdlChroma)) return true;
+  } else {
+    if (!sdlWin.resize(width,height, sdlChroma)) return true;
   }
 
   int stride,chroma_stride;
diff --git a/dec265/sdl.cc b/dec265/sdl.cc
index a7afa1c..7b5603c 100644
--- a/dec265/sdl.cc
+++ b/dec265/sdl.cc
@@ -96,6 +96,80 @@ bool SDL_YUV_Display::init(int frame_width, int frame_height, enum SDL_Chroma ch
   return true;
 }
 
+
+
+bool SDL_YUV_Display::resize(int frame_width, int frame_height, enum SDL_Chroma chroma)
+{
+  if (!mWindowOpen) {
+    return init(frame_width, frame_height, chroma);
+  }
+
+  // reduce image size to a multiple of 8, same rounding as init()
+  frame_width  &= ~7;
+  frame_height &= ~7;
+
+  if (frame_width == rect.w && frame_height == rect.h && mChroma == chroma) {
+    return true;
+  }
+
+  mChroma = chroma;
+
+  // The overlay is tied to the old dimensions/pixel format; it has to be
+  // freed and recreated at the new size (SDL 1.2 has no in-place resize).
+  if (mYUVOverlay) {
+    SDL_FreeYUVOverlay(mYUVOverlay);
+    mYUVOverlay = NULL;
+  }
+
+  const SDL_VideoInfo* info = SDL_GetVideoInfo();
+  if (!info) {
+    printf("SDL_GetVideoInfo() failed: %s\n", SDL_GetError());
+    mWindowOpen = false;
+    return false;
+  }
+
+  Uint8 bpp = info->vfmt->BitsPerPixel;
+
+  Uint32 vflags;
+  if (info->hw_available)
+    vflags = SDL_HWSURFACE;
+  else
+    vflags = SDL_SWSURFACE;
+
+  mScreen = SDL_SetVideoMode(frame_width, frame_height, bpp, vflags);
+  if (mScreen == NULL) {
+    printf("SDL: Couldn't set video mode to %dx%d,%d bpp: %s",
+           frame_width, frame_height, bpp, SDL_GetError());
+    mWindowOpen = false;
+    return false;
+  }
+
+  uint32_t pixelFormat;
+  switch (mChroma) {
+  case SDL_CHROMA_MONO: pixelFormat = SDL_YV12_OVERLAY; break;
+  case SDL_CHROMA_420:  pixelFormat = SDL_YV12_OVERLAY; break;
+  case SDL_CHROMA_422:  pixelFormat = SDL_YUY2_OVERLAY; break;
+  case SDL_CHROMA_444:  pixelFormat = SDL_YV12_OVERLAY; break;
+  default:              pixelFormat = SDL_YV12_OVERLAY; break;
+  }
+
+  mYUVOverlay = SDL_CreateYUVOverlay(frame_width, frame_height, pixelFormat, mScreen);
+  if (mYUVOverlay == NULL) {
+    printf("SDL: Couldn't recreate SDL YUV overlay: %s", SDL_GetError());
+    mWindowOpen = false;
+    return false;
+  }
+
+  rect.x = 0;
+  rect.y = 0;
+  rect.w = frame_width;
+  rect.h = frame_height;
+
+  return true;
+}
+
+
+
 void SDL_YUV_Display::display(const unsigned char *Y,
                               const unsigned char *U,
                               const unsigned char *V,
diff --git a/dec265/sdl.hh b/dec265/sdl.hh
index 08f9578..0ebc674 100644
--- a/dec265/sdl.hh
+++ b/dec265/sdl.hh
@@ -39,6 +39,7 @@ public:
   };
 
   bool init(int frame_width, int frame_height, enum SDL_Chroma chroma = SDL_CHROMA_420);
+  bool resize(int frame_width, int frame_height, enum SDL_Chroma chroma);
   void display(const unsigned char *Y, const unsigned char *U, const unsigned char *V,
                int stride, int chroma_stride);
   void close();
-- 
2.39.5