From 54620fea74e6595f5cba0fc4f523226bce932558 Mon Sep 17 00:00:00 2001
From: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Date: Thu, 6 Aug 2026 13:05:03 +0800
Subject: [PATCH] CVE-2026-45383: prevent reading past end of CtbAddrRStoTS[]
 in WPP images

Origin: upstream, https://github.com/strukturag/libde265/commit/d1a2c3b4b751d21f44e8e82220fe9766c9d116ff
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38
Applied-Upstream: 1.0.19

In the WPP slice decoder ctbAddrRS = ctbRow * ctbsWidth can exceed the
allocated vector size, causing out-of-bounds reads.

Gbp-Pq: Name CVE-2026-45383.patch
---
 libde265/decctx.cc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libde265/decctx.cc b/libde265/decctx.cc
index ea2e213..ed8709d 100644
--- a/libde265/decctx.cc
+++ b/libde265/decctx.cc
@@ -1291,6 +1291,10 @@ de265_error decoder_context::decode_slice_unit_WPP(image_unit* imgunit,
   int ctbAddrRS = shdr->slice_segment_address;
   int ctbRow    = ctbAddrRS / ctbsWidth;
 
+  if (ctbRow + nRows > img->get_sps().PicHeightInCtbsY) {
+    return DE265_WARNING_SLICEHEADER_INVALID;
+  }
+
   for (int entryPt=0;entryPt<nRows;entryPt++) {
     // entry points other than the first start at CTB rows
     if (entryPt>0) {
-- 
2.30.2