From 66fa645f8d0534a64bf71c6e607ab302c64888b2 Mon Sep 17 00:00:00 2001 From: Carlos Bentzen Date: Fri, 20 Feb 2026 17:10:04 +0100 Subject: [PATCH] [PATCH] h266parser: Validate tile index bounds in picture partition parsing Gbp-Pq: Name CVE-2026-3084.patch --- gst-libs/gst/codecparsers/gsth266parser.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/gst-libs/gst/codecparsers/gsth266parser.c b/gst-libs/gst/codecparsers/gsth266parser.c index 0f52e5fa..3da42e94 100644 --- a/gst-libs/gst/codecparsers/gsth266parser.c +++ b/gst-libs/gst/codecparsers/gsth266parser.c @@ -3618,15 +3618,28 @@ gst_h266_parser_parse_picture_partition (GstH266SPS * sps, goto error; } - tile_idx += pps->tile_idx_delta_val[i]; + gint new_tile_idx = (gint) tile_idx + pps->tile_idx_delta_val[i]; + if (new_tile_idx < 0 || + new_tile_idx >= (gint) pps->num_tiles_in_pic) { + GST_WARNING ("tile_idx %d out of bounds.", new_tile_idx); + goto error; + } + tile_idx = new_tile_idx; } else { pps->tile_idx_delta_val[i] = 0; - tile_idx += pps->slice_width_in_tiles_minus1[i] + 1; - if (tile_idx % pps->num_tile_columns == 0) { - tile_idx += pps->slice_height_in_tiles_minus1[i] * + gint new_tile_idx = (gint) tile_idx + + pps->slice_width_in_tiles_minus1[i] + 1; + if (new_tile_idx % pps->num_tile_columns == 0) { + new_tile_idx += pps->slice_height_in_tiles_minus1[i] * pps->num_tile_columns; } + if (new_tile_idx < 0 || + new_tile_idx >= (gint) pps->num_tiles_in_pic) { + GST_WARNING ("tile_idx %d out of bounds.", new_tile_idx); + goto error; + } + tile_idx = new_tile_idx; } } } -- 2.30.2