From cdcb356b75e26dbb68528636360a7fff281f57ef Mon Sep 17 00:00:00 2001 From: =?utf8?q?Sebastian=20Dr=C3=B6ge?= Date: Tue, 9 Jun 2026 09:26:38 +0300 Subject: [PATCH] [PATCH] av1parser: Fix bytes/bits confusion when parsing tile data size Gbp-Pq: Name CVE-2026-52718.patch --- gst-libs/gst/codecparsers/gstav1parser.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/gst-libs/gst/codecparsers/gstav1parser.c b/gst-libs/gst/codecparsers/gstav1parser.c index 7ef45c37..2ce56906 100644 --- a/gst-libs/gst/codecparsers/gstav1parser.c +++ b/gst-libs/gst/codecparsers/gstav1parser.c @@ -4350,6 +4350,8 @@ gst_av1_parser_parse_tile_list_obu (GstAV1Parser * parser, } for (tile = 0; tile <= tile_list->tile_count_minus_1; tile++) { + guint32 tile_data_size; + if (AV1_REMAINING_BITS (br) < 8 + 8 + 8 + 16) { retval = GST_AV1_PARSER_NO_MORE_DATA; goto error; @@ -4364,8 +4366,8 @@ gst_av1_parser_parse_tile_list_obu (GstAV1Parser * parser, tile_list->entry[tile].coded_tile_data = obu->data + gst_bit_reader_get_pos (br) / 8; /* skip the coded_tile_data */ - if (!gst_bit_reader_skip (br, - tile_list->entry[tile].tile_data_size_minus_1 + 1)) { + tile_data_size = tile_list->entry[tile].tile_data_size_minus_1 + 1; + if (!gst_bit_reader_skip (br, tile_data_size * 8)) { retval = GST_AV1_PARSER_NO_MORE_DATA; goto error; } -- 2.30.2