From d91484d8f576388f738de99e55762627aacfc3ea Mon Sep 17 00:00:00 2001 From: Debian Multimedia Maintainers Date: Sun, 20 Sep 2026 13:47:08 +0200 Subject: [PATCH] CVE-2026-33164 + CVE-2026-33165: fix reallocation of metadata array... Origin: https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658 Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg (CVE-2026-33165) Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r (CVE-2026-33164) Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131468 (CVE-2026-33165) Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131469 (CVE-2026-33164) Imported from 1.0.11-0+deb11u4 (cherry picked from commit c7891e412106130b83f8e8ea8b7f907e9449b658) Gbp-Pq: Name CVE-2026-33164+33165.patch --- libde265/image.cc | 5 +++-- libde265/image.h | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/libde265/image.cc b/libde265/image.cc index 057705c..a376aaa 100644 --- a/libde265/image.cc +++ b/libde265/image.cc @@ -453,8 +453,9 @@ de265_error de265_image::alloc_image(int w,int h, enum de265_chroma c, // CTB info - if (ctb_info.width_in_units != sps->PicWidthInCtbsY || - ctb_info.height_in_units != sps->PicHeightInCtbsY) + if (ctb_info.width_in_units != sps->PicWidthInCtbsY || + ctb_info.height_in_units != sps->PicHeightInCtbsY || + ctb_info.log2unitSize != sps->Log2CtbSizeY) { delete[] ctb_progress; diff --git a/libde265/image.h b/libde265/image.h index 0a0c0e3..7908fe3 100644 --- a/libde265/image.h +++ b/libde265/image.h @@ -149,7 +149,7 @@ template class MetaDataArray // private: DataUnit* data; int data_size; - int log2unitSize; + uint8_t log2unitSize; int width_in_units; int height_in_units; }; -- 2.39.5