From e828c1f0566b3084610280fa780e0e0d0bf6e861 Mon Sep 17 00:00:00 2001 From: Debian Multimedia Maintainers Date: Thu, 6 Aug 2026 13:05:03 +0800 Subject: [PATCH] CVE-2026-49295: bound aggregate short-term RPS size Origin: upstream, https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594 Bug-Debian: https://bugs.debian.org/1140431 Applied-Upstream: 1.1.0 Missing aggregate bound check on predicted reference picture set entries allows exceeding the 16-entry array, an out-of-bounds array write in process_reference_picture_set(). Gbp-Pq: Name CVE-2026-49295.patch --- libde265/refpic.cc | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/libde265/refpic.cc b/libde265/refpic.cc index 77cc719..ab7de2a 100644 --- a/libde265/refpic.cc +++ b/libde265/refpic.cc @@ -318,6 +318,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue, out_set->compute_derived_values(); + // The unused short-term references are all collected into a single PocStFoll array + // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set). + // While each individual list is bounded above, the predicted-RPS construction can + // append the current-picture delta to an already-full source set, pushing the + // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds + // write when filling PocStFoll. + if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) { + out_set->NumNegativePics = 0; + out_set->NumPositivePics = 0; + out_set->NumDeltaPocs = 0; + out_set->NumPocTotalCurr_shortterm_only = 0; + + errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false); + return false; + } + return true; } -- 2.30.2