From e8927415f81a7e34386d6408c89334a1e5e60200 Mon Sep 17 00:00:00 2001 From: Carlos Bentzen Date: Fri, 20 Feb 2026 13:34:50 +0100 Subject: [PATCH] [PATCH] h266parser: Fix out of bounds write when parsing pic_timing SEI Gbp-Pq: Name CVE-2026-3081.patch --- gst-libs/gst/codecparsers/gsth266parser.c | 3 ++- gst-libs/gst/codecparsers/gsth266parser.h | 9 +++++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/gst-libs/gst/codecparsers/gsth266parser.c b/gst-libs/gst/codecparsers/gsth266parser.c index 3da42e94..7649e2ca 100644 --- a/gst-libs/gst/codecparsers/gsth266parser.c +++ b/gst-libs/gst/codecparsers/gsth266parser.c @@ -1460,7 +1460,8 @@ gst_h266_parser_parse_pic_timing (GstH266PicTiming * pt, if (bp->du_hrd_params_present_flag && bp->du_cpb_params_in_pic_timing_sei_flag) { - READ_UE (nr, pt->num_decoding_units_minus1); + READ_UE_MAX (nr, pt->num_decoding_units_minus1, + GST_H266_MAX_DECODING_UNITS_IN_PIC_TIMING - 1); if (pt->num_decoding_units_minus1 > 0) { READ_UINT8 (nr, pt->du_common_cpb_removal_delay_flag, 1); if (pt->du_common_cpb_removal_delay_flag) { diff --git a/gst-libs/gst/codecparsers/gsth266parser.h b/gst-libs/gst/codecparsers/gsth266parser.h index a9df8d86..ddcce29b 100644 --- a/gst-libs/gst/codecparsers/gsth266parser.h +++ b/gst-libs/gst/codecparsers/gsth266parser.h @@ -105,6 +105,11 @@ G_BEGIN_DECLS The min coding block size is 8, so min width or height is 8. The min CTU size is 32. */ #define GST_H266_MAX_CTUS_IN_PICTURE (80216064 / 8 / 32) +/* Practical limit for number of decoding units per picture. + The spec allows up to PicSizeInCtbsY which could be very large, + but 600 is a reasonable practical limit matching the array sizes + in GstH266PicTiming. */ +#define GST_H266_MAX_DECODING_UNITS_IN_PIC_TIMING 600 /** * GST_H266_IS_NAL_TYPE_IDR: @@ -3066,8 +3071,8 @@ struct _GstH266PicTiming { guint8 du_common_cpb_removal_delay_flag; guint8 du_common_cpb_removal_delay_increment_minus1[8]; /* TODO: PicSizeInCtbsY could be very large */ - guint32 num_nalus_in_du_minus1[600]; - guint8 du_cpb_removal_delay_increment_minus1[600][8]; + guint32 num_nalus_in_du_minus1[GST_H266_MAX_DECODING_UNITS_IN_PIC_TIMING]; + guint8 du_cpb_removal_delay_increment_minus1[GST_H266_MAX_DECODING_UNITS_IN_PIC_TIMING][8]; guint8 delay_for_concatenation_ensured_flag; guint8 display_elemental_periods_minus1; }; -- 2.30.2