From f8f6d80be76cd663c50b7e4d5b97cfa05986b898 Mon Sep 17 00:00:00 2001 From: Dirk Farin Date: Sun, 15 Mar 2026 22:58:39 +0100 Subject: [PATCH] [PATCH] fix reallocation of metadata array when ctb size changes (thanks to Ana K.) Gbp-Pq: Name CVE-2026-33164_CVE-2026-33165.patch --- libde265/image.cc | 5 +++-- libde265/image.h | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/libde265/image.cc b/libde265/image.cc index 9beeb07..936a693 100644 --- a/libde265/image.cc +++ b/libde265/image.cc @@ -461,8 +461,9 @@ de265_error de265_image::alloc_image(int w,int h, enum de265_chroma c, // CTB info - if (ctb_info.width_in_units != sps->PicWidthInCtbsY || - ctb_info.height_in_units != sps->PicHeightInCtbsY) + if (ctb_info.width_in_units != sps->PicWidthInCtbsY || + ctb_info.height_in_units != sps->PicHeightInCtbsY || + ctb_info.log2unitSize != sps->Log2CtbSizeY) { delete[] ctb_progress; diff --git a/libde265/image.h b/libde265/image.h index c514429..c735a9d 100644 --- a/libde265/image.h +++ b/libde265/image.h @@ -150,7 +150,7 @@ template class MetaDataArray // private: DataUnit* data; int data_size; - int log2unitSize; + uint8_t log2unitSize; int width_in_units; int height_in_units; }; -- 2.39.5