CVE-2026-49295: bound aggregate short-term RPS size

Origin: upstream, https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594
Bug-Debian: https://bugs.debian.org/1140431
Applied-Upstream: 1.1.0

Missing aggregate bound check on predicted reference picture set entries
allows exceeding the 16-entry array, an out-of-bounds array write in
process_reference_picture_set().

Gbp-Pq: Name CVE-2026-49295.patch

diff --git a/libde265/refpic.cc b/libde265/refpic.cc
index 77cc719e3b38fd9b6711af4c4f924cc82685fe55..ab7de2a6246b051cbe63e180e527d1d9057a3c0b 100644 (file)
--- a/libde265/refpic.cc
+++ b/libde265/refpic.cc
@@ -318,6 +318,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue,
 
   out_set->compute_derived_values();
 
+  // The unused short-term references are all collected into a single PocStFoll array
+  // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set).
+  // While each individual list is bounded above, the predicted-RPS construction can
+  // append the current-picture delta to an already-full source set, pushing the
+  // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds
+  // write when filling PocStFoll.
+  if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) {
+    out_set->NumNegativePics = 0;
+    out_set->NumPositivePics = 0;
+    out_set->NumDeltaPocs = 0;
+    out_set->NumPocTotalCurr_shortterm_only = 0;
+
+    errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false);
+    return false;
+  }
+
   return true;
 }