[PATCH] return error when PCM bits parameter exceeds pixel depth (#225)

Gbp-Pq: Name CVE-2020-21599.patch

diff --git a/libde265/de265.cc b/libde265/de265.cc
index ec432be7f945e6c719e91a2d4c6e37ca444fdda5..8eabb70eab24a442308754d94196869e96b02f7f 100644 (file)
--- a/libde265/de265.cc
+++ b/libde265/de265.cc
@@ -156,6 +156,8 @@ LIBDE265_API const char* de265_get_error_text(de265_error err)
     return "SPS header missing, cannot decode SEI";
   case DE265_WARNING_COLLOCATED_MOTION_VECTOR_OUTSIDE_IMAGE_AREA:
     return "collocated motion-vector is outside image area";
+  case DE265_WARNING_PCM_BITDEPTH_TOO_LARGE:
+    return "PCM bit-depth too large";
 
   default: return "unknown error";
   }

diff --git a/libde265/de265.h b/libde265/de265.h
index 6481d8f0acab894842ba6de6ba71be4bae846899..d23959a4555f1dfbba8bc9e3e84eb5aa07a31799 100644 (file)
--- a/libde265/de265.h
+++ b/libde265/de265.h
@@ -135,7 +135,8 @@ typedef enum {
   DE265_NON_EXISTING_LT_REFERENCE_CANDIDATE_IN_SLICE_HEADER=1023,
   DE265_WARNING_CANNOT_APPLY_SAO_OUT_OF_MEMORY=1024,
   DE265_WARNING_SPS_MISSING_CANNOT_DECODE_SEI=1025,
-  DE265_WARNING_COLLOCATED_MOTION_VECTOR_OUTSIDE_IMAGE_AREA=1026
+  DE265_WARNING_COLLOCATED_MOTION_VECTOR_OUTSIDE_IMAGE_AREA=1026,
+  DE265_WARNING_PCM_BITDEPTH_TOO_LARGE=1027
 } de265_error;
 
 LIBDE265_API const char* de265_get_error_text(de265_error err);

diff --git a/libde265/sps.cc b/libde265/sps.cc
index 15bc5af94854acb286e41e84739ff87a2105b445..00b54ddcd190ecd2ac02c3dd821f8a5f50f6b948 100644 (file)
--- a/libde265/sps.cc
+++ b/libde265/sps.cc
@@ -360,6 +360,16 @@ de265_error seq_parameter_set::read(error_queue* errqueue, bitreader* br)
     READ_VLC_OFFSET(log2_min_pcm_luma_coding_block_size, uvlc, 3);
     READ_VLC(log2_diff_max_min_pcm_luma_coding_block_size, uvlc);
     pcm_loop_filter_disable_flag = get_bits(br,1);
+
+    if (pcm_sample_bit_depth_luma > bit_depth_luma) {
+      errqueue->add_warning(DE265_WARNING_PCM_BITDEPTH_TOO_LARGE, false);
+      return DE265_ERROR_CODED_PARAMETER_OUT_OF_RANGE;
+    }
+
+    if (pcm_sample_bit_depth_chroma > bit_depth_chroma) {
+      errqueue->add_warning(DE265_WARNING_PCM_BITDEPTH_TOO_LARGE, false);
+      return DE265_ERROR_CODED_PARAMETER_OUT_OF_RANGE;
+    }
   }
   else {
     pcm_sample_bit_depth_luma = 0;