[PATCH] fix reallocation of metadata array when ctb size changes (thanks to Ana K.)

Gbp-Pq: Name CVE-2026-33164_CVE-2026-33165.patch

diff --git a/libde265/image.cc b/libde265/image.cc
index 9beeb07ef7f695582f4161f8125e3738f2e60b32..936a6936c434515f83ab0b47358da4af46f544d5 100644 (file)
--- a/libde265/image.cc
+++ b/libde265/image.cc
@@ -461,8 +461,9 @@ de265_error de265_image::alloc_image(int w,int h, enum de265_chroma c,
 
     // CTB info
 
-    if (ctb_info.width_in_units != sps->PicWidthInCtbsY ||
-        ctb_info.height_in_units != sps->PicHeightInCtbsY)
+    if (ctb_info.width_in_units  != sps->PicWidthInCtbsY  ||
+        ctb_info.height_in_units != sps->PicHeightInCtbsY ||
+        ctb_info.log2unitSize    != sps->Log2CtbSizeY)
       {
         delete[] ctb_progress;
 

diff --git a/libde265/image.h b/libde265/image.h
index c514429d4659b9bd1a5294496a35d0904bb4bd85..c735a9df17c1a377ae6b650f637fe5030b9a8420 100644 (file)
--- a/libde265/image.h
+++ b/libde265/image.h
@@ -150,7 +150,7 @@ template <class DataUnit> class MetaDataArray
   // private:
   DataUnit* data;
   int data_size;
-  int log2unitSize;
+  uint8_t log2unitSize;
   int width_in_units;
   int height_in_units;
 };