From: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Date: Thu, 6 Aug 2026 05:05:03 +0000 (+0800)
Subject: CVE-2026-45383: prevent reading past end of CtbAddrRStoTS[] in WPP images
X-Git-Tag: archive/raspbian/1.0.15-1+rpi1+deb13u1^2~5
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=54620fea74e6595f5cba0fc4f523226bce932558;p=libde265.git

CVE-2026-45383: prevent reading past end of CtbAddrRStoTS[] in WPP images

Origin: upstream, https://github.com/strukturag/libde265/commit/d1a2c3b4b751d21f44e8e82220fe9766c9d116ff
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38
Applied-Upstream: 1.0.19

In the WPP slice decoder ctbAddrRS = ctbRow * ctbsWidth can exceed the
allocated vector size, causing out-of-bounds reads.

Gbp-Pq: Name CVE-2026-45383.patch
---

diff --git a/libde265/decctx.cc b/libde265/decctx.cc
index ea2e213..ed8709d 100644
--- a/libde265/decctx.cc
+++ b/libde265/decctx.cc
@@ -1291,6 +1291,10 @@ de265_error decoder_context::decode_slice_unit_WPP(image_unit* imgunit,
   int ctbAddrRS = shdr->slice_segment_address;
   int ctbRow    = ctbAddrRS / ctbsWidth;
 
+  if (ctbRow + nRows > img->get_sps().PicHeightInCtbsY) {
+    return DE265_WARNING_SLICEHEADER_INVALID;
+  }
+
   for (int entryPt=0;entryPt<nRows;entryPt++) {
     // entry points other than the first start at CTB rows
     if (entryPt>0) {