From: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Date: Thu, 6 Aug 2026 05:05:03 +0000 (+0800)
Subject: CVE-2026-45382: fix CTB OOB access when pps.sps mismatches active sps
X-Git-Tag: archive/raspbian/1.0.15-1+rpi1+deb13u1^2~6
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=928fe7a3ea12c7c75f844a5c563066e8f8ddce52;p=libde265.git

CVE-2026-45382: fix CTB OOB access when pps.sps mismatches active sps

Origin: upstream, https://github.com/strukturag/libde265/commit/c33b4f63ae9056b00f34a31874fed55cd0aa29c9
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9
Applied-Upstream: 1.0.19

Malformed PPS data creates an out-of-bounds index into the CtbAddrRStoTS
array, causing a heap-buffer-overflow read in decode_slice_unit_tiles.

Gbp-Pq: Name CVE-2026-45382.patch
---

diff --git a/libde265/decctx.cc b/libde265/decctx.cc
index 7c758fc..ea2e213 100644
--- a/libde265/decctx.cc
+++ b/libde265/decctx.cc
@@ -1317,6 +1317,11 @@ de265_error decoder_context::decode_slice_unit_WPP(image_unit* imgunit,
     tctx->img     = img;
     tctx->imgunit = imgunit;
     tctx->sliceunit= sliceunit;
+
+    if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
+      err = DE265_WARNING_SLICEHEADER_INVALID;
+      break;
+    }
     tctx->CtbAddrInTS = pps.CtbAddrRStoTS[ctbAddrRS];
 
     init_thread_context(tctx);
@@ -1394,6 +1399,12 @@ de265_error decoder_context::decode_slice_unit_tiles(image_unit* imgunit,
 
   // first CTB in this slice
   int ctbAddrRS = shdr->slice_segment_address;
+
+  // pps.TileIdRS and pps.CtbAddrRStoTS are both sized to PicSizeInCtbsY in
+  // set_derived_values(), so one bound covers both accesses below.
+  if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
+    return DE265_WARNING_SLICEHEADER_INVALID;
+  }
   int tileID = pps.TileIdRS[ctbAddrRS];
 
   for (int entryPt=0;entryPt<nTiles;entryPt++) {
@@ -1409,6 +1420,11 @@ de265_error decoder_context::decode_slice_unit_tiles(image_unit* imgunit,
       int ctbX = pps.colBd[tileID % pps.num_tile_columns];
       int ctbY = pps.rowBd[tileID / pps.num_tile_columns];
       ctbAddrRS = ctbY * ctbsWidth + ctbX;
+
+      if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) {
+        err = DE265_WARNING_SLICEHEADER_INVALID;
+        break;
+      }
     }
 
     // set thread context