From: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Date: Thu, 6 Aug 2026 05:05:03 +0000 (+0800)
Subject: CVE-2026-49295: bound aggregate short-term RPS size
X-Git-Tag: archive/raspbian/1.0.15-1+rpi1+deb13u1^2~3
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=e828c1f0566b3084610280fa780e0e0d0bf6e861;p=libde265.git

CVE-2026-49295: bound aggregate short-term RPS size

Origin: upstream, https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b
Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594
Bug-Debian: https://bugs.debian.org/1140431
Applied-Upstream: 1.1.0

Missing aggregate bound check on predicted reference picture set entries
allows exceeding the 16-entry array, an out-of-bounds array write in
process_reference_picture_set().

Gbp-Pq: Name CVE-2026-49295.patch
---

diff --git a/libde265/refpic.cc b/libde265/refpic.cc
index 77cc719..ab7de2a 100644
--- a/libde265/refpic.cc
+++ b/libde265/refpic.cc
@@ -318,6 +318,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue,
 
   out_set->compute_derived_values();
 
+  // The unused short-term references are all collected into a single PocStFoll array
+  // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set).
+  // While each individual list is bounded above, the predicted-RPS construction can
+  // append the current-picture delta to an already-full source set, pushing the
+  // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds
+  // write when filling PocStFoll.
+  if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) {
+    out_set->NumNegativePics = 0;
+    out_set->NumPositivePics = 0;
+    out_set->NumDeltaPocs = 0;
+    out_set->NumPocTotalCurr_shortterm_only = 0;
+
+    errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false);
+    return false;
+  }
+
   return true;
 }