From: Dirk Farin <dirk.farin@gmail.com>
Date: Sun, 15 Mar 2026 21:58:39 +0000 (+0100)
Subject: [PATCH] fix reallocation of metadata array when ctb size changes (thanks to Ana K.)
X-Git-Tag: archive/raspbian/1.0.15-1+rpi1+deb13u2^2~1
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=f8f6d80be76cd663c50b7e4d5b97cfa05986b898;p=libde265.git

[PATCH] fix reallocation of metadata array when ctb size changes (thanks to Ana K.)


Gbp-Pq: Name CVE-2026-33164_CVE-2026-33165.patch
---

diff --git a/libde265/image.cc b/libde265/image.cc
index 9beeb07..936a693 100644
--- a/libde265/image.cc
+++ b/libde265/image.cc
@@ -461,8 +461,9 @@ de265_error de265_image::alloc_image(int w,int h, enum de265_chroma c,
 
     // CTB info
 
-    if (ctb_info.width_in_units != sps->PicWidthInCtbsY ||
-        ctb_info.height_in_units != sps->PicHeightInCtbsY)
+    if (ctb_info.width_in_units  != sps->PicWidthInCtbsY  ||
+        ctb_info.height_in_units != sps->PicHeightInCtbsY ||
+        ctb_info.log2unitSize    != sps->Log2CtbSizeY)
       {
         delete[] ctb_progress;
 
diff --git a/libde265/image.h b/libde265/image.h
index c514429..c735a9d 100644
--- a/libde265/image.h
+++ b/libde265/image.h
@@ -150,7 +150,7 @@ template <class DataUnit> class MetaDataArray
   // private:
   DataUnit* data;
   int data_size;
-  int log2unitSize;
+  uint8_t log2unitSize;
   int width_in_units;
   int height_in_units;
 };