libde265.git
23 months agoMerge version 1.0.11-0+deb10u5+rpi1 and 1.0.11-0+deb10u6 to produce 1.0.11-0+deb10u6... buster-staging archive/raspbian/1.0.11-0+deb10u6+rpi1 raspbian/1.0.11-0+deb10u6+rpi1
Raspbian automatic forward porter [Thu, 4 Jan 2024 22:53:15 +0000 (22:53 +0000)]
Merge version 1.0.11-0+deb10u5+rpi1 and 1.0.11-0+deb10u6 to produce 1.0.11-0+deb10u6+rpi1

23 months agoMerge libde265 (1.0.11-0+deb10u6) import into refs/heads/workingbranch
Thorsten Alteholz [Fri, 29 Dec 2023 22:03:02 +0000 (23:03 +0100)]
Merge libde265 (1.0.11-0+deb10u6) import into refs/heads/workingbranch

23 months agoCVE-2023-49468
Debian Multimedia Maintainers [Fri, 29 Dec 2023 22:03:02 +0000 (23:03 +0100)]
CVE-2023-49468

commit 3e822a3ccf88df1380b165d6ce5a00494a27ceeb
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Thu Nov 23 19:11:34 2023 +0100

    fix #432 (undefined IPM)

Gbp-Pq: Name CVE-2023-49468.patch

23 months agoCVE-2023-49467
Debian Multimedia Maintainers [Fri, 29 Dec 2023 22:03:02 +0000 (23:03 +0100)]
CVE-2023-49467

commit 7e4faf254bbd2e52b0f216cb987573a2cce97b54
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Thu Nov 23 19:38:34 2023 +0100

    prevent endless loop for #434 input

Gbp-Pq: Name CVE-2023-49467.patch

23 months agoCVE-2023-49465
Debian Multimedia Maintainers [Fri, 29 Dec 2023 22:03:02 +0000 (23:03 +0100)]
CVE-2023-49465

commit 1475c7d2f0a6dc35c27e18abc4db9679bfd32568
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Thu Nov 23 19:43:55 2023 +0100

    possible fix for #435

Gbp-Pq: Name CVE-2023-49465.patch

23 months ago[PATCH] null-pointer check in debug output (fixes #426)
Dirk Farin [Sat, 4 Nov 2023 14:20:50 +0000 (15:20 +0100)]
[PATCH] null-pointer check in debug output (fixes #426)

Gbp-Pq: Name CVE-2023-47471.patch

23 months ago[PATCH] fix #418
Dirk Farin [Fri, 1 Sep 2023 19:18:48 +0000 (21:18 +0200)]
[PATCH] fix #418

Gbp-Pq: Name CVE-2023-43887.patch

23 months ago[PATCH] check for valid slice header index access (fixes #394)
Dirk Farin [Sat, 4 Mar 2023 09:27:59 +0000 (10:27 +0100)]
[PATCH] check for valid slice header index access (fixes #394)

Gbp-Pq: Name CVE-2023-27103.patch

23 months ago[PATCH] check whether referenced PPS exists (fixes #393)
Dirk Farin [Sat, 4 Mar 2023 09:32:43 +0000 (10:32 +0100)]
[PATCH] check whether referenced PPS exists (fixes #393)

Gbp-Pq: Name CVE-2023-27102.patch

23 months ago[PATCH] Don't update sps if they are only repeated
Tobias Frost [Fri, 13 Jan 2023 11:22:45 +0000 (12:22 +0100)]
[PATCH] Don't update sps if they are only repeated

This is an attempt to improve the mitigations from #365 and #366 and picks up an idea I described at #345:

> One way would be just to look at the pointers of the SPS (fast and easy, but
> may reject more than required), or investigate if the SPS used for the image
> generations are "compatible".

This changes do exactly this: It (very conservativly) checks if the old and new sps have
identical information -- except the reference picture set, which I believe is supposed
to be updated by new sps'). If they are basically identical, the old sps will be
used instead of the new one, (of course, reference image set is updated from the new one)

I'm using standalone operator== and helper functions to avoid changing ABI of the library;
if an ABI bump would be done, of course this should go to the respective classes.

Gbp-Pq: Name recycle_sps_if_possible.patch

23 months ago[PATCH] Use the sps from the image
Tobias Frost [Mon, 12 Dec 2022 13:33:40 +0000 (14:33 +0100)]
[PATCH] Use the sps from the image

(as e.g mc_chroma is using the sps to determine
picture properties, like pic_width_in_luma_samples
and pic_height_in_luma_samples, I *think* this is
more correct.

This PR is for discussion. (See #345.)
It makes the failures go away, but that does not mean it's correct :)

The following poc will be stop failing if (only) this
patch is applied:

 - poc2  #336 - CVE-2022-43238
 - poc4  #338 - CVE-2022-43241
 - poc6-1, poc6-2 #340 - CVE-2022-43242
 - poc7-1, poc7-2  #341 - CVE-2022-43239
 - poc8-1 #342 - CVE-2022-43244
 - poc9-3 #343 - CVE-2022-43236
 - poc10-2, poc10-3 #344 - CVE-2022-43237
 - poc16 #350
 - poc19 #353

The following are still failing if only this patch is
applied, but they stop failing if #365 is applied as well, but will
still fail with ONLY #365 applied (IOW, both are needed)

 - poc1  #335 - CVE-2022-43240
 - poc3  #337 - CVE-2022-43235
 - poc5   #339 - CVE-2022-43423
 - poc9-1,poc9-2, poc9-4  #343 - CVE-2022-43236
 - poc14  #348 - CVE-2022-43253
 - poc15  #349 - CVE-2022-43248
 - poc17-1, poc17-2  #351
 - poc18 #352 - CVE-2022-43245

Gbp-Pq: Name use_sps_from_the_image.patch

23 months ago[PATCH] Try to mitigate asan failures.
Tobias Frost [Mon, 12 Dec 2022 13:03:12 +0000 (14:03 +0100)]
[PATCH] Try to mitigate asan failures.

See #345 for my analysis and details…

(This PR is just for discussion.)

(The CVE references are obtained from the Debian security tracker,
which links the issues.)

This makes the following POCs stop failing:

- poc3 (#337)
- poc7-1 (#341) CVE-2022-43239 (note: does NOT fix poc7-2)
- poc8-2, poc8-3, poc8-4 (#342) CVE-2022-43244   (note: does NOT fix poc8-1)
- poc11-1, poc11-2 (#345) CVE-2022-43249
- poc12 (#346)
- poc13 (#347) CVE-2022-43252
- poc16 (#350)

Gbp-Pq: Name reject_reference_pics_from_different_sps.patch

23 months agoDisable building of some internal tools that no longer link
Joachim Bauch [Fri, 29 Dec 2023 22:03:02 +0000 (23:03 +0100)]
Disable building of some internal tools that no longer link

because internal symbols are no longer exported.

Gbp-Pq: Name disable_tools.patch

23 months agoOnly export symbols defined in the decoder API.
Joachim Bauch [Fri, 29 Dec 2023 22:03:02 +0000 (23:03 +0100)]
Only export symbols defined in the decoder API.

The encoder API is not final yet, so upstream exports all symbols to make
development easier. For packaging we only want to expose the public API.

Gbp-Pq: Name only_export_decoder_api.patch

23 months agolibde265 (1.0.11-0+deb10u6) buster-security; urgency=high
Thorsten Alteholz [Fri, 29 Dec 2023 22:03:02 +0000 (23:03 +0100)]
libde265 (1.0.11-0+deb10u6) buster-security; urgency=high

  * Non-maintainer upload by the LTS Team.
  * CVE-2023-49465
    heap-buffer-overflow in derive_spatial_luma_vector_prediction()
  * CVE-2023-49467
    heap-buffer-overflow in derive_combined_bipredictive_merging_candidates()
  * CVE-2023-49468
    global buffer overflow in read_coding_unit()

[dgit import unpatched libde265 1.0.11-0+deb10u6]

23 months agoImport libde265_1.0.11-0+deb10u6.debian.tar.xz
Thorsten Alteholz [Fri, 29 Dec 2023 22:03:02 +0000 (23:03 +0100)]
Import libde265_1.0.11-0+deb10u6.debian.tar.xz

[dgit import tarball libde265 1.0.11-0+deb10u6 libde265_1.0.11-0+deb10u6.debian.tar.xz]

2 years agoMerge version 1.0.11-0+deb10u4+rpi1 and 1.0.11-0+deb10u5 to produce 1.0.11-0+deb10u5... archive/raspbian/1.0.11-0+deb10u5+rpi1 raspbian/1.0.11-0+deb10u5+rpi1
Raspbian automatic forward porter [Fri, 1 Dec 2023 04:27:57 +0000 (04:27 +0000)]
Merge version 1.0.11-0+deb10u4+rpi1 and 1.0.11-0+deb10u5 to produce 1.0.11-0+deb10u5+rpi1

2 years agoMerge libde265 (1.0.11-0+deb10u5) import into refs/heads/workingbranch
Anton Gladky [Thu, 30 Nov 2023 16:31:53 +0000 (17:31 +0100)]
Merge libde265 (1.0.11-0+deb10u5) import into refs/heads/workingbranch

2 years ago[PATCH] null-pointer check in debug output (fixes #426)
Dirk Farin [Sat, 4 Nov 2023 14:20:50 +0000 (15:20 +0100)]
[PATCH] null-pointer check in debug output (fixes #426)

Gbp-Pq: Name CVE-2023-47471.patch

2 years ago[PATCH] fix #418
Dirk Farin [Fri, 1 Sep 2023 19:18:48 +0000 (21:18 +0200)]
[PATCH] fix #418

Gbp-Pq: Name CVE-2023-43887.patch

2 years ago[PATCH] check for valid slice header index access (fixes #394)
Dirk Farin [Sat, 4 Mar 2023 09:27:59 +0000 (10:27 +0100)]
[PATCH] check for valid slice header index access (fixes #394)

Gbp-Pq: Name CVE-2023-27103.patch

2 years ago[PATCH] check whether referenced PPS exists (fixes #393)
Dirk Farin [Sat, 4 Mar 2023 09:32:43 +0000 (10:32 +0100)]
[PATCH] check whether referenced PPS exists (fixes #393)

Gbp-Pq: Name CVE-2023-27102.patch

2 years ago[PATCH] Don't update sps if they are only repeated
Tobias Frost [Fri, 13 Jan 2023 11:22:45 +0000 (12:22 +0100)]
[PATCH] Don't update sps if they are only repeated

This is an attempt to improve the mitigations from #365 and #366 and picks up an idea I described at #345:

> One way would be just to look at the pointers of the SPS (fast and easy, but
> may reject more than required), or investigate if the SPS used for the image
> generations are "compatible".

This changes do exactly this: It (very conservativly) checks if the old and new sps have
identical information -- except the reference picture set, which I believe is supposed
to be updated by new sps'). If they are basically identical, the old sps will be
used instead of the new one, (of course, reference image set is updated from the new one)

I'm using standalone operator== and helper functions to avoid changing ABI of the library;
if an ABI bump would be done, of course this should go to the respective classes.

Gbp-Pq: Name recycle_sps_if_possible.patch

2 years ago[PATCH] Use the sps from the image
Tobias Frost [Mon, 12 Dec 2022 13:33:40 +0000 (14:33 +0100)]
[PATCH] Use the sps from the image

(as e.g mc_chroma is using the sps to determine
picture properties, like pic_width_in_luma_samples
and pic_height_in_luma_samples, I *think* this is
more correct.

This PR is for discussion. (See #345.)
It makes the failures go away, but that does not mean it's correct :)

The following poc will be stop failing if (only) this
patch is applied:

 - poc2  #336 - CVE-2022-43238
 - poc4  #338 - CVE-2022-43241
 - poc6-1, poc6-2 #340 - CVE-2022-43242
 - poc7-1, poc7-2  #341 - CVE-2022-43239
 - poc8-1 #342 - CVE-2022-43244
 - poc9-3 #343 - CVE-2022-43236
 - poc10-2, poc10-3 #344 - CVE-2022-43237
 - poc16 #350
 - poc19 #353

The following are still failing if only this patch is
applied, but they stop failing if #365 is applied as well, but will
still fail with ONLY #365 applied (IOW, both are needed)

 - poc1  #335 - CVE-2022-43240
 - poc3  #337 - CVE-2022-43235
 - poc5   #339 - CVE-2022-43423
 - poc9-1,poc9-2, poc9-4  #343 - CVE-2022-43236
 - poc14  #348 - CVE-2022-43253
 - poc15  #349 - CVE-2022-43248
 - poc17-1, poc17-2  #351
 - poc18 #352 - CVE-2022-43245

Gbp-Pq: Name use_sps_from_the_image.patch

2 years ago[PATCH] Try to mitigate asan failures.
Tobias Frost [Mon, 12 Dec 2022 13:03:12 +0000 (14:03 +0100)]
[PATCH] Try to mitigate asan failures.

See #345 for my analysis and details…

(This PR is just for discussion.)

(The CVE references are obtained from the Debian security tracker,
which links the issues.)

This makes the following POCs stop failing:

- poc3 (#337)
- poc7-1 (#341) CVE-2022-43239 (note: does NOT fix poc7-2)
- poc8-2, poc8-3, poc8-4 (#342) CVE-2022-43244   (note: does NOT fix poc8-1)
- poc11-1, poc11-2 (#345) CVE-2022-43249
- poc12 (#346)
- poc13 (#347) CVE-2022-43252
- poc16 (#350)

Gbp-Pq: Name reject_reference_pics_from_different_sps.patch

2 years agoDisable building of some internal tools that no longer link
Joachim Bauch [Thu, 30 Nov 2023 16:31:53 +0000 (17:31 +0100)]
Disable building of some internal tools that no longer link

because internal symbols are no longer exported.

Gbp-Pq: Name disable_tools.patch

2 years agoOnly export symbols defined in the decoder API.
Joachim Bauch [Thu, 30 Nov 2023 16:31:53 +0000 (17:31 +0100)]
Only export symbols defined in the decoder API.

The encoder API is not final yet, so upstream exports all symbols to make
development easier. For packaging we only want to expose the public API.

Gbp-Pq: Name only_export_decoder_api.patch

2 years agolibde265 (1.0.11-0+deb10u5) buster-security; urgency=medium
Anton Gladky [Thu, 30 Nov 2023 16:31:53 +0000 (17:31 +0100)]
libde265 (1.0.11-0+deb10u5) buster-security; urgency=medium

  * Non-maintainer upload by the LTS Security Team.
  * Fix: CVE-2023-27102, CVE-2023-27103, CVE-2023-43887 and CVE-2023-47471.

[dgit import unpatched libde265 1.0.11-0+deb10u5]

2 years agoImport libde265_1.0.11-0+deb10u5.debian.tar.xz
Anton Gladky [Thu, 30 Nov 2023 16:31:53 +0000 (17:31 +0100)]
Import libde265_1.0.11-0+deb10u5.debian.tar.xz

[dgit import tarball libde265 1.0.11-0+deb10u5 libde265_1.0.11-0+deb10u5.debian.tar.xz]

2 years agoMerge version 1.0.3-1+rpi1+deb10u1 and 1.0.11-0+deb10u4 to produce 1.0.11-0+deb10u4... archive/raspbian/1.0.11-0+deb10u4+rpi1 raspbian/1.0.11-0+deb10u4+rpi1
Raspbian automatic forward porter [Sun, 12 Mar 2023 10:22:17 +0000 (10:22 +0000)]
Merge version 1.0.3-1+rpi1+deb10u1 and 1.0.11-0+deb10u4 to produce 1.0.11-0+deb10u4+rpi1

2 years agoImport libde265_1.0.11.orig.tar.gz
Tobias Frost [Sat, 4 Mar 2023 16:01:58 +0000 (17:01 +0100)]
Import libde265_1.0.11.orig.tar.gz

[dgit import orig libde265_1.0.11.orig.tar.gz]

2 years agoMerge libde265 (1.0.11-0+deb10u4) import into refs/heads/workingbranch
Tobias Frost [Sat, 4 Mar 2023 16:01:58 +0000 (16:01 +0000)]
Merge libde265 (1.0.11-0+deb10u4) import into refs/heads/workingbranch

2 years ago[PATCH] Don't update sps if they are only repeated
Tobias Frost [Fri, 13 Jan 2023 11:22:45 +0000 (12:22 +0100)]
[PATCH] Don't update sps if they are only repeated

This is an attempt to improve the mitigations from #365 and #366 and picks up an idea I described at #345:

> One way would be just to look at the pointers of the SPS (fast and easy, but
> may reject more than required), or investigate if the SPS used for the image
> generations are "compatible".

This changes do exactly this: It (very conservativly) checks if the old and new sps have
identical information -- except the reference picture set, which I believe is supposed
to be updated by new sps'). If they are basically identical, the old sps will be
used instead of the new one, (of course, reference image set is updated from the new one)

I'm using standalone operator== and helper functions to avoid changing ABI of the library;
if an ABI bump would be done, of course this should go to the respective classes.

Gbp-Pq: Name recycle_sps_if_possible.patch

2 years ago[PATCH] Use the sps from the image
Tobias Frost [Mon, 12 Dec 2022 13:33:40 +0000 (14:33 +0100)]
[PATCH] Use the sps from the image

(as e.g mc_chroma is using the sps to determine
picture properties, like pic_width_in_luma_samples
and pic_height_in_luma_samples, I *think* this is
more correct.

This PR is for discussion. (See #345.)
It makes the failures go away, but that does not mean it's correct :)

The following poc will be stop failing if (only) this
patch is applied:

 - poc2  #336 - CVE-2022-43238
 - poc4  #338 - CVE-2022-43241
 - poc6-1, poc6-2 #340 - CVE-2022-43242
 - poc7-1, poc7-2  #341 - CVE-2022-43239
 - poc8-1 #342 - CVE-2022-43244
 - poc9-3 #343 - CVE-2022-43236
 - poc10-2, poc10-3 #344 - CVE-2022-43237
 - poc16 #350
 - poc19 #353

The following are still failing if only this patch is
applied, but they stop failing if #365 is applied as well, but will
still fail with ONLY #365 applied (IOW, both are needed)

 - poc1  #335 - CVE-2022-43240
 - poc3  #337 - CVE-2022-43235
 - poc5   #339 - CVE-2022-43423
 - poc9-1,poc9-2, poc9-4  #343 - CVE-2022-43236
 - poc14  #348 - CVE-2022-43253
 - poc15  #349 - CVE-2022-43248
 - poc17-1, poc17-2  #351
 - poc18 #352 - CVE-2022-43245

Gbp-Pq: Name use_sps_from_the_image.patch

2 years ago[PATCH] Try to mitigate asan failures.
Tobias Frost [Mon, 12 Dec 2022 13:03:12 +0000 (14:03 +0100)]
[PATCH] Try to mitigate asan failures.

See #345 for my analysis and details…

(This PR is just for discussion.)

(The CVE references are obtained from the Debian security tracker,
which links the issues.)

This makes the following POCs stop failing:

- poc3 (#337)
- poc7-1 (#341) CVE-2022-43239 (note: does NOT fix poc7-2)
- poc8-2, poc8-3, poc8-4 (#342) CVE-2022-43244   (note: does NOT fix poc8-1)
- poc11-1, poc11-2 (#345) CVE-2022-43249
- poc12 (#346)
- poc13 (#347) CVE-2022-43252
- poc16 (#350)

Gbp-Pq: Name reject_reference_pics_from_different_sps.patch

2 years agoDisable building of some internal tools that no longer link
Joachim Bauch [Sat, 4 Mar 2023 16:01:58 +0000 (16:01 +0000)]
Disable building of some internal tools that no longer link

because internal symbols are no longer exported.

Gbp-Pq: Name disable_tools.patch

2 years agoOnly export symbols defined in the decoder API.
Joachim Bauch [Sat, 4 Mar 2023 16:01:58 +0000 (16:01 +0000)]
Only export symbols defined in the decoder API.

The encoder API is not final yet, so upstream exports all symbols to make
development easier. For packaging we only want to expose the public API.

Gbp-Pq: Name only_export_decoder_api.patch

2 years agolibde265 (1.0.11-0+deb10u4) buster-security; urgency=medium
Tobias Frost [Sat, 4 Mar 2023 16:01:58 +0000 (16:01 +0000)]
libde265 (1.0.11-0+deb10u4) buster-security; urgency=medium

  * Non-maintainer upload by the LTS Security Team.
  * Import new upstream version, based on the 1.0.11-0+deb11u1 package
    from bullseye.
    - fixing:
      CVE-2023-24751, CVE-2023-24752, CVE-2023-24754, CVE-2023-24755,
      CVE-2023-24756, CVE-2023-24757, CVE-2023-24758 and CVE-2023-25221.
    - dropping no longer needed patches that have been integrated or
      made obsolete by the new upstream version.

[dgit import unpatched libde265 1.0.11-0+deb10u4]

2 years agoImport libde265_1.0.11.orig.tar.gz
Tobias Frost [Sat, 4 Mar 2023 16:01:58 +0000 (16:01 +0000)]
Import libde265_1.0.11.orig.tar.gz

[dgit import orig libde265_1.0.11.orig.tar.gz]

2 years agoImport libde265_1.0.11-0+deb10u4.debian.tar.xz
Tobias Frost [Sat, 4 Mar 2023 16:01:58 +0000 (16:01 +0000)]
Import libde265_1.0.11-0+deb10u4.debian.tar.xz

[dgit import tarball libde265 1.0.11-0+deb10u4 libde265_1.0.11-0+deb10u4.debian.tar.xz]

2 years agoMerge libde265 (1.0.3-1+deb10u3) import into refs/heads/workingbranch
Tobias Frost [Tue, 24 Jan 2023 21:39:16 +0000 (21:39 +0000)]
Merge libde265 (1.0.3-1+deb10u3) import into refs/heads/workingbranch

2 years ago[PATCH] reference PPS from slice by shared_ptr to prevent usage after deallocation
Dirk Farin [Fri, 4 May 2018 14:30:37 +0000 (16:30 +0200)]
[PATCH] reference PPS from slice by shared_ptr to prevent usage after deallocation

Gbp-Pq: Name fix-use-after-free.patch

2 years ago[PATCH] initialize newly created CABAC model table when (fixes #236)
Dirk Farin [Tue, 24 Jan 2023 18:01:42 +0000 (19:01 +0100)]
[PATCH] initialize newly created CABAC model table when (fixes #236)

Gbp-Pq: Name CVE-2020-21596-global-buffer-overflow.patch

2 years ago[PATCH] SAO: fix illegal table access when input pixel is out of range (fixes #351)
Dirk Farin [Tue, 24 Jan 2023 15:53:06 +0000 (16:53 +0100)]
[PATCH] SAO: fix illegal table access when input pixel is out of range (fixes #351)

Gbp-Pq: Name CVE-2022-43245-fix-asan-wildpointer-apply_sao_internal.patch

2 years ago[PATCH] check for negative Q-values in invalid input streams
Dirk Farin [Mon, 16 Jul 2018 08:57:50 +0000 (10:57 +0200)]
[PATCH] check for negative Q-values in invalid input streams

Gbp-Pq: Name check-4-negative-Q-value.patch

2 years ago[PATCH] Don't update sps if they are only repeated
Tobias Frost [Fri, 13 Jan 2023 11:22:45 +0000 (12:22 +0100)]
[PATCH] Don't update sps if they are only repeated

This is an attempt to improve the mitigations from #365 and #366 and picks up an idea I described at #345:

> One way would be just to look at the pointers of the SPS (fast and easy, but
> may reject more than required), or investigate if the SPS used for the image
> generations are "compatible".

This changes do exactly this: It (very conservativly) checks if the old and new sps have
identical information -- except the reference picture set, which I believe is supposed
to be updated by new sps'). If they are basically identical, the old sps will be
used instead of the new one, (of course, reference image set is updated from the new one)

I'm using standalone operator== and helper functions to avoid changing ABI of the library;
if an ABI bump would be done, of course this should go to the respective classes.

Gbp-Pq: Name recycle_sps_if_possible.patch

2 years ago[PATCH] Use the sps from the image
Tobias Frost [Mon, 12 Dec 2022 13:33:40 +0000 (14:33 +0100)]
[PATCH] Use the sps from the image

(as e.g mc_chroma is using the sps to determine
picture properties, like pic_width_in_luma_samples
and pic_height_in_luma_samples, I *think* this is
more correct.

This PR is for discussion. (See #345.)
It makes the failures go away, but that does not mean it's correct :)

The following poc will be stop failing if (only) this
patch is applied:

 - poc2  #336 - CVE-2022-43238
 - poc4  #338 - CVE-2022-43241
 - poc6-1, poc6-2 #340 - CVE-2022-43242
 - poc7-1, poc7-2  #341 - CVE-2022-43239
 - poc8-1 #342 - CVE-2022-43244
 - poc9-3 #343 - CVE-2022-43236
 - poc10-2, poc10-3 #344 - CVE-2022-43237
 - poc16 #350
 - poc19 #353

The following are still failing if only this patch is
applied, but they stop failing if #365 is applied as well, but will
still fail with ONLY #365 applied (IOW, both are needed)

 - poc1  #335 - CVE-2022-43240
 - poc3  #337 - CVE-2022-43235
 - poc5   #339 - CVE-2022-43423
 - poc9-1,poc9-2, poc9-4  #343 - CVE-2022-43236
 - poc14  #348 - CVE-2022-43253
 - poc15  #349 - CVE-2022-43248
 - poc17-1, poc17-2  #351
 - poc18 #352 - CVE-2022-43245

Gbp-Pq: Name use_sps_from_the_image.patch

2 years ago[PATCH] Try to mitigate asan failures.
Tobias Frost [Mon, 12 Dec 2022 13:03:12 +0000 (14:03 +0100)]
[PATCH] Try to mitigate asan failures.

See #345 for my analysis and details…

(This PR is just for discussion.)

(The CVE references are obtained from the Debian security tracker,
which links the issues.)

This makes the following POCs stop failing:

- poc3 (#337)
- poc7-1 (#341) CVE-2022-43239 (note: does NOT fix poc7-2)
- poc8-2, poc8-3, poc8-4 (#342) CVE-2022-43244   (note: does NOT fix poc8-1)
- poc11-1, poc11-2 (#345) CVE-2022-43249
- poc12 (#346)
- poc13 (#347) CVE-2022-43252
- poc16 (#350)

Gbp-Pq: Name reject_reference_pics_from_different_sps.patch

2 years ago[PATCH] fix reading invalid images where shdr references are NULL in part of the...
Dirk Farin [Tue, 5 Apr 2022 18:00:20 +0000 (20:00 +0200)]
[PATCH] fix reading invalid images where shdr references are NULL in part of the image (#302)

Gbp-Pq: Name CVE-2021-36411.patch

2 years ago[PATCH] fix MC with HDR chroma, but SDR luma (#301)
Dirk Farin [Tue, 5 Apr 2022 17:27:04 +0000 (19:27 +0200)]
[PATCH] fix MC with HDR chroma, but SDR luma (#301)

Gbp-Pq: Name CVE-2021-36410.patch

2 years ago[PATCH] fix assertion when reading invalid scaling_list (#300)
Dirk Farin [Tue, 5 Apr 2022 15:53:43 +0000 (17:53 +0200)]
[PATCH] fix assertion when reading invalid scaling_list (#300)

Gbp-Pq: Name CVE-2021-36409.patch

2 years ago[PATCH] fix streams where SPS image size changes without refreshing PPS (#299)
Dirk Farin [Tue, 5 Apr 2022 16:41:28 +0000 (18:41 +0200)]
[PATCH] fix streams where SPS image size changes without refreshing PPS (#299)

Gbp-Pq: Name CVE-2021-36408.patch

2 years ago[PATCH] fix check for valid PPS idx (#298)
Dirk Farin [Tue, 5 Apr 2022 17:35:46 +0000 (19:35 +0200)]
[PATCH] fix check for valid PPS idx (#298)

Gbp-Pq: Name CVE-2021-35452.patch

2 years ago[PATCH] return error when PCM bits parameter exceeds pixel depth (#225)
Dirk Farin [Tue, 23 Feb 2021 14:11:09 +0000 (15:11 +0100)]
[PATCH] return error when PCM bits parameter exceeds pixel depth (#225)

Gbp-Pq: Name CVE-2020-21599.patch

2 years agofix invalid memory access after unavailable reference frame insertion
Debian Multimedia Maintainers [Tue, 24 Jan 2023 21:39:16 +0000 (21:39 +0000)]
fix invalid memory access after unavailable reference frame insertion

Origin: https://github.com/strukturag/libde265/commit/ee8e09a7f6f65b7c409c7801ad64918a2925ed9b
Reviewed-by: Tobias Frost <tobi@debian.org>
Last-Update: 2023-01-24 <YYYY-MM-DD, last update of the meta-information, optional>

Needed to avoid asan errors for the version at hand, otherwise the crash even
happens before the pocs triggers.
Last-Update: 2023-01-24 <YYYY-MM-DD, last update of the meta-information, optional>
Gbp-Pq: Name fix-invalid-memory-access.patch

2 years agoReplace deprecated FFmpeg API
Andreas Cadhalpun [Tue, 24 Jan 2023 21:39:16 +0000 (21:39 +0000)]
Replace deprecated FFmpeg API

Last-Update: <2015-11-02>

Gbp-Pq: Name ffmpeg_2.9.patch

2 years agoDisable building of some internal tools that no longer link
Joachim Bauch [Tue, 24 Jan 2023 21:39:16 +0000 (21:39 +0000)]
Disable building of some internal tools that no longer link

because internal symbols are not exported.

Gbp-Pq: Name disable_tools.patch

2 years agoOnly export symbols defined in the decoder API.
Joachim Bauch [Tue, 24 Jan 2023 21:39:16 +0000 (21:39 +0000)]
Only export symbols defined in the decoder API.

The encoder API is not final yet, so upstream exports all symbols to make
development easier. For packaging we only want to expose the public API.

Gbp-Pq: Name only_export_decoder_api.patch

2 years agolibde265 (1.0.3-1+deb10u3) buster-security; urgency=medium
Tobias Frost [Tue, 24 Jan 2023 21:39:16 +0000 (21:39 +0000)]
libde265 (1.0.3-1+deb10u3) buster-security; urgency=medium

  * Non-maintainer upload by the LTS Security Team.
  * Source-only upload. (Last upload was accidentially a binary-upload)

[dgit import unpatched libde265 1.0.3-1+deb10u3]

2 years agoImport libde265_1.0.3-1+deb10u3.debian.tar.xz
Tobias Frost [Tue, 24 Jan 2023 21:39:16 +0000 (21:39 +0000)]
Import libde265_1.0.3-1+deb10u3.debian.tar.xz

[dgit import tarball libde265 1.0.3-1+deb10u3 libde265_1.0.3-1+deb10u3.debian.tar.xz]

3 years agoMerge version 1.0.3-1+rpi1 and 1.0.3-1+deb10u1 to produce 1.0.3-1+rpi1+deb10u1 archive/raspbian/1.0.3-1+rpi1+deb10u1 raspbian/1.0.3-1+rpi1+deb10u1
Raspbian automatic forward porter [Thu, 15 Dec 2022 22:08:55 +0000 (22:08 +0000)]
Merge version 1.0.3-1+rpi1 and 1.0.3-1+deb10u1 to produce 1.0.3-1+rpi1+deb10u1

3 years agoMerge libde265 (1.0.3-1+deb10u1) import into refs/heads/workingbranch
Tobias Frost [Thu, 15 Dec 2022 16:40:12 +0000 (16:40 +0000)]
Merge libde265 (1.0.3-1+deb10u1) import into refs/heads/workingbranch

3 years ago[PATCH] fix reading invalid images where shdr references are NULL in part of the...
Dirk Farin [Tue, 5 Apr 2022 18:00:20 +0000 (20:00 +0200)]
[PATCH] fix reading invalid images where shdr references are NULL in part of the image (#302)

Gbp-Pq: Name CVE-2021-36411.patch

3 years ago[PATCH] fix MC with HDR chroma, but SDR luma (#301)
Dirk Farin [Tue, 5 Apr 2022 17:27:04 +0000 (19:27 +0200)]
[PATCH] fix MC with HDR chroma, but SDR luma (#301)

Gbp-Pq: Name CVE-2021-36410.patch

3 years ago[PATCH] fix assertion when reading invalid scaling_list (#300)
Dirk Farin [Tue, 5 Apr 2022 15:53:43 +0000 (17:53 +0200)]
[PATCH] fix assertion when reading invalid scaling_list (#300)

Gbp-Pq: Name CVE-2021-36409.patch

3 years ago[PATCH] fix streams where SPS image size changes without refreshing PPS (#299)
Dirk Farin [Tue, 5 Apr 2022 16:41:28 +0000 (18:41 +0200)]
[PATCH] fix streams where SPS image size changes without refreshing PPS (#299)

Gbp-Pq: Name CVE-2021-36408.patch

3 years ago[PATCH] fix check for valid PPS idx (#298)
Dirk Farin [Tue, 5 Apr 2022 17:35:46 +0000 (19:35 +0200)]
[PATCH] fix check for valid PPS idx (#298)

Gbp-Pq: Name CVE-2021-35452.patch

3 years ago[PATCH] return error when PCM bits parameter exceeds pixel depth (#225)
Dirk Farin [Tue, 23 Feb 2021 14:11:09 +0000 (15:11 +0100)]
[PATCH] return error when PCM bits parameter exceeds pixel depth (#225)

Gbp-Pq: Name CVE-2020-21599.patch

3 years agoReplace deprecated FFmpeg API
Andreas Cadhalpun [Thu, 15 Dec 2022 16:40:12 +0000 (16:40 +0000)]
Replace deprecated FFmpeg API

Last-Update: <2015-11-02>

Gbp-Pq: Name ffmpeg_2.9.patch

3 years agoDisable building of some internal tools that no longer link
Joachim Bauch [Thu, 15 Dec 2022 16:40:12 +0000 (16:40 +0000)]
Disable building of some internal tools that no longer link

because internal symbols are not exported.

Gbp-Pq: Name disable_tools.patch

3 years agoOnly export symbols defined in the decoder API.
Joachim Bauch [Thu, 15 Dec 2022 16:40:12 +0000 (16:40 +0000)]
Only export symbols defined in the decoder API.

The encoder API is not final yet, so upstream exports all symbols to make
development easier. For packaging we only want to expose the public API.

Gbp-Pq: Name only_export_decoder_api.patch

3 years agolibde265 (1.0.3-1+deb10u1) buster-security; urgency=medium
Tobias Frost [Thu, 15 Dec 2022 16:40:12 +0000 (16:40 +0000)]
libde265 (1.0.3-1+deb10u1) buster-security; urgency=medium

  * Non-maintainer upload by the LTS Security Team.
  * Cherry-pick upstream patches for:
    - CVE-2020-21599 (See #1014999)
    - CVE-2021-35452, CVE-2021-36408, CVE-2021-36409, CVE-2021-36410 and
      CVE-2021-36411 (Closes: 1014977)

[dgit import unpatched libde265 1.0.3-1+deb10u1]

3 years agoImport libde265_1.0.3-1+deb10u1.debian.tar.xz
Tobias Frost [Thu, 15 Dec 2022 16:40:12 +0000 (16:40 +0000)]
Import libde265_1.0.3-1+deb10u1.debian.tar.xz

[dgit import tarball libde265 1.0.3-1+deb10u1 libde265_1.0.3-1+deb10u1.debian.tar.xz]

7 years agoMerge version 1.0.2-2+rpi1 and 1.0.3-1 to produce 1.0.3-1+rpi1 archive/raspbian/1.0.3-1+rpi1 raspbian/1.0.3-1+rpi1
Raspbian forward pporter [Thu, 26 Apr 2018 05:53:11 +0000 (06:53 +0100)]
Merge version 1.0.2-2+rpi1 and 1.0.3-1 to produce 1.0.3-1+rpi1

7 years agoImport libde265_1.0.3.orig.tar.gz
Joachim Bauch [Thu, 19 Apr 2018 09:44:40 +0000 (10:44 +0100)]
Import libde265_1.0.3.orig.tar.gz

[dgit import orig libde265_1.0.3.orig.tar.gz]

7 years agoMerge libde265 (1.0.3-1) import into refs/heads/workingbranch
Joachim Bauch [Thu, 19 Apr 2018 09:44:40 +0000 (10:44 +0100)]
Merge libde265 (1.0.3-1) import into refs/heads/workingbranch

7 years agoffmpeg_2.9
Debian Multimedia Maintainers [Thu, 19 Apr 2018 09:44:40 +0000 (10:44 +0100)]
ffmpeg_2.9

Gbp-Pq: Name ffmpeg_2.9.patch

7 years agodisable_tools
Debian Multimedia Maintainers [Thu, 19 Apr 2018 09:44:40 +0000 (10:44 +0100)]
disable_tools

Gbp-Pq: Name disable_tools.patch

7 years agoonly_export_decoder_api
Debian Multimedia Maintainers [Thu, 19 Apr 2018 09:44:40 +0000 (10:44 +0100)]
only_export_decoder_api

Gbp-Pq: Name only_export_decoder_api.patch

7 years agolibde265 (1.0.3-1) unstable; urgency=medium
Joachim Bauch [Thu, 19 Apr 2018 09:44:40 +0000 (10:44 +0100)]
libde265 (1.0.3-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/copyright: Use https protocol in Format field
  * d/control: Set Vcs-* to salsa.debian.org

  [ Felipe Sateler ]
  * Change maintainer address to debian-multimedia@lists.debian.org

  [ Joachim Bauch ]
  * Imported Upstream version 1.0.3
  * Update patches for new upstream version.
  * Update symbols for new upstream version.
  * Update standards version and switch to debhelper 10.

[dgit import unpatched libde265 1.0.3-1]

7 years agoImport libde265_1.0.3-1.debian.tar.xz
Joachim Bauch [Thu, 19 Apr 2018 09:44:40 +0000 (10:44 +0100)]
Import libde265_1.0.3-1.debian.tar.xz

[dgit import tarball libde265 1.0.3-1 libde265_1.0.3-1.debian.tar.xz]

8 years agoMerge libde265 (1.0.2-2+rpi1) import into refs/heads/workingbranch
Raspbian Automatic git importer [Thu, 22 Dec 2016 04:31:19 +0000 (04:31 +0000)]
Merge libde265 (1.0.2-2+rpi1) import into refs/heads/workingbranch

8 years agoMerge libde265 (1.0.2-2) import into refs/heads/workingbranch
Raspbian Automatic git importer [Thu, 22 Dec 2016 04:31:19 +0000 (04:31 +0000)]
Merge libde265 (1.0.2-2) import into refs/heads/workingbranch

9 years agodisable-neon
Debian Multimedia Maintainers [Mon, 25 Jan 2016 01:25:24 +0000 (01:25 +0000)]
disable-neon

Gbp-Pq: Name disable-neon.patch

9 years agoffmpeg_2.9
Debian Multimedia Maintainers [Mon, 25 Jan 2016 01:25:24 +0000 (01:25 +0000)]
ffmpeg_2.9

Gbp-Pq: Name ffmpeg_2.9.patch

9 years agodisable_tools
Debian Multimedia Maintainers [Mon, 25 Jan 2016 01:25:24 +0000 (01:25 +0000)]
disable_tools

Gbp-Pq: Name disable_tools.patch

9 years agoonly_export_decoder_api
Debian Multimedia Maintainers [Mon, 25 Jan 2016 01:25:24 +0000 (01:25 +0000)]
only_export_decoder_api

Gbp-Pq: Name only_export_decoder_api.patch

9 years agolibde265 (1.0.2-2+rpi1) stretch-staging; urgency=medium
Raspbian forward porter [Mon, 25 Jan 2016 01:25:24 +0000 (01:25 +0000)]
libde265 (1.0.2-2+rpi1) stretch-staging; urgency=medium

  [changes brought forward from 1.0.2-1+rpi1 by Peter Michael Green <plugwash@raspbian.org> at Sun, 04 Oct 2015 21:44:10 +0000]
  * Disable neon.

[dgit import unpatched libde265 1.0.2-2+rpi1]

9 years agoImport libde265_1.0.2-2+rpi1.debian.tar.xz
Raspbian forward porter [Mon, 25 Jan 2016 01:25:24 +0000 (01:25 +0000)]
Import libde265_1.0.2-2+rpi1.debian.tar.xz

[dgit import tarball libde265 1.0.2-2+rpi1 libde265_1.0.2-2+rpi1.debian.tar.xz]

9 years agoffmpeg_2.9
Debian Multimedia Maintainers [Mon, 11 Jan 2016 18:12:19 +0000 (18:12 +0000)]
ffmpeg_2.9

Gbp-Pq: Name ffmpeg_2.9.patch

9 years agodisable_tools
Debian Multimedia Maintainers [Mon, 11 Jan 2016 18:12:19 +0000 (18:12 +0000)]
disable_tools

Gbp-Pq: Name disable_tools.patch

9 years agoonly_export_decoder_api
Debian Multimedia Maintainers [Mon, 11 Jan 2016 18:12:19 +0000 (18:12 +0000)]
only_export_decoder_api

Gbp-Pq: Name only_export_decoder_api.patch

9 years agolibde265 (1.0.2-2) unstable; urgency=low
Joachim Bauch [Mon, 11 Jan 2016 18:12:19 +0000 (18:12 +0000)]
libde265 (1.0.2-2) unstable; urgency=low

  [ Joachim Bauch ]
  * Added patch by Andreas Cadhalpun to fix compilation with FFmpeg 2.9
    (Closes: #803834)
  * Updated symbols file for new C++11 symbols.

  [ Sebastian Ramacher ]
  * Migrate to automatic dbg packages.
  * debian/control: Remove some unnecessary Build-Depends.

[dgit import unpatched libde265 1.0.2-2]

9 years agoImport libde265_1.0.2-2.debian.tar.xz
Joachim Bauch [Mon, 11 Jan 2016 18:12:19 +0000 (18:12 +0000)]
Import libde265_1.0.2-2.debian.tar.xz

[dgit import tarball libde265 1.0.2-2 libde265_1.0.2-2.debian.tar.xz]

10 years agoImport libde265_1.0.2.orig.tar.gz
Joachim Bauch [Thu, 16 Jul 2015 09:07:46 +0000 (09:07 +0000)]
Import libde265_1.0.2.orig.tar.gz

[dgit import orig libde265_1.0.2.orig.tar.gz]

11 years agolibde265 (0.9-1) unstable; urgency=low
Joachim Bauch [Tue, 16 Sep 2014 16:47:14 +0000 (16:47 +0000)]
libde265 (0.9-1) unstable; urgency=low

  * Updated symbols to make all "std::vector" symbols optional.
  * Imported Upstream version 0.9
  * Removed deprecated patch to update symbols visibility. Changes were
    applied upstream.
  * Upstream supports compiling against Qt5, prefer that over Qt4.
  * Added new symbols from new upstream release.

[dgit import unpatched libde265 0.9-1]

11 years agoImport libde265_0.9.orig.tar.gz
Joachim Bauch [Tue, 16 Sep 2014 16:47:14 +0000 (16:47 +0000)]
Import libde265_0.9.orig.tar.gz

[dgit import orig libde265_0.9.orig.tar.gz]

11 years agoImport libde265_0.9-1.debian.tar.xz
Joachim Bauch [Tue, 16 Sep 2014 16:47:14 +0000 (16:47 +0000)]
Import libde265_0.9-1.debian.tar.xz

[dgit import tarball libde265 0.9-1 libde265_0.9-1.debian.tar.xz]