From a8f2e19532bab40d0c712b8adc71f3259ee6f07d Mon Sep 17 00:00:00 2001 From: Carlos Bentzen Date: Fri, 20 Feb 2026 17:40:24 +0100 Subject: [PATCH] [PATCH] h266parser: Fix APS ID bounds check in APS parsing Gbp-Pq: Name CVE-2026-3086.patch --- gst-libs/gst/codecparsers/gsth266parser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gst-libs/gst/codecparsers/gsth266parser.c b/gst-libs/gst/codecparsers/gsth266parser.c index 7649e2ca..5cf4b1c2 100644 --- a/gst-libs/gst/codecparsers/gsth266parser.c +++ b/gst-libs/gst/codecparsers/gsth266parser.c @@ -4389,7 +4389,7 @@ gst_h266_parse_aps (GstH266Parser * parser, GstH266NalUnit * nalu, READ_UINT8 (&nr, params_type, 3); aps->params_type = params_type; READ_UINT8 (&nr, aps->aps_id, 5); - CHECK_ALLOWED_MAX (aps->aps_id, GST_H266_MAX_APS_COUNT); + CHECK_ALLOWED_MAX (aps->aps_id, GST_H266_MAX_APS_COUNT - 1); READ_UINT8 (&nr, aps->chroma_present_flag, 1); switch (aps->params_type) { -- 2.30.2