Version in base suite: 1.0.15-1 Base version: libde265_1.0.15-1 Target version: libde265_1.0.15-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/libd/libde265/libde265_1.0.15-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/libd/libde265/libde265_1.0.15-1+deb13u1.dsc changelog | 10 patches/CVE-2024-38949_CVE-2024-38950.patch | 111 +++++++ patches/CVE-2025-61147.patch | 98 ++++++ patches/CVE-2026-45382.patch | 48 +++ patches/CVE-2026-45383.patch | 22 + patches/CVE-2026-49295.patch | 36 ++ patches/CVE-2026-49337.patch | 48 +++ patches/CVE-2026-49346.patch | 98 ++++++ patches/CVE-2026-54240_CVE-2026-54241.patch | 394 ++++++++++++++++++++++++++++ patches/series | 8 10 files changed, 873 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp365jm1cq/libde265_1.0.15-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp365jm1cq/libde265_1.0.15-1+deb13u1.dsc: no acceptable signature found diff -Nru libde265-1.0.15/debian/changelog libde265-1.0.15/debian/changelog --- libde265-1.0.15/debian/changelog 2023-12-21 08:29:24.000000000 +0000 +++ libde265-1.0.15/debian/changelog 2026-08-06 05:05:03.000000000 +0000 @@ -1,3 +1,13 @@ +libde265 (1.0.15-1+deb13u1) trixie-security; urgency=medium + + * Non-maintainer upload by the Security Team. + * Backport upstream security fixes + CVE-2024-38949, CVE-2024-38950, CVE-2025-61147, CVE-2026-45382, + CVE-2026-45383, CVE-2026-49295, CVE-2026-49337, CVE-2026-49346, + CVE-2026-54240, CVE-2026-54241 + + -- Aron Xu Thu, 06 Aug 2026 13:05:03 +0800 + libde265 (1.0.15-1) unstable; urgency=medium * New upstream version 1.0.15 diff -Nru libde265-1.0.15/debian/patches/CVE-2024-38949_CVE-2024-38950.patch libde265-1.0.15/debian/patches/CVE-2024-38949_CVE-2024-38950.patch --- libde265-1.0.15/debian/patches/CVE-2024-38949_CVE-2024-38950.patch 1970-01-01 00:00:00.000000000 +0000 +++ libde265-1.0.15/debian/patches/CVE-2024-38949_CVE-2024-38950.patch 2026-08-06 05:05:03.000000000 +0000 @@ -0,0 +1,111 @@ +Description: CVE-2024-38949, CVE-2024-38950: fix SDL OOB in dec265 display path + Heap buffer overflow in the dec265 SDL output on 4:4:4 streams + (display444as420) and on mid-stream resolution changes. +Origin: upstream, https://github.com/strukturag/libde265/commit/4089de0845e0009e019be4ca5cbebaf2aee0a8ce +Bug: https://github.com/strukturag/libde265/issues/460 +Bug-Debian: https://bugs.debian.org/1074416 +Applied-Upstream: 1.0.19 + +diff --git a/dec265/dec265.cc b/dec265/dec265.cc +index ecf5d131..708408b9 100644 +--- a/dec265/dec265.cc ++++ b/dec265/dec265.cc +@@ -270,17 +270,20 @@ bool display_sdl(const struct de265_image* img) + + de265_chroma chroma = de265_get_chroma_format(img); + ++ enum SDL_YUV_Display::SDL_Chroma sdlChroma; ++ switch (chroma) { ++ case de265_chroma_420: sdlChroma = SDL_YUV_Display::SDL_CHROMA_420; break; ++ case de265_chroma_422: sdlChroma = SDL_YUV_Display::SDL_CHROMA_422; break; ++ case de265_chroma_444: sdlChroma = SDL_YUV_Display::SDL_CHROMA_444; break; ++ case de265_chroma_mono: sdlChroma = SDL_YUV_Display::SDL_CHROMA_MONO; break; ++ default: assert(false); sdlChroma = SDL_YUV_Display::SDL_CHROMA_MONO; ++ } ++ + if (!sdl_active) { + sdl_active=true; +- enum SDL_YUV_Display::SDL_Chroma sdlChroma; +- switch (chroma) { +- case de265_chroma_420: sdlChroma = SDL_YUV_Display::SDL_CHROMA_420; break; +- case de265_chroma_422: sdlChroma = SDL_YUV_Display::SDL_CHROMA_422; break; +- case de265_chroma_444: sdlChroma = SDL_YUV_Display::SDL_CHROMA_444; break; +- case de265_chroma_mono: sdlChroma = SDL_YUV_Display::SDL_CHROMA_MONO; break; +- } +- +- sdlWin.init(width,height, sdlChroma); ++ if (!sdlWin.init(width,height, sdlChroma)) return true; ++ } else { ++ if (!sdlWin.resize(width,height, sdlChroma)) return true; + } + + int stride,chroma_stride; +diff --git a/dec265/sdl.cc b/dec265/sdl.cc +index eab1f8f1..4211011d 100644 +--- a/dec265/sdl.cc ++++ b/dec265/sdl.cc +@@ -94,6 +94,43 @@ bool SDL_YUV_Display::init(int frame_width, int frame_height, enum SDL_Chroma ch + return true; + } + ++bool SDL_YUV_Display::resize(int frame_width, int frame_height, enum SDL_Chroma chroma) ++{ ++ if (!mWindowOpen) { ++ return init(frame_width, frame_height, chroma); ++ } ++ ++ // SDL_PIXELFORMAT_YV12 requires even dimensions; init() rounds down to a ++ // multiple of 8, so we do the same here for consistency. ++ frame_width &= ~7; ++ frame_height &= ~7; ++ ++ if (frame_width == rect.w && frame_height == rect.h && mChroma == chroma) { ++ return true; ++ } ++ ++ // All chroma formats currently map to SDL_PIXELFORMAT_YV12 (we down-convert ++ // 4:2:2 and 4:4:4 ourselves), so the texture pixel format never changes. ++ // Only the texture dimensions and the window size need updating. ++ SDL_DestroyTexture(mTexture); ++ mTexture = SDL_CreateTexture(mRenderer, SDL_PIXELFORMAT_YV12, ++ SDL_TEXTUREACCESS_STREAMING, ++ frame_width, frame_height); ++ if (!mTexture) { ++ printf("SDL: Couldn't recreate SDL texture: %s\n", SDL_GetError()); ++ mWindowOpen = false; ++ return false; ++ } ++ ++ SDL_SetWindowSize(mWindow, frame_width, frame_height); ++ ++ mChroma = chroma; ++ rect.w = frame_width; ++ rect.h = frame_height; ++ ++ return true; ++} ++ + void SDL_YUV_Display::display(const unsigned char *Y, + const unsigned char *U, + const unsigned char *V, +@@ -247,7 +284,7 @@ void SDL_YUV_Display::display444as420(const unsigned char *Y, + } + + uint8_t *startV = mPixels + (rect.h*mStride); +- uint8_t *startU = startV + (rect.h*mStride/2); ++ uint8_t *startU = startV + (rect.h*mStride/4); + for (int y=0;y ++#include ++#include ++ + #ifdef HAVE_CONFIG_H + #include "config.h" + #endif +@@ -563,6 +567,40 @@ void (*volatile __malloc_initialize_hook)(void) = init_my_hooks; + #endif + + ++int parse_param(const char* arg, std::optional lower_bound, std::optional upper_bound, const char* arg_name) ++{ ++ int value; ++ ++ try { ++ size_t len; ++ value = std::stoi(optarg, &len); ++ if (arg[len] != 0) { ++ std::cerr << "invalid argument to " << arg_name << "\n"; ++ exit(5); ++ } ++ } catch (std::invalid_argument const& ex) { ++ std::cerr << "invalid argument to " << arg_name << "\n"; ++ exit(5); ++ } ++ catch (std::out_of_range const& ex) { ++ std::cerr << "argument to -T is out of range\n"; ++ exit(5); ++ } ++ ++ if (lower_bound && value < *lower_bound) { ++ std::cerr << "argument to " << arg_name << " may not be smaller than " << *lower_bound << "\n"; ++ exit(5); ++ } ++ ++ if (upper_bound && value > *upper_bound) { ++ std::cerr << "argument to " << arg_name << " may not be larger than " << *upper_bound << "\n"; ++ exit(5); ++ } ++ ++ return value; ++} ++ ++ + int main(int argc, char** argv) + { + while (1) { +@@ -578,9 +616,9 @@ int main(int argc, char** argv) + + switch (c) { + case 'q': quiet++; break; +- case 't': nThreads=atoi(optarg); break; ++ case 't': nThreads=parse_param(optarg, 0, std::nullopt, "-t"); break; + case 'c': check_hash=true; break; +- case 'f': max_frames=atoi(optarg); break; ++ case 'f': max_frames=parse_param(optarg, 1, std::nullopt, "-f"); break; + case 'o': write_yuv=true; output_filename=optarg; break; + case 'h': show_help=true; break; + case 'd': dump_headers=true; break; +@@ -592,7 +630,7 @@ int main(int argc, char** argv) + case 'm': measure_quality=true; reference_filename=optarg; break; + case 's': show_ssim_map=true; break; + case 'e': show_psnr_map=true; break; +- case 'T': highestTID=atoi(optarg); break; ++ case 'T': highestTID = parse_param(optarg, 0, std::nullopt, "-T"); break; + case 'v': verbosity++; break; + } + } diff -Nru libde265-1.0.15/debian/patches/CVE-2026-45382.patch libde265-1.0.15/debian/patches/CVE-2026-45382.patch --- libde265-1.0.15/debian/patches/CVE-2026-45382.patch 1970-01-01 00:00:00.000000000 +0000 +++ libde265-1.0.15/debian/patches/CVE-2026-45382.patch 2026-08-06 05:04:02.000000000 +0000 @@ -0,0 +1,48 @@ +Description: CVE-2026-45382: fix CTB OOB access when pps.sps mismatches active sps + Malformed PPS data creates an out-of-bounds index into the CtbAddrRStoTS + array, causing a heap-buffer-overflow read in decode_slice_unit_tiles. +Origin: upstream, https://github.com/strukturag/libde265/commit/c33b4f63ae9056b00f34a31874fed55cd0aa29c9 +Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9 +Applied-Upstream: 1.0.19 + +diff --git a/libde265/decctx.cc b/libde265/decctx.cc +index 7c758fcb..ea2e2136 100644 +--- a/libde265/decctx.cc ++++ b/libde265/decctx.cc +@@ -1317,6 +1317,11 @@ de265_error decoder_context::decode_slice_unit_WPP(image_unit* imgunit, + tctx->img = img; + tctx->imgunit = imgunit; + tctx->sliceunit= sliceunit; ++ ++ if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) { ++ err = DE265_WARNING_SLICEHEADER_INVALID; ++ break; ++ } + tctx->CtbAddrInTS = pps.CtbAddrRStoTS[ctbAddrRS]; + + init_thread_context(tctx); +@@ -1394,6 +1399,12 @@ de265_error decoder_context::decode_slice_unit_tiles(image_unit* imgunit, + + // first CTB in this slice + int ctbAddrRS = shdr->slice_segment_address; ++ ++ // pps.TileIdRS and pps.CtbAddrRStoTS are both sized to PicSizeInCtbsY in ++ // set_derived_values(), so one bound covers both accesses below. ++ if ((size_t)ctbAddrRS >= pps.CtbAddrRStoTS.size()) { ++ return DE265_WARNING_SLICEHEADER_INVALID; ++ } + int tileID = pps.TileIdRS[ctbAddrRS]; + + for (int entryPt=0;entryPt= pps.CtbAddrRStoTS.size()) { ++ err = DE265_WARNING_SLICEHEADER_INVALID; ++ break; ++ } + } + + // set thread context diff -Nru libde265-1.0.15/debian/patches/CVE-2026-45383.patch libde265-1.0.15/debian/patches/CVE-2026-45383.patch --- libde265-1.0.15/debian/patches/CVE-2026-45383.patch 1970-01-01 00:00:00.000000000 +0000 +++ libde265-1.0.15/debian/patches/CVE-2026-45383.patch 2026-08-06 05:04:28.000000000 +0000 @@ -0,0 +1,22 @@ +Description: CVE-2026-45383: prevent reading past end of CtbAddrRStoTS[] in WPP images + In the WPP slice decoder ctbAddrRS = ctbRow * ctbsWidth can exceed the + allocated vector size, causing out-of-bounds reads. +Origin: upstream, https://github.com/strukturag/libde265/commit/d1a2c3b4b751d21f44e8e82220fe9766c9d116ff +Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38 +Applied-Upstream: 1.0.19 + +diff --git a/libde265/decctx.cc b/libde265/decctx.cc +index ea2e2136..ed8709d8 100644 +--- a/libde265/decctx.cc ++++ b/libde265/decctx.cc +@@ -1291,6 +1291,10 @@ de265_error decoder_context::decode_slice_unit_WPP(image_unit* imgunit, + int ctbAddrRS = shdr->slice_segment_address; + int ctbRow = ctbAddrRS / ctbsWidth; + ++ if (ctbRow + nRows > img->get_sps().PicHeightInCtbsY) { ++ return DE265_WARNING_SLICEHEADER_INVALID; ++ } ++ + for (int entryPt=0;entryPt0) { diff -Nru libde265-1.0.15/debian/patches/CVE-2026-49295.patch libde265-1.0.15/debian/patches/CVE-2026-49295.patch --- libde265-1.0.15/debian/patches/CVE-2026-49295.patch 1970-01-01 00:00:00.000000000 +0000 +++ libde265-1.0.15/debian/patches/CVE-2026-49295.patch 2026-08-06 05:04:28.000000000 +0000 @@ -0,0 +1,36 @@ +Description: CVE-2026-49295: bound aggregate short-term RPS size + Missing aggregate bound check on predicted reference picture set entries + allows exceeding the 16-entry array, an out-of-bounds array write in + process_reference_picture_set(). +Origin: upstream, https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b +Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594 +Bug-Debian: https://bugs.debian.org/1140431 +Applied-Upstream: 1.1.0 + +diff --git a/libde265/refpic.cc b/libde265/refpic.cc +index 77cc719e..ab7de2a6 100644 +--- a/libde265/refpic.cc ++++ b/libde265/refpic.cc +@@ -318,6 +318,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue, + + out_set->compute_derived_values(); + ++ // The unused short-term references are all collected into a single PocStFoll array ++ // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set). ++ // While each individual list is bounded above, the predicted-RPS construction can ++ // append the current-picture delta to an already-full source set, pushing the ++ // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds ++ // write when filling PocStFoll. ++ if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) { ++ out_set->NumNegativePics = 0; ++ out_set->NumPositivePics = 0; ++ out_set->NumDeltaPocs = 0; ++ out_set->NumPocTotalCurr_shortterm_only = 0; ++ ++ errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false); ++ return false; ++ } ++ + return true; + } + diff -Nru libde265-1.0.15/debian/patches/CVE-2026-49337.patch libde265-1.0.15/debian/patches/CVE-2026-49337.patch --- libde265-1.0.15/debian/patches/CVE-2026-49337.patch 1970-01-01 00:00:00.000000000 +0000 +++ libde265-1.0.15/debian/patches/CVE-2026-49337.patch 2026-08-06 05:04:02.000000000 +0000 @@ -0,0 +1,48 @@ +Description: CVE-2026-49337: free orphaned slice header when no active image unit + Slice headers attached to finished pictures without an active image unit + were retained forever; a crafted NAL sequence can grow memory without + bound during continuous streaming. +Origin: upstream, https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9 +Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm +Bug-Debian: https://bugs.debian.org/1140431 +Applied-Upstream: 1.1.0 +Comment: Backport: on 1.0.15 the pre-existing unconditional add_slice_segment_header() call must be removed (upstream moves it into the guarded block); keeping both would double-free every slice header. + +diff --git a/libde265/decctx.cc b/libde265/decctx.cc +index ed8709d8..8383dd2b 100644 +--- a/libde265/decctx.cc ++++ b/libde265/decctx.cc +@@ -928,8 +928,6 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + return err; + } + +- this->img->add_slice_segment_header(shdr); +- + skip_bits(&reader,1); // TODO: why? + prepare_for_CABAC(&reader); + +@@ -957,6 +955,13 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + + if ( ! image_units.empty() ) { + ++ // Hand the slice header to the picture (which takes ownership and frees it ++ // on release). Only do this when there is an active image unit to decode ++ // the slice; otherwise the header would be retained on img->slices forever, ++ // which a crafted stream of non-first slice NALs can exploit to grow memory ++ // without bound. ++ this->img->add_slice_segment_header(shdr); ++ + slice_unit* sliceunit = new slice_unit(this); + sliceunit->nal = nal; + sliceunit->shdr = shdr; +@@ -967,6 +972,10 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + + image_units.back()->slice_units.push_back(sliceunit); + } ++ else { ++ nal_parser.free_NAL_unit(nal); ++ delete shdr; ++ } + + bool did_work; + err = decode_some(&did_work); diff -Nru libde265-1.0.15/debian/patches/CVE-2026-49346.patch libde265-1.0.15/debian/patches/CVE-2026-49346.patch --- libde265-1.0.15/debian/patches/CVE-2026-49346.patch 1970-01-01 00:00:00.000000000 +0000 +++ libde265-1.0.15/debian/patches/CVE-2026-49346.patch 2026-08-06 05:04:02.000000000 +0000 @@ -0,0 +1,98 @@ +Description: CVE-2026-49346: fix integer overflow in image plane allocation size + Large SPS dimensions with 16-bit bit depth overflow the 32-bit allocation + size in de265_image_get_buffer(); the wrapped ~1 KB allocation is later + written with the full plane size, corrupting the heap. +Origin: upstream, https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8 +Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86 +Bug-Debian: https://bugs.debian.org/1140431 +Applied-Upstream: 1.1.0 + +diff --git a/libde265/image.cc b/libde265/image.cc +index 0ae77511..9ddfed2c 100644 +--- a/libde265/image.cc ++++ b/libde265/image.cc +@@ -71,10 +71,11 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx, + void* inputdata, int inputstride, void *userdata) + { + int alignment = STANDARD_ALIGNMENT; +- int stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment; +- int height = img->get_height(cIdx); ++ uint32_t stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment; ++ uint32_t height = img->get_height(cIdx); + +- uint8_t* p = (uint8_t *)ALLOC_ALIGNED_16(stride * height + MEMORY_PADDING); ++ // size computed in size_t: stride*height can exceed UINT32_MAX for large planes ++ uint8_t* p = static_cast(ALLOC_ALIGNED_16(static_cast(stride) * height + MEMORY_PADDING)); + + if (p==NULL) { return NULL; } + +@@ -82,13 +83,15 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx, + + // copy input data if provided + +- if (inputdata != NULL) { +- if (inputstride == stride) { +- memcpy(p, inputdata, stride*height); ++ if (inputdata != nullptr) { ++ if (inputstride == static_cast(stride)) { ++ memcpy(p, inputdata, static_cast(stride) * height); + } + else { +- for (int y=0;y(y) * stride, ++ static_cast(inputdata) + static_cast(inputstride) * y, ++ inputstride); + } + } + } +@@ -108,30 +111,35 @@ LIBDE265_API void de265_free_image_plane(struct de265_image* img, int cIdx) + static int de265_image_get_buffer(de265_decoder_context* ctx, + de265_image_spec* spec, de265_image* img, void* userdata) + { +- const int rawChromaWidth = spec->width / img->SubWidthC; +- const int rawChromaHeight = spec->height / img->SubHeightC; ++ const uint32_t rawChromaWidth = spec->width / img->SubWidthC; ++ const uint32_t rawChromaHeight = spec->height / img->SubHeightC; + +- int luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment; +- int chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment; ++ uint32_t luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment; ++ uint32_t chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment; + + assert(img->BitDepth_Y >= 8 && img->BitDepth_Y <= 16); + assert(img->BitDepth_C >= 8 && img->BitDepth_C <= 16); + +- int luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8); +- int chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8); ++ uint32_t luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8); ++ uint32_t chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8); + +- int luma_height = spec->height; +- int chroma_height = rawChromaHeight; ++ uint32_t luma_height = spec->height; ++ uint32_t chroma_height = rawChromaHeight; + + bool alloc_failed = false; + +- uint8_t* p[3] = { 0,0,0 }; +- p[0] = (uint8_t *)ALLOC_ALIGNED_16(luma_height * luma_bpl + MEMORY_PADDING); +- if (p[0]==NULL) { alloc_failed=true; } ++ // Compute the plane sizes in size_t. Each operand fits in uint32_t, but the ++ // height * bytes-per-line product can exceed UINT32_MAX for large frames, so ++ // the multiplication must be done in 64 bits. Computing it in 32 bits wraps ++ // the allocation size to a small value while fill_image() later writes the ++ // real (size_t) size -> heap buffer overflow (GHSA-vv8h-932h-7r86). ++ uint8_t* p[3] = { nullptr,nullptr,nullptr }; ++ p[0] = static_cast(ALLOC_ALIGNED_16(static_cast(luma_height) * luma_bpl + MEMORY_PADDING)); ++ if (p[0]==nullptr) { alloc_failed=true; } + + if (img->get_chroma_format() != de265_chroma_mono) { +- p[1] = (uint8_t *)ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING); +- p[2] = (uint8_t *)ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING); ++ p[1] = static_cast(ALLOC_ALIGNED_16(static_cast(chroma_height) * chroma_bpl + MEMORY_PADDING)); ++ p[2] = static_cast(ALLOC_ALIGNED_16(static_cast(chroma_height) * chroma_bpl + MEMORY_PADDING)); + + if (p[1]==NULL || p[2]==NULL) { alloc_failed=true; } + } diff -Nru libde265-1.0.15/debian/patches/CVE-2026-54240_CVE-2026-54241.patch libde265-1.0.15/debian/patches/CVE-2026-54240_CVE-2026-54241.patch --- libde265-1.0.15/debian/patches/CVE-2026-54240_CVE-2026-54241.patch 1970-01-01 00:00:00.000000000 +0000 +++ libde265-1.0.15/debian/patches/CVE-2026-54240_CVE-2026-54241.patch 2026-08-06 05:05:03.000000000 +0000 @@ -0,0 +1,394 @@ +Description: CVE-2026-54240, CVE-2026-54241: fix pixel-accessor integer overflow + The image pixel accessors computed xpos + ypos*stride in signed 32-bit + arithmetic; frames with width*height > INT32_MAX wrap the offset and the + returned pointer lands far outside the buffer (OOB read/write). Widen + stride/offset math to 64 bits and store validated SPS dimensions in + uint16_t. +Origin: upstream, https://github.com/strukturag/libde265/commit/bdca87569b9c63c2a7054d90ae4462dbb78d159a +Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3 +Bug: https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr +Applied-Upstream: 1.1.1 + +diff --git a/libde265/de265.cc b/libde265/de265.cc +index 6ff01918..571ed06b 100644 +--- a/libde265/de265.cc ++++ b/libde265/de265.cc +@@ -672,7 +672,7 @@ LIBDE265_API const uint8_t* de265_get_image_plane(const de265_image* img, int ch + + uint8_t* data = img->pixels_confwin[channel]; + +- if (stride) *stride = img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8); ++ if (stride) *stride = static_cast(img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8)); + + return data; + } +diff --git a/libde265/image-io.cc b/libde265/image-io.cc +index 49837837..c6370bcd 100644 +--- a/libde265/image-io.cc ++++ b/libde265/image-io.cc +@@ -73,7 +73,7 @@ de265_image* ImageSource_YUV::read_next_image() + // --- load image --- + + uint8_t* p; +- int stride; ++ ptrdiff_t stride; + + p = img->get_image_plane(0); stride = img->get_image_stride(0); + for (int y=0;yget_width(); + int height= img->get_height(); +diff --git a/libde265/image.cc b/libde265/image.cc +index 9ddfed2c..9beeb07e 100644 +--- a/libde265/image.cc ++++ b/libde265/image.cc +@@ -183,7 +183,7 @@ de265_image_allocation de265_image::default_image_allocation = { + }; + + +-void de265_image::set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata) ++void de265_image::set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata) + { + pixels[cIdx] = mem; + plane_user_data[cIdx] = userdata; +diff --git a/libde265/image.h b/libde265/image.h +index 0a0c0e32..c514429d 100644 +--- a/libde265/image.h ++++ b/libde265/image.h +@@ -26,6 +26,7 @@ + #endif + + #include ++#include + #include + #include + #include +@@ -254,11 +255,11 @@ struct de265_image { + /* */ uint8_t* get_image_plane(int cIdx) { return pixels[cIdx]; } + const uint8_t* get_image_plane(int cIdx) const { return pixels[cIdx]; } + +- void set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata); ++ void set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata); + + uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos) + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + xpos + ypos*stride; + } + +@@ -267,38 +268,38 @@ struct de265_image { + template + pixel_t* get_image_plane_at_pos_NEW(int cIdx, int xpos,int ypos) + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return (pixel_t*)(pixels[cIdx] + (xpos + ypos*stride)*sizeof(pixel_t)); + } + + const uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos) const + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + xpos + ypos*stride; + } + + void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos) + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]); + } + + const void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos) const + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]); + } + + /* Number of pixels in one row (not number of bytes). + */ +- int get_image_stride(int cIdx) const ++ ptrdiff_t get_image_stride(int cIdx) const + { + if (cIdx==0) return stride; + else return chroma_stride; + } + +- int get_luma_stride() const { return stride; } +- int get_chroma_stride() const { return chroma_stride; } ++ ptrdiff_t get_luma_stride() const { return stride; } ++ ptrdiff_t get_chroma_stride() const { return chroma_stride; } + + int get_width (int cIdx=0) const { return cIdx==0 ? width : chroma_width; } + int get_height(int cIdx=0) const { return cIdx==0 ? height : chroma_height; } +@@ -352,8 +353,8 @@ private: + + int width, height; // size in luma pixels + +- int chroma_width, chroma_height; +- int stride, chroma_stride; ++ int chroma_width = 0, chroma_height = 0; ++ ptrdiff_t stride = 0, chroma_stride = 0; + + public: + uint8_t BitDepth_Y, BitDepth_C; +diff --git a/libde265/intrapred.h b/libde265/intrapred.h +index 5c997908..2b224879 100644 +--- a/libde265/intrapred.h ++++ b/libde265/intrapred.h +@@ -533,7 +533,7 @@ void intra_border_computer::fill_from_image() + assert(nT<=32); + + pixel_t* image; +- int stride; ++ ptrdiff_t stride; + image = (pixel_t*)img->get_image_plane(cIdx); + stride = img->get_image_stride(cIdx); + +diff --git a/libde265/motion.cc b/libde265/motion.cc +index 0ddfaabd..35030064 100644 +--- a/libde265/motion.cc ++++ b/libde265/motion.cc +@@ -50,7 +50,7 @@ void mc_luma(const base_context* ctx, + const seq_parameter_set* sps, int mv_x, int mv_y, + int xP,int yP, + int16_t* out, int out_stride, +- const pixel_t* ref, int ref_stride, ++ const pixel_t* ref, ptrdiff_t ref_stride, + int nPbW, int nPbH, int bitDepth_L) + { + int xFracL = mv_x & 3; +@@ -129,7 +129,7 @@ void mc_luma(const base_context* ctx, + pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+7)]; + + const pixel_t* src_ptr; +- int src_stride; ++ ptrdiff_t src_stride; + + if (-extra_left + xIntOffsL >= 0 && + -extra_top + yIntOffsL >= 0 && +@@ -176,7 +176,7 @@ void mc_chroma(const base_context* ctx, + int mv_x, int mv_y, + int xP,int yP, + int16_t* out, int out_stride, +- const pixel_t* ref, int ref_stride, ++ const pixel_t* ref, ptrdiff_t ref_stride, + int nPbWC, int nPbHC, int bit_depth_C) + { + // chroma sample interpolation process (8.5.3.2.2.2) +@@ -222,7 +222,7 @@ void mc_chroma(const base_context* ctx, + pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+3)]; + + const pixel_t* src_ptr; +- int src_stride; ++ ptrdiff_t src_stride; + + int extra_top = 1; + int extra_left = 1; +diff --git a/libde265/sao.cc b/libde265/sao.cc +index 1b88a102..92125db0 100644 +--- a/libde265/sao.cc ++++ b/libde265/sao.cc +@@ -28,8 +28,8 @@ + template + void apply_sao_internal(de265_image* img, int xCtb,int yCtb, + const slice_segment_header* shdr, int cIdx, int nSW,int nSH, +- const pixel_t* in_img, int in_stride, +- /* */ pixel_t* out_img, int out_stride) ++ const pixel_t* in_img, ptrdiff_t in_stride, ++ /* */ pixel_t* out_img, ptrdiff_t out_stride) + { + const sao_info* saoinfo = img->get_sao_info(xCtb,yCtb); + +@@ -77,7 +77,7 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb, + + if (SaoTypeIdx==2) { + int hPos[2], vPos[2]; +- int vPosStride[2]; // vPos[] multiplied by image stride ++ ptrdiff_t vPosStride[2]; // vPos[] multiplied by image stride + int SaoEoClass = (saoinfo->SaoEoClass >> (2*cIdx)) & 0x3; + + switch (SaoEoClass) { +@@ -277,8 +277,8 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb, + template + void apply_sao(de265_image* img, int xCtb,int yCtb, + const slice_segment_header* shdr, int cIdx, int nSW,int nSH, +- const pixel_t* in_img, int in_stride, +- /* */ pixel_t* out_img, int out_stride) ++ const pixel_t* in_img, ptrdiff_t in_stride, ++ /* */ pixel_t* out_img, ptrdiff_t out_stride) + { + if (img->high_bit_depth(cIdx)) { + apply_sao_internal(img,xCtb,yCtb, shdr,cIdx,nSW,nSH, +@@ -343,8 +343,8 @@ void apply_sample_adaptive_offset_sequential(de265_image* img) + return; + } + +- int lumaImageSize = img->get_image_stride(0) * img->get_height(0) * img->get_bytes_per_pixel(0); +- int chromaImageSize = img->get_image_stride(1) * img->get_height(1) * img->get_bytes_per_pixel(1); ++ size_t lumaImageSize = static_cast(img->get_image_stride(0)) * img->get_height(0) * img->get_bytes_per_pixel(0); ++ size_t chromaImageSize = static_cast(img->get_image_stride(1)) * img->get_height(1) * img->get_bytes_per_pixel(1); + + uint8_t* inputCopy = new uint8_t[ libde265_max(lumaImageSize, chromaImageSize) ]; + if (inputCopy == NULL) { +@@ -358,10 +358,10 @@ void apply_sample_adaptive_offset_sequential(de265_image* img) + + for (int cIdx=0;cIdxget_image_stride(cIdx); ++ ptrdiff_t stride = img->get_image_stride(cIdx); + int height = img->get_height(cIdx); + +- memcpy(inputCopy, img->get_image_plane(cIdx), stride * height * img->get_bytes_per_pixel(cIdx)); ++ memcpy(inputCopy, img->get_image_plane(cIdx), static_cast(stride) * height * img->get_bytes_per_pixel(cIdx)); + + for (int yCtb=0; yCtb(data); ++ ptrdiff_t stride16 = stride / 2; + for (int y=0; y> 8 ) ^ ( y >> 8 ); +@@ -222,7 +225,7 @@ static inline uint16_t crc_process_byte_parallel(uint16_t crc, uint8_t byte) + (t << 12)) & 0xFFFF; + } + +-static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride, int bit_depth) ++static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,ptrdiff_t stride, int bit_depth) + { + raw_hash_data raw_data(w,stride); + +@@ -248,7 +251,7 @@ static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride + } + + +-static void compute_MD5(uint8_t* data,int w,int h,int stride, uint8_t* result, int bit_depth) ++static void compute_MD5(uint8_t* data,int w,int h,ptrdiff_t stride, uint8_t* result, int bit_depth) + { + MD5_CTX md5; + MD5_Init(&md5); +@@ -287,7 +290,8 @@ static de265_error process_sei_decoded_picture_hash(const sei_message* sei, de26 + int nHashes = img->get_sps().chroma_format_idc==0 ? 1 : 3; + for (int i=0;iget_width(i); + h = img->get_height(i); +@@ -339,7 +343,7 @@ static de265_error process_sei_decoded_picture_hash(const sei_message* sei, de26 + + case sei_decoded_picture_hash_type_checksum: + { +- uint32_t chksum = compute_checksum_8bit(data,w,h,stride, img->get_bit_depth(i)); ++ uint32_t chksum = compute_checksum(data,w,h,stride, img->get_bit_depth(i)); + + if (chksum != seihash->checksum[i]) { + /* +diff --git a/libde265/sps.cc b/libde265/sps.cc +index 0652e426..29409fc5 100644 +--- a/libde265/sps.cc ++++ b/libde265/sps.cc +@@ -521,7 +521,7 @@ de265_error seq_parameter_set::compute_derived_values(bool sanitize_values) + PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY); + PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY; + PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY; +- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples; ++ PicSizeInSamplesY = static_cast(pic_width_in_luma_samples) * pic_height_in_luma_samples; + + if (chroma_format_idc==0 || separate_colour_plane_flag) { + CtbWidthC = 0; +@@ -1276,7 +1276,7 @@ de265_error seq_parameter_set::write(error_queue* errqueue, CABAC_encoder& out) + PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY); + PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY; + PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY; +- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples; ++ PicSizeInSamplesY = static_cast(pic_width_in_luma_samples) * pic_height_in_luma_samples; + if (chroma_format_idc==0 || separate_colour_plane_flag) { + CtbWidthC = 0; + CtbHeightC = 0; +diff --git a/libde265/sps.h b/libde265/sps.h +index 9759bae0..18be31b2 100644 +--- a/libde265/sps.h ++++ b/libde265/sps.h +@@ -39,6 +39,13 @@ class error_queue; + #define MAX_PICTURE_WIDTH 65535 + #define MAX_PICTURE_HEIGHT 65535 + ++// pic_width/height_in_luma_samples are stored as uint16_t and PicSizeInSamplesY as uint32_t, ++// so these limits must keep width/height in 16 bits and their product in 32 bits. ++static_assert(MAX_PICTURE_WIDTH <= 0xFFFF, "picture width must fit in uint16_t"); ++static_assert(MAX_PICTURE_HEIGHT <= 0xFFFF, "picture height must fit in uint16_t"); ++static_assert((uint64_t)MAX_PICTURE_WIDTH * MAX_PICTURE_HEIGHT <= 0xFFFFFFFFu, ++ "total luma sample count must fit in uint32_t"); ++ + enum { + CHROMA_MONO = 0, + CHROMA_420 = 1, +@@ -110,10 +117,10 @@ public: + int seq_parameter_set_id; + int chroma_format_idc; + +- char separate_colour_plane_flag; +- int pic_width_in_luma_samples; +- int pic_height_in_luma_samples; +- char conformance_window_flag; ++ bool separate_colour_plane_flag; ++ uint16_t pic_width_in_luma_samples; // <= MAX_PICTURE_WIDTH (validated on parse) ++ uint16_t pic_height_in_luma_samples; // <= MAX_PICTURE_HEIGHT (validated on parse) ++ bool conformance_window_flag; + + int conf_win_left_offset; + int conf_win_right_offset; diff -Nru libde265-1.0.15/debian/patches/series libde265-1.0.15/debian/patches/series --- libde265-1.0.15/debian/patches/series 2023-12-21 08:04:40.000000000 +0000 +++ libde265-1.0.15/debian/patches/series 2026-08-06 05:04:35.000000000 +0000 @@ -4,3 +4,11 @@ use_sps_from_the_image.patch recycle_sps_if_possible.patch fix-private-libs-pc.patch +CVE-2025-61147.patch +CVE-2024-38949_CVE-2024-38950.patch +CVE-2026-45382.patch +CVE-2026-45383.patch +CVE-2026-49337.patch +CVE-2026-49295.patch +CVE-2026-49346.patch +CVE-2026-54240_CVE-2026-54241.patch