Version in base suite: 1.15.0-2.1 Base version: libvpx_1.15.0-2.1 Target version: libvpx_1.15.0-2.1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/libv/libvpx/libvpx_1.15.0-2.1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/libv/libvpx/libvpx_1.15.0-2.1+deb13u1.dsc changelog | 6 +++ patches/CVE-2026-2447.patch | 84 ++++++++++++++++++++++++++++++++++++++++++++ patches/series | 1 3 files changed, 91 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp_i4zefx5/libvpx_1.15.0-2.1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp_i4zefx5/libvpx_1.15.0-2.1+deb13u1.dsc: no acceptable signature found diff -Nru libvpx-1.15.0/debian/changelog libvpx-1.15.0/debian/changelog --- libvpx-1.15.0/debian/changelog 2025-05-27 21:00:58.000000000 +0000 +++ libvpx-1.15.0/debian/changelog 2026-02-17 09:05:13.000000000 +0000 @@ -1,3 +1,9 @@ +libvpx (1.15.0-2.1+deb13u1) trixie-security; urgency=medium + + * CVE-2026-2447 (aka CVE-2026-1861) + + -- Moritz Mühlenhoff Tue, 17 Feb 2026 10:05:13 +0100 + libvpx (1.15.0-2.1) unstable; urgency=medium * Non-maintainer upload. diff -Nru libvpx-1.15.0/debian/patches/CVE-2026-2447.patch libvpx-1.15.0/debian/patches/CVE-2026-2447.patch --- libvpx-1.15.0/debian/patches/CVE-2026-2447.patch 1970-01-01 00:00:00.000000000 +0000 +++ libvpx-1.15.0/debian/patches/CVE-2026-2447.patch 2026-02-17 09:05:09.000000000 +0000 @@ -0,0 +1,84 @@ +commit d5f35ac8d93cba7f7a3f7ddb8f9dc8bd28f785e1 +Author: Wan-Teh Chang +Date: Wed Jan 21 18:03:55 2026 -0800 + + write_superframe_index: return 0 if buffer is full + + write_superframe_index() should return the number of bytes written to + ctx->pending_cx_data. If ctx->pending_cx_data is full, + write_superframe_index() doesn't write the optional superframe index, so + it should return 0 in this case. Add an assertion that would have + detected this bug. Add and clarify comments for code related to this + bug. + + Also fix the buffer full check. The check should not assume that + ctx->pending_cx_data is equal to ctx->cx_data, and the check had an + off-by-one error. + + The bug was introduced when write_superframe_index() was added in the + following CLs: + https://chromium-review.googlesource.com/c/webm/libvpx/+/44659 + https://chromium-review.googlesource.com/c/webm/libvpx/+/45268 + + Bug: oss-fuzz:476466137 + Change-Id: Ie113568cf25acc73f8af640a3c51cfdb5b900613 + +--- libvpx-1.15.0.orig/vp9/vp9_cx_iface.c ++++ libvpx-1.15.0/vp9/vp9_cx_iface.c +@@ -8,7 +8,9 @@ + * be found in the AUTHORS file in the root of the source tree. + */ + ++#include + #include ++#include + #include + #include + #include +@@ -121,6 +123,7 @@ struct vpx_codec_alg_priv { + VP9_COMP *cpi; + unsigned char *cx_data; + size_t cx_data_sz; ++ // pending_cx_data either is a null pointer or points into the cx_data buffer. + unsigned char *pending_cx_data; + size_t pending_cx_data_sz; + int pending_frame_count; +@@ -1251,8 +1254,12 @@ static int write_superframe_index(vpx_co + + // Write the index + index_sz = 2 + (mag + 1) * ctx->pending_frame_count; +- if (ctx->pending_cx_data_sz + index_sz < ctx->cx_data_sz) { +- uint8_t *x = ctx->pending_cx_data + ctx->pending_cx_data_sz; ++ unsigned char *cx_data_end = ctx->cx_data + ctx->cx_data_sz; ++ unsigned char *pending_cx_data_end = ++ ctx->pending_cx_data + ctx->pending_cx_data_sz; ++ ptrdiff_t space_remaining = cx_data_end - pending_cx_data_end; ++ if (index_sz <= space_remaining) { ++ uint8_t *x = pending_cx_data_end; + int i, j; + #ifdef TEST_SUPPLEMENTAL_SUPERFRAME_DATA + uint8_t marker_test = 0xc0; +@@ -1283,6 +1290,8 @@ static int write_superframe_index(vpx_co + #ifdef TEST_SUPPLEMENTAL_SUPERFRAME_DATA + index_sz += index_sz_test; + #endif ++ } else { ++ index_sz = 0; + } + return index_sz; + } +@@ -1602,9 +1611,12 @@ static vpx_codec_err_t encoder_encode(vp + ctx->pending_frame_sizes[ctx->pending_frame_count++] = size; + ctx->pending_frame_magnitude |= size; + ctx->pending_cx_data_sz += size; +- // write the superframe only for the case when +- if (!ctx->output_cx_pkt_cb.output_cx_pkt) ++ // write the superframe only for the case when the callback function ++ // for getting per-layer packets is not registered. ++ if (!ctx->output_cx_pkt_cb.output_cx_pkt) { + size += write_superframe_index(ctx); ++ assert(size <= cx_data_sz); ++ } + pkt.data.frame.buf = ctx->pending_cx_data; + pkt.data.frame.sz = ctx->pending_cx_data_sz; + ctx->pending_cx_data = NULL; diff -Nru libvpx-1.15.0/debian/patches/series libvpx-1.15.0/debian/patches/series --- libvpx-1.15.0/debian/patches/series 2025-05-27 21:00:58.000000000 +0000 +++ libvpx-1.15.0/debian/patches/series 2026-02-17 09:04:57.000000000 +0000 @@ -1,3 +1,4 @@ 0001-Relax-ABI-check.patch 0002-Do-not-undefine-_FORTIFY_SOURCE.patch vpx_codec_enc_init_multi-fix-double-free-on-init-fai.patch +CVE-2026-2447.patch