mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-27 00:30:20 +00:00
Code Issues Projects Releases Wiki Activity

libde265: patch CVE-2026-49346

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49346

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 07:52:06 +05:30
committed by Anuj Mittal
parent c83399f83f
commit 4a63a2afa1
2 changed files with 103 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch
+102
View File
@@ -0,0 +1,102 @@
From 1667c33f2778a04f08ba4f7d6c1c16508350a779 Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Tue, 26 May 2026 00:59:08 +0200
Subject: [PATCH] fix integer overflow in image plane allocation size
(GHSA-vv8h-932h-7r86)
(cherry picked from commit 8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8)
CVE: CVE-2026-49346
Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libde265/image.cc | 46 +++++++++++++++++++++++++++-------------------
1 file changed, 27 insertions(+), 19 deletions(-)
diff --git a/libde265/image.cc b/libde265/image.cc
index 0b6071ba..94f3c974 100644
--- a/libde265/image.cc
+++ b/libde265/image.cc
@@ -70,10 +70,11 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx,
void* inputdata, int inputstride, void *userdata)
{
int alignment = STANDARD_ALIGNMENT;
- int stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment;
- int height = img->get_height(cIdx);
+ uint32_t stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment;
+ uint32_t height = img->get_height(cIdx);
- uint8_t* p = static_cast<uint8_t*>(ALLOC_ALIGNED_16(stride * height + MEMORY_PADDING));
+ // size computed in size_t: stride*height can exceed UINT32_MAX for large planes
+ uint8_t* p = static_cast<uint8_t*>(ALLOC_ALIGNED_16(static_cast<size_t>(stride) * height + MEMORY_PADDING));
if (p==nullptr) { return nullptr; }
@@ -82,12 +83,14 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx,
// copy input data if provided
if (inputdata != nullptr) {
- if (inputstride == stride) {
- memcpy(p, inputdata, stride*height);
+ if (inputstride == static_cast<int>(stride)) {
+ memcpy(p, inputdata, static_cast<size_t>(stride) * height);
}
else {
- for (int y=0;y<height;y++) {
- memcpy(p+y*stride, static_cast<char*>(inputdata) + inputstride*y, inputstride);
+ for (uint32_t y=0;y<height;y++) {
+ memcpy(p + static_cast<size_t>(y) * stride,
+ static_cast<char*>(inputdata) + static_cast<size_t>(inputstride) * y,
+ inputstride);
}
}
}
@@ -107,30 +110,35 @@ LIBDE265_API void de265_free_image_plane(struct de265_image* img, int cIdx)
static int de265_image_get_buffer(de265_decoder_context* ctx,
de265_image_spec* spec, de265_image* img, void* userdata)
{
- const int rawChromaWidth = spec->width / img->SubWidthC;
- const int rawChromaHeight = spec->height / img->SubHeightC;
+ const uint32_t rawChromaWidth = spec->width / img->SubWidthC;
+ const uint32_t rawChromaHeight = spec->height / img->SubHeightC;
- int luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment;
- int chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment;
+ uint32_t luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment;
+ uint32_t chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment;
assert(img->BitDepth_Y >= 8 && img->BitDepth_Y <= 16);
assert(img->BitDepth_C >= 8 && img->BitDepth_C <= 16);
- int luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8);
- int chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8);
+ uint32_t luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8);
+ uint32_t chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8);
- int luma_height = spec->height;
- int chroma_height = rawChromaHeight;
+ uint32_t luma_height = spec->height;
+ uint32_t chroma_height = rawChromaHeight;
bool alloc_failed = false;
- uint8_t* p[3] = { 0,0,0 };
- p[0] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(luma_height * luma_bpl + MEMORY_PADDING));
+ // Compute the plane sizes in size_t. Each operand fits in uint32_t, but the
+ // height * bytes-per-line product can exceed UINT32_MAX for large frames, so
+ // the multiplication must be done in 64 bits. Computing it in 32 bits wraps
+ // the allocation size to a small value while fill_image() later writes the
+ // real (size_t) size -> heap buffer overflow (GHSA-vv8h-932h-7r86).
+ uint8_t* p[3] = { nullptr,nullptr,nullptr };
+ p[0] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(static_cast<size_t>(luma_height) * luma_bpl + MEMORY_PADDING));
if (p[0]==nullptr) { alloc_failed=true; }
if (img->get_chroma_format() != de265_chroma_mono) {
- p[1] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING));
- p[2] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING));
+ p[1] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(static_cast<size_t>(chroma_height) * chroma_bpl + MEMORY_PADDING));
+ p[2] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(static_cast<size_t>(chroma_height) * chroma_bpl + MEMORY_PADDING));
if (p[1]==nullptr || p[2]==nullptr) { alloc_failed=true; }
}
meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
+1
View File
@@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f"
SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \
file://CVE-2026-49295.patch \
file://CVE-2026-49337.patch \
file://CVE-2026-49346.patch \
"
SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06"