mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-26 12:20:25 +00:00
Code Issues Projects Releases Wiki Activity

libde265: patch CVE-2026-49295

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49295

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 07:52:05 +05:30
committed by Anuj Mittal
parent 53bb41bcf0
commit bd09bb41b4
2 changed files with 44 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch
+41
View File
@@ -0,0 +1,41 @@
From 7d5e48dbf9324691ba3ce4cd8ffa089d735b0b70 Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Mon, 25 May 2026 20:14:07 +0200
Subject: [PATCH] bound aggregate short-term RPS size (GHSA-g2rg-wj66-w594)
(cherry picked from commit 691f3a3c55b3d32478c4a49895dee061a282652b)
CVE: CVE-2026-49295
Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libde265/refpic.cc | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/libde265/refpic.cc b/libde265/refpic.cc
index ea4db4b0..dcd2b214 100644
--- a/libde265/refpic.cc
+++ b/libde265/refpic.cc
@@ -322,6 +322,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue,
out_set->compute_derived_values();
+ // The unused short-term references are all collected into a single PocStFoll array
+ // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set).
+ // While each individual list is bounded above, the predicted-RPS construction can
+ // append the current-picture delta to an already-full source set, pushing the
+ // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds
+ // write when filling PocStFoll.
+ if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) {
+ out_set->NumNegativePics = 0;
+ out_set->NumPositivePics = 0;
+ out_set->NumDeltaPocs = 0;
+ out_set->NumPocTotalCurr_shortterm_only = 0;
+
+ errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false);
+ return false;
+ }
+
return true;
}
meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
+3 -1
View File
@@ -8,7 +8,9 @@ LICENSE = "LGPL-3.0-only & MIT"
LICENSE_FLAGS = "commercial"
LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f"
SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV}"
SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \
file://CVE-2026-49295.patch \
"
SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06"