mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-27 00:30:20 +00:00
Code Issues Projects Releases Wiki Activity

libde265: patch CVE-2026-49337

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49337

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 07:52:06 +05:30
committed by Anuj Mittal
parent bd09bb41b4
commit c83399f83f
2 changed files with 54 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch
+53
View File
@@ -0,0 +1,53 @@
From 2f0c53241cb9bf2f5acded53c25f1b74db536de7 Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Mon, 25 May 2026 20:29:40 +0200
Subject: [PATCH] free orphaned slice header when no active image unit
(GHSA-g5hj-rf9f-7vxm)
(cherry picked from commit 683cb9fa603e35840642f98765ab95cdb71cadf9)
CVE: CVE-2026-49337
Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libde265/decctx.cc | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/libde265/decctx.cc b/libde265/decctx.cc
index fbb3baa1..5deddc37 100644
--- a/libde265/decctx.cc
+++ b/libde265/decctx.cc
@@ -478,10 +478,6 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na
shdr->entry_point_offset[i] -= skipped;
}
- this->img->add_slice_segment_header(shdr);
-
-
-
// --- start a new image if this is the first slice ---
if (shdr->first_slice_segment_in_pic_flag) {
@@ -495,6 +491,13 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na
if ( ! image_units.empty() ) {
+ // Hand the slice header to the picture (which takes ownership and frees it
+ // on release). Only do this when there is an active image unit to decode
+ // the slice; otherwise the header would be retained on img->slices forever,
+ // which a crafted stream of non-first slice NALs can exploit to grow memory
+ // without bound.
+ this->img->add_slice_segment_header(shdr);
+
slice_unit* sliceunit = new slice_unit(this);
sliceunit->nal = nal;
sliceunit->shdr = shdr;
@@ -507,6 +510,7 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na
}
else {
nal_parser.free_NAL_unit(nal);
+ delete shdr;
}
bool did_work;
meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
+1
View File
@@ -10,6 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f"
SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \
file://CVE-2026-49295.patch \
file://CVE-2026-49337.patch \
"
SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06"