Ankur Tyagi
2026-04-09 19:09:18 +12:00
committed by Anuj Mittal
parent 7e723ad1c7
commit d17d94e0e0
3 changed files with 1 additions and 84 deletions
@@ -1,39 +0,0 @@
From e31a5389f2a4967b9ca298a3435d1af2f9a04cda Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Fri, 1 Sep 2023 21:18:48 +0200
Subject: [PATCH] fix #418
CVE: CVE-2023-43887
Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/63b596c915977f038eafd7647d1db25488a8c133]
(cherry picked from commit 63b596c915977f038eafd7647d1db25488a8c133)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libde265/decctx.cc | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/libde265/decctx.cc b/libde265/decctx.cc
index 223a6aaf..350f7e7a 100644
--- a/libde265/decctx.cc
+++ b/libde265/decctx.cc
@@ -582,16 +582,17 @@ de265_error decoder_context::read_pps_NAL(bitreader& reader)
std::shared_ptr<pic_parameter_set> new_pps = std::make_shared<pic_parameter_set>();
bool success = new_pps->read(&reader,this);
+ if (!success) {
+ return DE265_WARNING_PPS_HEADER_INVALID;
+ }
if (param_pps_headers_fd>=0) {
new_pps->dump(param_pps_headers_fd);
}
- if (success) {
- pps[ (int)new_pps->pic_parameter_set_id ] = new_pps;
- }
+ pps[ (int)new_pps->pic_parameter_set_id ] = new_pps;
- return success ? DE265_OK : DE265_WARNING_PPS_HEADER_INVALID;
+ return DE265_OK;
}
de265_error decoder_context::read_sei_NAL(bitreader& reader, bool suffix)
@@ -1,42 +0,0 @@
From 78bd5752157f34e822cefd8ff8959a96a26b4841 Mon Sep 17 00:00:00 2001
From: Dirk Farin <dirk.farin@gmail.com>
Date: Sat, 4 Nov 2023 15:20:50 +0100
Subject: [PATCH] null-pointer check in debug output (fixes #426)
CVE: CVE-2023-47471
Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/e36b4a1b0bafa53df47514c419d5be3e8916ebc7]
(cherry picked from commit e36b4a1b0bafa53df47514c419d5be3e8916ebc7)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
libde265/slice.cc | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/libde265/slice.cc b/libde265/slice.cc
index 280b7417..435123dc 100644
--- a/libde265/slice.cc
+++ b/libde265/slice.cc
@@ -1277,14 +1277,23 @@ void slice_segment_header::dump_slice_segment_header(const decoder_context* ctx,
#define LOG3(t,d1,d2,d3) log2fh(fh, t,d1,d2,d3)
#define LOG4(t,d1,d2,d3,d4) log2fh(fh, t,d1,d2,d3,d4)
+ LOG0("----------------- SLICE -----------------\n");
+
const pic_parameter_set* pps = ctx->get_pps(slice_pic_parameter_set_id);
+ if (!pps) {
+ LOG0("invalid PPS referenced\n");
+ return;
+ }
assert(pps->pps_read); // TODO: error handling
const seq_parameter_set* sps = ctx->get_sps((int)pps->seq_parameter_set_id);
+ if (!sps) {
+ LOG0("invalid SPS referenced\n");
+ return;
+ }
assert(sps->sps_read); // TODO: error handling
- LOG0("----------------- SLICE -----------------\n");
LOG1("first_slice_segment_in_pic_flag : %d\n", first_slice_segment_in_pic_flag);
if (ctx->get_nal_unit_type() >= NAL_UNIT_BLA_W_LP &&
ctx->get_nal_unit_type() <= NAL_UNIT_RESERVED_IRAP_VCL23) {
@@ -9,11 +9,9 @@ LICENSE_FLAGS = "commercial"
LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f"
SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https \
file://CVE-2023-43887.patch \
file://CVE-2023-47471.patch \
file://CVE-2025-61147.patch \
"
SRCREV = "a267c84707ab264928fa9b86de2ee749c48c318c"
SRCREV = "7ba65889d3d6d8a0d99b5360b028243ba843be3a"
S = "${WORKDIR}/git"