Debian Patches

Status for libde265/1.0.11-1+deb12u3

Patch Description Author Forwarded Bugs Origin Last update
CVE-2026-49346.patch CVE-2026-49346: fix integer overflow in image plane allocation size Large SPS dimensions with 16-bit bit depth overflow the 32-bit allocation
size in de265_image_get_buffer(); the wrapped ~1 KB allocation is later
written with the full plane size, corrupting the heap.

diff --git a/libde265/image.cc b/libde265/image.cc
index 0ae77511..9ddfed2c 100644		 yes debian upstream upstream, https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8
only_export_decoder_api.patch Only export symbols defined in the decoder API. The encoder API is not final yet, so upstream exports all symbols to make
development easier. For packaging we only want to expose the public API.		 Joachim Bauch <bauch@struktur.de> no
disable_tools.patch Disable building of some internal tools that no longer link because internal symbols are no longer exported. Joachim Bauch <bauch@struktur.de> no
CVE-2026-54240_CVE-2026-54241.patch CVE-2026-54240, CVE-2026-54241: fix pixel-accessor integer overflow The image pixel accessors computed xpos + ypos*stride in signed 32-bit
arithmetic; frames with width*height > INT32_MAX wrap the offset and the
returned pointer lands far outside the buffer (OOB read/write). Widen
stride/offset math to 64 bits and store validated SPS dimensions in
uint16_t.

diff --git a/libde265/de265.cc b/libde265/de265.cc
index 6ff01918..571ed06b 100644		 yes upstream upstream, https://github.com/strukturag/libde265/commit/bdca87569b9c63c2a7054d90ae4462dbb78d159a
TEMP-0000000-BB5891.patch Fix WPP CABAC context handoff race (GHSA-xp3h-6f5r-8cxp)
In WPP-threaded decoding, each CTB row task hands its saved CABAC
context (imgunit->ctx_models[row]) to the row below through
context_model_table, a hand-rolled refcounted handle whose model and
refcnt pointers are mutated together by copy, assignment, release(),
and decouple(). The producer/consumer handoff relied on
wait_for_progress()/set_progress() to order the accesses, but that
lock's fast path read a plain non-atomic int with no acquire/release
barrier, so writes to a row slot were not reliably published across
threads. Under a crafted stream this let two tasks touch the same
slot's ownership metadata concurrently, corrupting it and causing
heap-use-after-free / double-free (confirmed via AddressSanitizer,
reproducing the double-free in context_model_table::release() at
the exact reported sites).

Add a mutex to image_unit guarding the whole copy/release (consumer)
and assign/decouple (producer) sequence for a row slot, so ownership
transitions are mutually exclusive. Also make de265_progress_lock's
progress counter atomic with acquire/release ordering, closing the
underlying missing-barrier gap that the same fast path exposes to
every other wait_for_progress() consumer (deblocking, SAO, motion
readiness).

few hundred fuzzer iterations; the fixed build stayed clean across
thousands of iterations of the same reproducers. Decode output is
unchanged (girlshy.h265 hash matches single- and multi-threaded).		 Dirk Farin <dirk.farin@gmail.com> yes upstream https://github.com/strukturag/libde265/commit/eb346780796055d9f9aac62d725d3170aa60c7b4 2026-09-02
reject_reference_pics_from_different_sps.patch Try to mitigate asan failures.
See #345 for my analysis and details…

(This PR is just for discussion.)

(The CVE references are obtained from the Debian security tracker,
which links the issues.)

This makes the following POCs stop failing:

- poc3 (#337)
- poc7-1 (#341) CVE-2022-43239 (note: does NOT fix poc7-2)
- poc8-2, poc8-3, poc8-4 (#342) CVE-2022-43244 (note: does NOT fix poc8-1)
- poc11-1, poc11-2 (#345) CVE-2022-43249
- poc12 (#346)
- poc13 (#347) CVE-2022-43252
- poc16 (#350)		 Tobias Frost <tobi@debian.org> no https://github.com/strukturag/libde265/pull/365 2022-12-12
use_sps_from_the_image.patch Use the sps from the image
(as e.g mc_chroma is using the sps to determine
picture properties, like pic_width_in_luma_samples
and pic_height_in_luma_samples, I *think* this is
more correct.

This PR is for discussion. (See #345.)
It makes the failures go away, but that does not mean it's correct :)

The following poc will be stop failing if (only) this
patch is applied:

- poc2 #336 - CVE-2022-43238
- poc4 #338 - CVE-2022-43241
- poc6-1, poc6-2 #340 - CVE-2022-43242
- poc7-1, poc7-2 #341 - CVE-2022-43239
- poc8-1 #342 - CVE-2022-43244
- poc9-3 #343 - CVE-2022-43236
- poc10-2, poc10-3 #344 - CVE-2022-43237
- poc16 #350
- poc19 #353

The following are still failing if only this patch is
applied, but they stop failing if #365 is applied as well, but will
still fail with ONLY #365 applied (IOW, both are needed)

- poc1 #335 - CVE-2022-43240
- poc3 #337 - CVE-2022-43235
- poc5 #339 - CVE-2022-43423
- poc9-1,poc9-2, poc9-4 #343 - CVE-2022-43236
- poc14 #348 - CVE-2022-43253
- poc15 #349 - CVE-2022-43248
- poc17-1, poc17-2 #351
- poc18 #352 - CVE-2022-43245		 Tobias Frost <tobi@debian.org> no https://github.com/strukturag/libde265/pull/366 2022-12-12
recycle_sps_if_possible.patch Don't update sps if they are only repeated
This is an attempt to improve the mitigations from #365 and #366 and picks up an idea I described at #345:

> One way would be just to look at the pointers of the SPS (fast and easy, but
> may reject more than required), or investigate if the SPS used for the image
> generations are "compatible".

This changes do exactly this: It (very conservativly) checks if the old and new sps have
identical information -- except the reference picture set, which I believe is supposed
to be updated by new sps'). If they are basically identical, the old sps will be
used instead of the new one, (of course, reference image set is updated from the new one)

I'm using standalone operator== and helper functions to avoid changing ABI of the library;
if an ABI bump would be done, of course this should go to the respective classes.		 Tobias Frost <tobi@debian.org> no https://github.com/strukturag/libde265/pull/372 2023-01-13
CVE-2023-27102.patch commit 0b1752abff97cb542941d317a0d18aa50cb199b1

check whether referenced PPS exists (fixes #393)

===================================================================		 Dirk Farin <dirk.farin@gmail.com> no 2023-03-04
CVE-2023-27103.patch commit d6bf73e765b7a23627bfd7a8645c143fd9097995

check for valid slice header index access (fixes #394)

===================================================================		 Dirk Farin <dirk.farin@gmail.com> no 2023-03-04
CVE-2023-43887.patch commit 63b596c915977f038eafd7647d1db25488a8c133

fix #418

===================================================================		 Dirk Farin <dirk.farin@gmail.com> no 2023-09-01
CVE-2023-47471.patch commit e36b4a1b0bafa53df47514c419d5be3e8916ebc7

null-pointer check in debug output (fixes #426)

diff --git a/libde265/slice.cc b/libde265/slice.cc
index 280b7417..435123dc 100644		 Dirk Farin <dirk.farin@gmail.com> no 2023-11-04
CVE-2023-49465.patch commit 1475c7d2f0a6dc35c27e18abc4db9679bfd32568

possible fix for #435

===================================================================		 Dirk Farin <dirk.farin@gmail.com> no 2023-11-23
CVE-2023-49467.patch commit 7e4faf254bbd2e52b0f216cb987573a2cce97b54

prevent endless loop for #434 input

diff --git a/libde265/slice.cc b/libde265/slice.cc
index 435123dc..3a8a8de1 100644		 Dirk Farin <dirk.farin@gmail.com> no 2023-11-23
CVE-2023-49468.patch commit 3e822a3ccf88df1380b165d6ce5a00494a27ceeb

fix #432 (undefined IPM)

diff --git a/libde265/image.h b/libde265/image.h
index 0b536054..0a0c0e32 100644		 Dirk Farin <dirk.farin@gmail.com> no 2023-11-23
CVE-2023-51792.patch check validity of conformance window parameters (fixes #427)
(cherry picked from commit 221e767136b8c46c748ae35b79ec9b976b3da301)		 Dirk Farin <dirk.farin@gmail.com> no https://github.com/strukturag/libde265/commit/221e767136b8c46c748ae35b79ec9b976b3da301 2023-11-04
TEMP-0000000-E66AA0.patch Fix heap-use-after-free in decoder_context::reset() (GHSA-mm7m-v26f-wf8x)

decoder_context::reset() calls dpb.clear() which frees all de265_image objects
and their owned slice_segment_header structs. However, reset() never nulls the
previous_slice_header pointer, leaving a dangling reference into freed memory.

When the next NAL unit after reset() is a dependent slice, slice_segment_header::read()
at slice.cc:435 executes:
*this = *ctx->previous_slice_header;

This copies from freed 1464-byte struct — heap-use-after-free (CWE-416).

The in-stream case was already guarded by commit 12ba88ec (decctx.cc:556 nulls
previous_slice_header on first slice of new picture). This fix applies the same
invariant to the reset() path: only a slice header still retained by a live image
may remain as previous_slice_header.		 Dirk Farin <dirk.farin@gmail.com> yes upstream https://github.com/strukturag/libde265/commit/07bc500d45f781a7e2915afb7eebc2d6d9a541c9 2026-09-02
CVE-2026-33164+33165.patch fix reallocation of metadata array when ctb size changes (thanks to Ana K.)

(cherry picked from commit c7891e412106130b83f8e8ea8b7f907e9449b658)		 Dirk Farin <dirk.farin@gmail.com> yes debian upstream https://github.com/strukturag/libde265/commit/c7891e412106130b83f8e8ea8b7f907e9449b658 2026-03-15
CVE-2024-38949+CVE-2024-38950.patch dec265: fix SDL OOB on 4:4:4 streams and mid-stream resolution change (closes #460) Dirk Farin <dirk.farin@gmail.com> yes debian upstream https://github.com/strukturag/libde265/commit/4089de0845e0009e019be4ca5cbebaf2aee0a8ce 2026-05-10
CVE-2026-45382.patch fix CTB OOB access when pps.sps mismatches active sps (GHSA-hwhx-x2mq-ccr9) Dirk Farin <dirk.farin@gmail.com> yes upstream https://github.com/strukturag/libde265/commit/c33b4f63ae9056b00f34a31874fed55cd0aa29c9 2026-05-10
CVE-2026-45383.patch CVE-2026-45383: prevent reading past end of CtbAddrRStoTS[] in WPP images In the WPP slice decoder ctbAddrRS = ctbRow * ctbsWidth can exceed the
allocated vector size, causing out-of-bounds reads.

diff --git a/libde265/decctx.cc b/libde265/decctx.cc
index ea2e2136..ed8709d8 100644		 yes upstream upstream, https://github.com/strukturag/libde265/commit/d1a2c3b4b751d21f44e8e82220fe9766c9d116ff
CVE-2026-49295.patch CVE-2026-49295: bound aggregate short-term RPS size Missing aggregate bound check on predicted reference picture set entries
allows exceeding the 16-entry array, an out-of-bounds array write in
process_reference_picture_set().

diff --git a/libde265/refpic.cc b/libde265/refpic.cc
index 77cc719e..ab7de2a6 100644		 yes debian upstream upstream, https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652b
CVE-2026-49337.patch CVE-2026-49337: free orphaned slice header when no active image unit Slice headers attached to finished pictures without an active image unit
were retained forever; a crafted NAL sequence can grow memory without
bound during continuous streaming.

diff --git a/libde265/decctx.cc b/libde265/decctx.cc
index ed8709d8..8383dd2b 100644		 yes debian upstream upstream, https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9

All known versions for source package 'libde265'

Links