From patchwork Mon Oct 12 08:53:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100420 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7AFBECA9ED1 for ; Mon, 12 Oct 2026 08:53:53 +0000 (UTC) Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9074.1791795225904016797 for ; Mon, 12 Oct 2026 01:53:45 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=gMVjBRbN; spf=pass (domain: gmail.com, ip: 209.85.214.176, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2e8da6ef7ddso2992385ad.3 for ; Mon, 12 Oct 2026 01:53:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791795225; x=1792400025; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=4x/C/dWGcatHe42E5jutBB/abcUKIjeNHiMFKqhs2V8=; b=gMVjBRbNbfSY+SsuwpMdfrN21PbIzEH205DcUOeM8EZwrUQ1V5NaljmwNxnw94236p YHjICYcBxyFnXLsFQkl+yBuDCIwvuwW6w2UrD04Dp3IpZYrEiiabVeiW+Z8YsWDBWnu8 GpUXYvThHxqoRgaK2X4mOEhGYt1EbxI7IddfzZkBPDuH3nzuG4uE5X4uDP1D8pYgWEyA H3qQbyBM/qpmpu0hdunCpgSo0V19mLwTZeCFW3/2ofnJ/+f8V4dfeCd7fexFzJ3hB6Q9 lg/TF2p8fXuP888iLQER2MVL9JJEMtK9Z1B9QWnNVZyXs4pYThNO7CPF80LFwvo9B60f sKCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791795225; x=1792400025; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=4x/C/dWGcatHe42E5jutBB/abcUKIjeNHiMFKqhs2V8=; b=HrVdz0d6IpCrBlmyv2YR5065edqoxuviFxNwcwouU/CwagqreB//uFxLn4lEUhlW+D 9gTufh2oKvvoLV0YxGgwSEh4ZLxaE+3trDv8IXn7HqsnrRnPH8QbJivxWcT0Jlcq8W0C KE4lpwMnduVlIfve/N6yF2+UBRWHjYOK2McgBfRLZF+c2S2t/Mr9CnU39QltWbRcZOz8 +9vYh6O65o+JuGlwZDBOO9VX7vpUMWm6C610bibW9tqrXGz2UCa85qYKNCyxLWSVBFvs /gpMue6CzheQWmAS07PPVvPS7/6UJ/5GAUgxInj8BPx5mAVnF4sBgtnETKmMJPBhRdv9 BXSw== X-Gm-Message-State: AFq9FYIs5rtfHeGs1UW4yKH0nC2rblBBsQYcHtPqAteSAMc//V+PBp9E ySNUjwtkXkV/Mew061Ur29IZE1w/vBhQ+P6YLckvqcUNyagPjNDykHSBdHs5uK4Kdkk= X-Gm-Gg: AYBFou3WLQ1ca/axu0Nw1T3PlEsNylWxxJS7+ibViZqUCnEMiJx4S7gPFC9fKxAd/oy 1c9+4EOCHv2l3AhKWhqsPnYH4GtBcZpgiXyrK43pKat3lpswXHCV2YL5y41klKWkyoaMDnsbPfr 5er7EQ13DIAfF+vN2/cNBl47lnmzI5FfDKPhxspIX6+f00LmRRL/D7JDfH3EanbPMzmmLLPk+LC 0izqaEF2aAp/AHZNvoP67+enWP5jpRJ2lXukJ87kSMM22kA+iBoP9TNWvlK43n8sKtBDiBnmi44 CwZYXo4W5wg3VNZuVAoreegH7f6znqRMoj8hfpu47BTCv3cJso1YISbfTMQh/vPzU0O8dXsz4se e/co61C7Xu25hsk6PZW+vH4JiA4+NrfzSKgjNmKNwBVJf9/G0ep8HC8KApXLtVVbj7AiBoa6m4T F46LZa3nYHubDsPrT1t/HSHgJCXWJS55xeFiSoE09wad162AaXn79o1xhBoHeD7hfU9eJkBL9wo Tc/Gl2QtJHzjSwmiVaTv8GmDs9BuccxW7B/X4w= X-Received: by 2002:a17:903:1a8f:b0:2e2:d39f:182f with SMTP id d9443c01a7336-2e842bc7f46mr75971405ad.28.1791795225059; Mon, 12 Oct 2026 01:53:45 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e8acfa3b6csm14943335ad.41.2026.10.12.01.53.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 01:53:44 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-multimedia][PATCH v2 1/4] libde265: patch CVE-2026-49295 Date: Mon, 12 Oct 2026 21:53:34 +1300 Message-ID: <20261012085337.2879365-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 08:53:53 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130755 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-49295 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit bd09bb41b41ee12aeb181bf04e5f5961b00123ef) Signed-off-by: Ankur Tyagi --- .../libde265/libde265/CVE-2026-49295.patch | 41 +++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 4 +- 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch new file mode 100644 index 00000000000..189d330b9a5 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch @@ -0,0 +1,41 @@ +From 7d5e48dbf9324691ba3ce4cd8ffa089d735b0b70 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Mon, 25 May 2026 20:14:07 +0200 +Subject: [PATCH] bound aggregate short-term RPS size (GHSA-g2rg-wj66-w594) + +(cherry picked from commit 691f3a3c55b3d32478c4a49895dee061a282652b) + +CVE: CVE-2026-49295 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652] +Signed-off-by: Ankur Tyagi +--- + libde265/refpic.cc | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/libde265/refpic.cc b/libde265/refpic.cc +index ea4db4b0..dcd2b214 100644 +--- a/libde265/refpic.cc ++++ b/libde265/refpic.cc +@@ -322,6 +322,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue, + + out_set->compute_derived_values(); + ++ // The unused short-term references are all collected into a single PocStFoll array ++ // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set). ++ // While each individual list is bounded above, the predicted-RPS construction can ++ // append the current-picture delta to an already-full source set, pushing the ++ // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds ++ // write when filling PocStFoll. ++ if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) { ++ out_set->NumNegativePics = 0; ++ out_set->NumPositivePics = 0; ++ out_set->NumDeltaPocs = 0; ++ out_set->NumPocTotalCurr_shortterm_only = 0; ++ ++ errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false); ++ return false; ++ } ++ + return true; + } + diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index ca05e9099e5..6bed3250fa5 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -8,7 +8,9 @@ LICENSE = "LGPL-3.0-only AND MIT" LICENSE_FLAGS = "commercial" LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f" -SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV}" +SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \ + file://CVE-2026-49295.patch \ +" SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Mon Oct 12 08:53:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100419 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95A73CA9ED0 for ; Mon, 12 Oct 2026 08:53:53 +0000 (UTC) Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9075.1791795228304841164 for ; Mon, 12 Oct 2026 01:53:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Hs1TTrUo; spf=pass (domain: gmail.com, ip: 209.85.214.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2e61ac64ec3so15228465ad.2 for ; Mon, 12 Oct 2026 01:53:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791795228; x=1792400028; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=CPtpAxsWgHCGclwUU4Kex2f7e/VVpeiiVhkw7dMAbMg=; b=Hs1TTrUoD2vQ7yG3IaADmMTdx5CCXMpMrA4T6QeDjOsDC3Lo27ygxFifP6vXPHLPH2 ESYgYZQ/UyhZdsByQU2gQvbYmsNzFqvLOpMmKUqqy5oIxHXEU2C/7atysSqDP7R12rmD 5gkCQ4ItccEAkIUAO5YI3S/P4JX8QeyouBCn7nJaYKyUkWFe9uJO4jmPs46L5Z1QpNtd rel9g+knAEPJEKw8vRSuJlmIwesyAaAw1vnuDpxhXWlpZPRu9jOp10B3V70mD5TdYYmV Ae7wLgvlrEKz5aqvUOgAE1+PWBaJicUZ7UOxquYPGb9RDZEsvF5JtPgH5oeIna53YAFm dSJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791795228; x=1792400028; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=CPtpAxsWgHCGclwUU4Kex2f7e/VVpeiiVhkw7dMAbMg=; b=12XO+WEIKMKz1jkLTeE+8dZsDDFOLs7dvCc6PIwlfMv8zMKQKnv75jK4GGlaI6W1gY ofwqjCq2YwISP/OagGKvFJ11Dcw9M6/ectFW4Hl2pqIPcTFVkFfcOErKHpkss1gGiX3w Pd8fvz+U0N+1VrzR8oLQ53yG/XkM5P0taOnG3Z2Yfy/PTTqukRp4MBKYL2d6rJ2pqCGC 3IVsgNVgNNDDEe6OGKYltdhcY98htmWY7IsUnB6dOywWsgafyFOkRkiAm4DNZwxq9Drd syhO0jJhorGBTsUxsGUgWq9tVD8Qk9W9lyZRlqRkjih44TUa+XW2vmKCM8PsOvH3wpzl O2uQ== X-Gm-Message-State: AFq9FYJlv1epNFgg0AD4WyXRh32+3KaLIZcEAAS90d42ffO/v2FiLhvk xCcdgropPLtV0/oF2qzbjF/U8qV57UqbgoPNIr39/2rf7G0ctYSXxrMo+ihW5HZk4uc= X-Gm-Gg: AYBFou1jJe/ORqpZatYoOVvLZ2Zm5hDt+c0Wllcp1ydZHMKgQ/NaAG32JgYtUinexLh xFIA0Se3SsRKwi5IR1bmJWiBrBsTqVyzPssuI7jIQB1uVsiWFG6zhBlFfe9tjGF/70/bVQfnzJG cHNkbVWLONikUDp575vZfX7WuJKwtR54Yl/Lky8PAIkR5vmCg3Jd7OQqDgWk2Z51qU/BYwzm4kb FuOJKnFMOFOOvFW2CgNkP7riOwdwlp5CWvUQXTxFzt+J0BjVKDtBCNghSPY+z/nG1siFoY34Gfk Rnzpz852IyrO0ydW/srzEO28YH5fHB8rxYvh0i19TLVilYbnOQNUbPbYcei5UFmcyOYlfShGnqU +d9nH14jpKYFH9zpilOV8ijk+8g2mCSMacloAkjujDU1V3ptJpKr0b2sToBZnUrcGCgql/9TChD 61N/rPhZPpmvjK7o+8h4z22UynTc1QwKY9Zt0fRDyrWOIpueL4uy32Qb7ia6UB0FNNYrZ1cFuA4 tc0FFte/BNjyaEugwIUIoe2MLfLJgtmvdmcJnM= X-Received: by 2002:a17:903:2282:b0:2df:8d6c:bb7c with SMTP id d9443c01a7336-2e842aa7eccmr72669985ad.20.1791795227637; Mon, 12 Oct 2026 01:53:47 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e8acfa3b6csm14943335ad.41.2026.10.12.01.53.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 01:53:47 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-multimedia][PATCH v2 2/4] libde265: patch CVE-2026-49337 Date: Mon, 12 Oct 2026 21:53:35 +1300 Message-ID: <20261012085337.2879365-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012085337.2879365-1-ankur.tyagi85@gmail.com> References: <20261012085337.2879365-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 08:53:53 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130756 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-49337 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit c83399f83fbbbb855c5a272c9702e8aff4328ce4) Signed-off-by: Ankur Tyagi --- .../libde265/libde265/CVE-2026-49337.patch | 53 +++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch new file mode 100644 index 00000000000..88e0e329491 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch @@ -0,0 +1,53 @@ +From 2f0c53241cb9bf2f5acded53c25f1b74db536de7 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Mon, 25 May 2026 20:29:40 +0200 +Subject: [PATCH] free orphaned slice header when no active image unit + (GHSA-g5hj-rf9f-7vxm) + +(cherry picked from commit 683cb9fa603e35840642f98765ab95cdb71cadf9) + +CVE: CVE-2026-49337 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9] + +Signed-off-by: Ankur Tyagi +--- + libde265/decctx.cc | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/libde265/decctx.cc b/libde265/decctx.cc +index fbb3baa1..5deddc37 100644 +--- a/libde265/decctx.cc ++++ b/libde265/decctx.cc +@@ -478,10 +478,6 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + shdr->entry_point_offset[i] -= skipped; + } + +- this->img->add_slice_segment_header(shdr); +- +- +- + // --- start a new image if this is the first slice --- + + if (shdr->first_slice_segment_in_pic_flag) { +@@ -495,6 +491,13 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + + if ( ! image_units.empty() ) { + ++ // Hand the slice header to the picture (which takes ownership and frees it ++ // on release). Only do this when there is an active image unit to decode ++ // the slice; otherwise the header would be retained on img->slices forever, ++ // which a crafted stream of non-first slice NALs can exploit to grow memory ++ // without bound. ++ this->img->add_slice_segment_header(shdr); ++ + slice_unit* sliceunit = new slice_unit(this); + sliceunit->nal = nal; + sliceunit->shdr = shdr; +@@ -507,6 +510,7 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + } + else { + nal_parser.free_NAL_unit(nal); ++ delete shdr; + } + + bool did_work; diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index 6bed3250fa5..5fcf6411131 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -10,6 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f" SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \ file://CVE-2026-49295.patch \ + file://CVE-2026-49337.patch \ " SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Mon Oct 12 08:53:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100421 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 563DBCA9ED1 for ; Mon, 12 Oct 2026 08:54:03 +0000 (UTC) Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9159.1791795230907235676 for ; Mon, 12 Oct 2026 01:53:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Eg4+RMMI; spf=pass (domain: gmail.com, ip: 209.85.214.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2df982e04c1so8505435ad.2 for ; Mon, 12 Oct 2026 01:53:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791795230; x=1792400030; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=6QiV0nfZtc98gxzDTeDh7ZHrHNNpjxQXVoYPbjSwhmo=; b=Eg4+RMMI3Lnfxe4mz2/KmuQCnyBsqsOidSsUE/wdeLwA9r+CI+vCBlM3qXiquiPRc6 XSkF3XyX/Ltxr8rQZIlG6FQeYt6EUcYH8U9C3a6ASy5dqbzw4FFCNOsnrQNnRf2VdIYO +WGhDN3AmZ5LElwSj+9h56j/33GlCDQZsnI1CKf1yOFTWxbcAY/nQHevar1vyJo/8jDP /LGiQAcg/QFxfP+oyAds/6Tx87wLpmsr8iYJhePDs4pOTt3DXCiR/7zdcme9wHITpok8 UYLwKV/hgwE/oIDKCyQncAgBsXwj48/dahb/kO8o9kabUNo+EOPWLChOcPl4EaWpieHv 50GA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791795230; x=1792400030; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=6QiV0nfZtc98gxzDTeDh7ZHrHNNpjxQXVoYPbjSwhmo=; b=D1MKG5AR25UXqZD3OyAljf9whICfnThTFf6kMidbfs5U28Me1hTtqDd9hw/uw47Pk7 eujS1kv0qXkpv7UgDK5g7+5VVv1M1r1A36GIdGPGtKTK3kInI4YQggpdA5E50UagU8M4 kmXZOU1MR8xwmi65JmuiR9u6hdsLKysw328HlYpLe7gnh7l1T/7APRuxKJTiakW+W3J5 G9dga5uKSqLnHXGvX8U/TavBpfqIwmK5kkjZRzMDIYoJhxkzujAsxi7JZ3vToi8sRmTC VOALLTNjggqnYZPDN8uSBwE5iBuv1Ct5lYsCTmFY4HrYpzOCaHtAUzCAJHTND3lDzaRM zFjA== X-Gm-Message-State: AFq9FYLAbsm9sAZuN12cMBlDNQ9931FlVbLRUwJ1gynhoxYAeqtpsGkS yyILiYk+NZ55EncA6Xj3OhXwsfN2H/5vhWFuy1ItnO1hraKIc5GZsGflH5rWkQCpSR4= X-Gm-Gg: AYBFou3Amwo+iZlZEhxd2bYwow+DxoB1wTTRKgLAK0anIqved2rgJ0BL9gEP3PWn7ij pvAf744Ra8a5W5z0fNsc0R0elTur3/0yYLJY8/lr/w3X9udUC+tHoznj8QQMv1ZYrUFRgOvdaP1 KHv4mNaE0CIU0yBmmxOc/0frJOrkunIVmEl/jJHG+68PA2WVco8x9iIzeCkbVI8qBcrXUonHVr5 MQIySlTD3nqKqGantzvlzT6XQ2ZxdiJDPtqAS2tnYy246jH5hZWR1akqU7AG8wNsnrXIYM21ETE OFMcaazU99uNY2Da/sBnvw0uzH2KHbGNA7w/9tjJIbPraxCgbW0W097QlZCeUlK6N8eZ10CKDg7 Y5Rbjdz1eIubzmwNjXjD9Dn+IUyBFzE/5QVyPxnjKhSdYZcL9PzBrVeSiaxuV2IXsrjJeCD3LZi GM7vAI9isEXe5+bWzowMO73UQKqQMd3EAJEE5hM95UytLLh+Rdz6JqBAGponSHWc7hwoSi6Dcu1 rudcHRipC09UGy0CNB3g1o6zfU5ZKFe/xA1ul2myUctR2+nsw== X-Received: by 2002:a17:902:db0b:b0:2e2:cebe:d811 with SMTP id d9443c01a7336-2e842ce805amr75629925ad.46.1791795230102; Mon, 12 Oct 2026 01:53:50 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e8acfa3b6csm14943335ad.41.2026.10.12.01.53.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 01:53:49 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-multimedia][PATCH v2 3/4] libde265: patch CVE-2026-49346 Date: Mon, 12 Oct 2026 21:53:36 +1300 Message-ID: <20261012085337.2879365-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012085337.2879365-1-ankur.tyagi85@gmail.com> References: <20261012085337.2879365-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 08:54:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130757 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-49346 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 4a63a2afa1c984b82a663ed8951b62f0ae5da093) Signed-off-by: Ankur Tyagi --- .../libde265/libde265/CVE-2026-49346.patch | 102 ++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 1 + 2 files changed, 103 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch new file mode 100644 index 00000000000..288295b08a8 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch @@ -0,0 +1,102 @@ +From 1667c33f2778a04f08ba4f7d6c1c16508350a779 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Tue, 26 May 2026 00:59:08 +0200 +Subject: [PATCH] fix integer overflow in image plane allocation size + (GHSA-vv8h-932h-7r86) + +(cherry picked from commit 8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8) + +CVE: CVE-2026-49346 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8] + +Signed-off-by: Ankur Tyagi +--- + libde265/image.cc | 46 +++++++++++++++++++++++++++------------------- + 1 file changed, 27 insertions(+), 19 deletions(-) + +diff --git a/libde265/image.cc b/libde265/image.cc +index 0b6071ba..94f3c974 100644 +--- a/libde265/image.cc ++++ b/libde265/image.cc +@@ -70,10 +70,11 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx, + void* inputdata, int inputstride, void *userdata) + { + int alignment = STANDARD_ALIGNMENT; +- int stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment; +- int height = img->get_height(cIdx); ++ uint32_t stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment; ++ uint32_t height = img->get_height(cIdx); + +- uint8_t* p = static_cast(ALLOC_ALIGNED_16(stride * height + MEMORY_PADDING)); ++ // size computed in size_t: stride*height can exceed UINT32_MAX for large planes ++ uint8_t* p = static_cast(ALLOC_ALIGNED_16(static_cast(stride) * height + MEMORY_PADDING)); + + if (p==nullptr) { return nullptr; } + +@@ -82,12 +83,14 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx, + // copy input data if provided + + if (inputdata != nullptr) { +- if (inputstride == stride) { +- memcpy(p, inputdata, stride*height); ++ if (inputstride == static_cast(stride)) { ++ memcpy(p, inputdata, static_cast(stride) * height); + } + else { +- for (int y=0;y(inputdata) + inputstride*y, inputstride); ++ for (uint32_t y=0;y(y) * stride, ++ static_cast(inputdata) + static_cast(inputstride) * y, ++ inputstride); + } + } + } +@@ -107,30 +110,35 @@ LIBDE265_API void de265_free_image_plane(struct de265_image* img, int cIdx) + static int de265_image_get_buffer(de265_decoder_context* ctx, + de265_image_spec* spec, de265_image* img, void* userdata) + { +- const int rawChromaWidth = spec->width / img->SubWidthC; +- const int rawChromaHeight = spec->height / img->SubHeightC; ++ const uint32_t rawChromaWidth = spec->width / img->SubWidthC; ++ const uint32_t rawChromaHeight = spec->height / img->SubHeightC; + +- int luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment; +- int chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment; ++ uint32_t luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment; ++ uint32_t chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment; + + assert(img->BitDepth_Y >= 8 && img->BitDepth_Y <= 16); + assert(img->BitDepth_C >= 8 && img->BitDepth_C <= 16); + +- int luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8); +- int chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8); ++ uint32_t luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8); ++ uint32_t chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8); + +- int luma_height = spec->height; +- int chroma_height = rawChromaHeight; ++ uint32_t luma_height = spec->height; ++ uint32_t chroma_height = rawChromaHeight; + + bool alloc_failed = false; + +- uint8_t* p[3] = { 0,0,0 }; +- p[0] = static_cast(ALLOC_ALIGNED_16(luma_height * luma_bpl + MEMORY_PADDING)); ++ // Compute the plane sizes in size_t. Each operand fits in uint32_t, but the ++ // height * bytes-per-line product can exceed UINT32_MAX for large frames, so ++ // the multiplication must be done in 64 bits. Computing it in 32 bits wraps ++ // the allocation size to a small value while fill_image() later writes the ++ // real (size_t) size -> heap buffer overflow (GHSA-vv8h-932h-7r86). ++ uint8_t* p[3] = { nullptr,nullptr,nullptr }; ++ p[0] = static_cast(ALLOC_ALIGNED_16(static_cast(luma_height) * luma_bpl + MEMORY_PADDING)); + if (p[0]==nullptr) { alloc_failed=true; } + + if (img->get_chroma_format() != de265_chroma_mono) { +- p[1] = static_cast(ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING)); +- p[2] = static_cast(ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING)); ++ p[1] = static_cast(ALLOC_ALIGNED_16(static_cast(chroma_height) * chroma_bpl + MEMORY_PADDING)); ++ p[2] = static_cast(ALLOC_ALIGNED_16(static_cast(chroma_height) * chroma_bpl + MEMORY_PADDING)); + + if (p[1]==nullptr || p[2]==nullptr) { alloc_failed=true; } + } diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index 5fcf6411131..a02d6dd5d8c 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f" SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \ file://CVE-2026-49295.patch \ file://CVE-2026-49337.patch \ + file://CVE-2026-49346.patch \ " SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Mon Oct 12 08:53:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100422 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6756FCA9ED0 for ; Mon, 12 Oct 2026 08:54:03 +0000 (UTC) Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9160.1791795233229427944 for ; Mon, 12 Oct 2026 01:53:53 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Udv3haGF; spf=pass (domain: gmail.com, ip: 209.85.214.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2e8246b13cbso13354105ad.2 for ; Mon, 12 Oct 2026 01:53:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791795232; x=1792400032; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=nrbgLpbwEEBb0tsaMG+LmqQUyf+iPCi2n7OE3hcRmLo=; b=Udv3haGFWDILEYJ9/EdSNAI58sgdYl7vPP5jHvLITzixoQBKjeWm6zGh0imwWE9bCC mccpy6GdKzI4A4tMoc2/vbIrB/puhzLAdTe4bM9BY7TX7Sbw8YxHGdaHwfLR2/kv5ZKf G8fuByPUFQhwb5uYF0korkmOxRnELO3Ih3uWZYAg7wzvub8WM/9j+DGx8D/YnQpkjeuA iAty95t/i/2CpUz1NF5amAFyKWzONXjUSGRyeD03JQNRLOan0pLuNWQWm5cFYIS9+oOD 6lNpeAm6hNMehGv06rOfKCMLHUdjSOi7MfCIGDrwI6X5eqzHu+iWEnrgFHCP1/0G0zM2 wXBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791795232; x=1792400032; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=nrbgLpbwEEBb0tsaMG+LmqQUyf+iPCi2n7OE3hcRmLo=; b=zUPSj/8dqlytoX6AhcVg9eDsXRApaHS9APOldrFl+1Sav9VLnHoonFTD5JT8JvUfCc xudC7yiFW7zKprHGseEdDJQKfgVbZsSp041KdbecXabUJrXHecafh7Il9AMlBSiS8r0B law51BQQi9KxX9kYLh7OIR1FGbfKwzj5ENP0H29/54wNKWePPlonC0rpN36O7ksC6DDc ctDiOq7U6WBsOFQ0AaH+LMpRSX/7AWtXrrE0lxIxCwAKtX47BMU3oiB2v4AI2rGSkld3 PVlzzdFKs7nx/HPKMsQqCXJt090m/c7qXoN4KfJL8/mw3X+SImTXsZ/h/NdGjzPEnl/9 sJ/g== X-Gm-Message-State: AFq9FYIFKeJNt/go26hCrJEGg5HMEuuhEhBi6GVTBupq8UA1xqUmKwOf RwyuTqqcV6ZBV62Ik/zT72nB3mtZR3Lp5GwV0/D/Pw4TABMu9fWo3QM3D/2ZbVYK/FY= X-Gm-Gg: AYBFou15aCszQndFVXoTv9KaTp88oaqEzOet/hLuH170xrNwVcx96YgyoOky6Dq7sbP yLkHTGOuuGDL4fV/htNb6l1N+mZClgN+tNLUSyu2K71nNtjqkP3v4V8JIxLAtIuHHDxfWomx7W/ FmJ+cwnadhDds8uJntk+e823uj66v+PVSY4MU10AkDcnLLi7A2HGO0s62TmQDMbRDg2FXyuNMsj NyhRGQ9nBebbCs934VGCm+2IJbe2XoE4H536gXzaYAxt/Tp0kUf+Lla6Mz17tqCrNvGCeoHSMaP bU46yl+W7Ysts6eb8JjaA4E45vm1+cQPa4Gxto7mQ87nGEkY5QPZ8vWNK5AyKwBgI4M5VJWCPL3 hW55co8jKCZ4ywGBhyUi7Poz6foRZ44hjHAm+C3+px2VbeUPJfE90DFnYTPfwfA63z4/PR/V2KY NJaYOQ4Ih45AX6x9vc85dj+jQIe+VgcXyEiO+lZW7+gqMO5lAx+eK4TZHNqjE9nng0AHZxYHDjh uzkk7MLorojRct3by8yjkfdc/M7AmylNiFmj94= X-Received: by 2002:a17:903:2f87:b0:2e2:ca04:fdae with SMTP id d9443c01a7336-2e842ab206cmr71097745ad.30.1791795232427; Mon, 12 Oct 2026 01:53:52 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e8acfa3b6csm14943335ad.41.2026.10.12.01.53.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 01:53:52 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-multimedia][PATCH v2 4/4] libde265: patch CVE-2026-54240 and CVE-2026-54241 Date: Mon, 12 Oct 2026 21:53:37 +1300 Message-ID: <20261012085337.2879365-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012085337.2879365-1-ankur.tyagi85@gmail.com> References: <20261012085337.2879365-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 08:54:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130758 From: Ankur Tyagi Debian identified same commit as fix for both CVEs[1][2]. Details: https://nvd.nist.gov/vuln/detail/cve-2026-54240 https://nvd.nist.gov/vuln/detail/cve-2026-54241 [1]https://security-tracker.debian.org/tracker/CVE-2026-54240 [2]https://security-tracker.debian.org/tracker/CVE-2026-54241 Signed-off-by: Ankur Tyagi --- .../CVE-2026-54240-CVE-2026-54241.patch | 426 ++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 1 + 2 files changed, 427 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch new file mode 100644 index 00000000000..6f5c526f17f --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch @@ -0,0 +1,426 @@ +From 3986aba8dec43bc539e5f7c349826cea902f9ee3 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Wed, 3 Jun 2026 16:44:32 +0200 +Subject: [PATCH] fix pixel-accessor integer overflow on large frames + (GHSA-ccfw-29x7-rrx3) + +The de265_image::get_image_plane_at_pos*() accessors computed the pixel +offset `xpos + ypos*stride` in signed 32-bit int. For frames where +width*height exceeds INT32_MAX (e.g. 46344x46344, both within the existing +<=65535 limit), ypos*stride wraps negative and the returned pointer lands +~2 GB before the buffer -> heap out-of-bounds read/write. This is independent +of the earlier allocation fix (GHSA-vv8h-932h-7r86), which only widened the +buffer size, not the offset arithmetic. + +Widen the image stride to ptrdiff_t (members, get_image_stride/get_luma_stride/ +get_chroma_stride, set_image_plane) so all pixel-offset math is evaluated in +64 bits. The public C API (de265_get/set_image_plane) keeps int for ABI; the +narrowing at that boundary is safe (stride <= ~65552). + +The same 32-bit-stride / absolute-coordinate pattern existed in several scalar +paths that the accessors don't cover; widen those too: + - sao.cc: SAO offset indexing, and the inputCopy allocation+memcpy size + (an int size_t under-allocation -> heap write) + - motion.cc: mc_luma/mc_chroma reference-plane access (ref_stride, src_stride) + - intrapred.h: intra reference-border fill + - sei.cc: decoded-picture-hash MD5/CRC/checksum + - image-io.cc: YUV plane read and write +The deblock kernels, SIMD layer (acceleration.h) and per-block code already +use ptrdiff_t or only small block-local offsets and need no change. + +Also store pic_width/height_in_luma_samples as uint16_t (the value is +provably <= MAX_PICTURE_WIDTH = 65535 after validation) so PicSizeInSamplesY +needs only a single uint32_t cast instead of int*int (which was signed-overflow +UB on the same trigger); add static_asserts tying the limits to the storage. + +Verified: girlshy bit-exact single- and multi-threaded; ASan+UBSan PoC against +the get_image_plane_at_pos sink crashes pre-fix (UBSan signed-overflow at the +accessor + ASan wild write) and is clean post-fix. + +(cherry picked from commit bdca87569b9c63c2a7054d90ae4462dbb78d159a) + +CVE: CVE-2026-54240 CVE-2026-54241 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/bdca87569b9c63c2a7054d90ae4462dbb78d159a] + +Signed-off-by: Ankur Tyagi +--- + libde265/de265.cc | 2 +- + libde265/image-io.cc | 4 ++-- + libde265/image.cc | 2 +- + libde265/image.h | 21 +++++++++++---------- + libde265/intrapred.h | 2 +- + libde265/motion.cc | 8 ++++---- + libde265/sao.cc | 18 +++++++++--------- + libde265/sei.cc | 18 ++++++++++-------- + libde265/sps.cc | 4 ++-- + libde265/sps.h | 11 +++++++++-- + 10 files changed, 50 insertions(+), 40 deletions(-) + +diff --git a/libde265/de265.cc b/libde265/de265.cc +index 48e38a01..02b2d5fd 100644 +--- a/libde265/de265.cc ++++ b/libde265/de265.cc +@@ -678,7 +678,7 @@ LIBDE265_API const uint8_t* de265_get_image_plane(const de265_image* img, int ch + + uint8_t* data = img->pixels_confwin[channel]; + +- if (stride) *stride = img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8); ++ if (stride) *stride = static_cast(img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8)); + + return data; + } +diff --git a/libde265/image-io.cc b/libde265/image-io.cc +index f15234b6..14ca95f0 100644 +--- a/libde265/image-io.cc ++++ b/libde265/image-io.cc +@@ -76,7 +76,7 @@ de265_image* ImageSource_YUV::read_next_image() + // --- load image --- + + uint8_t* p; +- int stride; ++ ptrdiff_t stride; + + p = img->get_image_plane(0); stride = img->get_image_stride(0); + for (uint32_t y=0;yget_width(); + int height= img->get_height(); +diff --git a/libde265/image.cc b/libde265/image.cc +index 94f3c974..59a19184 100644 +--- a/libde265/image.cc ++++ b/libde265/image.cc +@@ -184,7 +184,7 @@ de265_image_allocation de265_image::default_image_allocation = { + }; + + +-void de265_image::set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata) ++void de265_image::set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata) + { + pixels[cIdx] = mem; + plane_user_data[cIdx] = userdata; +diff --git a/libde265/image.h b/libde265/image.h +index e0f1db24..114f41e4 100644 +--- a/libde265/image.h ++++ b/libde265/image.h +@@ -26,6 +26,7 @@ + #endif + + #include ++#include + #include + #include + #include +@@ -235,11 +236,11 @@ struct de265_image { + /* */ uint8_t* get_image_plane(int cIdx) { return pixels[cIdx]; } + const uint8_t* get_image_plane(int cIdx) const { return pixels[cIdx]; } + +- void set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata); ++ void set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata); + + uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos) + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + xpos + ypos*stride; + } + +@@ -248,38 +249,38 @@ struct de265_image { + template + pixel_t* get_image_plane_at_pos_NEW(int cIdx, int xpos,int ypos) + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return (pixel_t*)(pixels[cIdx] + (xpos + ypos*stride)*sizeof(pixel_t)); + } + + const uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos) const + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + xpos + ypos*stride; + } + + void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos) + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]); + } + + const void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos) const + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]); + } + + /* Number of pixels in one row (not number of bytes). + */ +- int get_image_stride(int cIdx) const ++ ptrdiff_t get_image_stride(int cIdx) const + { + if (cIdx==0) return stride; + else return chroma_stride; + } + +- int get_luma_stride() const { return stride; } +- int get_chroma_stride() const { return chroma_stride; } ++ ptrdiff_t get_luma_stride() const { return stride; } ++ ptrdiff_t get_chroma_stride() const { return chroma_stride; } + + int get_width (int cIdx=0) const { return cIdx==0 ? width : chroma_width; } + int get_height(int cIdx=0) const { return cIdx==0 ? height : chroma_height; } +@@ -333,7 +334,7 @@ private: + int width = 0, height = 0; // size in luma pixels + + int chroma_width = 0, chroma_height = 0; +- int stride = 0, chroma_stride = 0; ++ ptrdiff_t stride = 0, chroma_stride = 0; + + public: + uint8_t BitDepth_Y = 0, BitDepth_C = 0; +diff --git a/libde265/intrapred.h b/libde265/intrapred.h +index 9b17f75b..a256cb3a 100644 +--- a/libde265/intrapred.h ++++ b/libde265/intrapred.h +@@ -533,7 +533,7 @@ void intra_border_computer::fill_from_image() + assert(nT<=32); + + pixel_t* image; +- int stride; ++ ptrdiff_t stride; + image = (pixel_t*)img->get_image_plane(cIdx); + stride = img->get_image_stride(cIdx); + +diff --git a/libde265/motion.cc b/libde265/motion.cc +index c62c24c3..14e920e1 100644 +--- a/libde265/motion.cc ++++ b/libde265/motion.cc +@@ -50,7 +50,7 @@ void mc_luma(const base_context* ctx, + const seq_parameter_set* sps, int mv_x, int mv_y, + int xP,int yP, + int16_t* out, int out_stride, +- const pixel_t* ref, int ref_stride, ++ const pixel_t* ref, ptrdiff_t ref_stride, + int nPbW, int nPbH, int bitDepth_L) + { + int xFracL = mv_x & 3; +@@ -129,7 +129,7 @@ void mc_luma(const base_context* ctx, + pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+7)]; + + const pixel_t* src_ptr; +- int src_stride; ++ ptrdiff_t src_stride; + + if (-extra_left + xIntOffsL >= 0 && + -extra_top + yIntOffsL >= 0 && +@@ -181,7 +181,7 @@ void mc_chroma(const base_context* ctx, + int mv_x, int mv_y, + int xP,int yP, + int16_t* out, int out_stride, +- const pixel_t* ref, int ref_stride, ++ const pixel_t* ref, ptrdiff_t ref_stride, + int nPbWC, int nPbHC, int bit_depth_C) + { + // chroma sample interpolation process (8.5.3.2.2.2) +@@ -227,7 +227,7 @@ void mc_chroma(const base_context* ctx, + pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+3)]; + + const pixel_t* src_ptr; +- int src_stride; ++ ptrdiff_t src_stride; + + int extra_top = 1; + int extra_left = 1; +diff --git a/libde265/sao.cc b/libde265/sao.cc +index a0db84b2..579dcef2 100644 +--- a/libde265/sao.cc ++++ b/libde265/sao.cc +@@ -28,8 +28,8 @@ + template + void apply_sao_internal(de265_image* img, int xCtb,int yCtb, + const slice_segment_header* shdr, int cIdx, int nSW,int nSH, +- const pixel_t* in_img, int in_stride, +- /* */ pixel_t* out_img, int out_stride) ++ const pixel_t* in_img, ptrdiff_t in_stride, ++ /* */ pixel_t* out_img, ptrdiff_t out_stride) + { + const sao_info* saoinfo = img->get_sao_info(xCtb,yCtb); + +@@ -77,7 +77,7 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb, + + if (SaoTypeIdx==2) { + int hPos[2], vPos[2]; +- int vPosStride[2]; // vPos[] multiplied by image stride ++ ptrdiff_t vPosStride[2]; // vPos[] multiplied by image stride + int SaoEoClass = (saoinfo->SaoEoClass >> (2*cIdx)) & 0x3; + + switch (SaoEoClass) { +@@ -266,8 +266,8 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb, + template + void apply_sao(de265_image* img, int xCtb,int yCtb, + const slice_segment_header* shdr, int cIdx, int nSW,int nSH, +- const pixel_t* in_img, int in_stride, +- /* */ pixel_t* out_img, int out_stride) ++ const pixel_t* in_img, ptrdiff_t in_stride, ++ /* */ pixel_t* out_img, ptrdiff_t out_stride) + { + if (img->high_bit_depth(cIdx)) { + apply_sao_internal(img,xCtb,yCtb, shdr,cIdx,nSW,nSH, +@@ -332,8 +332,8 @@ void apply_sample_adaptive_offset_sequential(de265_image* img) + return; + } + +- int lumaImageSize = img->get_image_stride(0) * img->get_height(0) * img->get_bytes_per_pixel(0); +- int chromaImageSize = img->get_image_stride(1) * img->get_height(1) * img->get_bytes_per_pixel(1); ++ size_t lumaImageSize = static_cast(img->get_image_stride(0)) * img->get_height(0) * img->get_bytes_per_pixel(0); ++ size_t chromaImageSize = static_cast(img->get_image_stride(1)) * img->get_height(1) * img->get_bytes_per_pixel(1); + + uint8_t* inputCopy = new uint8_t[ libde265_max(lumaImageSize, chromaImageSize) ]; + if (inputCopy == nullptr) { +@@ -347,10 +347,10 @@ void apply_sample_adaptive_offset_sequential(de265_image* img) + + for (int cIdx=0;cIdxget_image_stride(cIdx); ++ ptrdiff_t stride = img->get_image_stride(cIdx); + int height = img->get_height(cIdx); + +- memcpy(inputCopy, img->get_image_plane(cIdx), stride * height * img->get_bytes_per_pixel(cIdx)); ++ memcpy(inputCopy, img->get_image_plane(cIdx), static_cast(stride) * height * img->get_bytes_per_pixel(cIdx)); + + for (int yCtb=0; yCtb(data); +- int stride16 = stride / 2; ++ ptrdiff_t stride16 = stride / 2; + for (int y=0; y> 8 ) ^ ( y >> 8 ); +@@ -224,7 +225,7 @@ static inline uint16_t crc_process_byte_parallel(uint16_t crc, uint8_t byte) + (t << 12)) & 0xFFFF; + } + +-static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride, int bit_depth) ++static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,ptrdiff_t stride, int bit_depth) + { + raw_hash_data raw_data(w,stride); + +@@ -250,7 +251,7 @@ static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride + } + + +-static void compute_MD5(uint8_t* data,int w,int h,int stride, uint8_t* result, int bit_depth) ++static void compute_MD5(uint8_t* data,int w,int h,ptrdiff_t stride, uint8_t* result, int bit_depth) + { + MD5_CTX md5; + MD5_Init(&md5); +@@ -289,7 +290,8 @@ static de265_error process_sei_decoded_picture_hash(const sei_message* sei, de26 + int nHashes = img->get_sps().chroma_format_idc==0 ? 1 : 3; + for (int i=0;iget_width(i); + h = img->get_height(i); +diff --git a/libde265/sps.cc b/libde265/sps.cc +index aa871a09..a29a3c0a 100644 +--- a/libde265/sps.cc ++++ b/libde265/sps.cc +@@ -570,7 +570,7 @@ de265_error seq_parameter_set::compute_derived_values(bool sanitize_values) + PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY); + PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY; + PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY; +- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples; ++ PicSizeInSamplesY = static_cast(pic_width_in_luma_samples) * pic_height_in_luma_samples; + + if (chroma_format_idc==0 || separate_colour_plane_flag) { + CtbWidthC = 0; +@@ -1325,7 +1325,7 @@ de265_error seq_parameter_set::write(error_queue* errqueue, CABAC_encoder& out) + PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY); + PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY; + PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY; +- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples; ++ PicSizeInSamplesY = static_cast(pic_width_in_luma_samples) * pic_height_in_luma_samples; + if (chroma_format_idc==0 || separate_colour_plane_flag) { + CtbWidthC = 0; + CtbHeightC = 0; +diff --git a/libde265/sps.h b/libde265/sps.h +index c8be9788..5cb0b46c 100644 +--- a/libde265/sps.h ++++ b/libde265/sps.h +@@ -39,6 +39,13 @@ constexpr int MAX_NUM_LT_REF_PICS_SPS = 32; + constexpr int MAX_PICTURE_WIDTH = 65535; + constexpr int MAX_PICTURE_HEIGHT = 65535; + ++// pic_width/height_in_luma_samples are stored as uint16_t and PicSizeInSamplesY as uint32_t, ++// so these limits must keep width/height in 16 bits and their product in 32 bits. ++static_assert(MAX_PICTURE_WIDTH <= 0xFFFF, "picture width must fit in uint16_t"); ++static_assert(MAX_PICTURE_HEIGHT <= 0xFFFF, "picture height must fit in uint16_t"); ++static_assert((uint64_t)MAX_PICTURE_WIDTH * MAX_PICTURE_HEIGHT <= 0xFFFFFFFFu, ++ "total luma sample count must fit in uint32_t"); ++ + enum { + CHROMA_MONO = 0, + CHROMA_420 = 1, +@@ -111,8 +118,8 @@ public: + uint8_t chroma_format_idc; // [0;3] + + bool separate_colour_plane_flag; +- int pic_width_in_luma_samples; +- int pic_height_in_luma_samples; ++ uint16_t pic_width_in_luma_samples; // <= MAX_PICTURE_WIDTH (validated on parse) ++ uint16_t pic_height_in_luma_samples; // <= MAX_PICTURE_HEIGHT (validated on parse) + bool conformance_window_flag; + + int conf_win_left_offset; diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index a02d6dd5d8c..8e145cf8dde 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -12,6 +12,7 @@ SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https file://CVE-2026-49295.patch \ file://CVE-2026-49337.patch \ file://CVE-2026-49346.patch \ + file://CVE-2026-54240-CVE-2026-54241.patch \ " SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06"