Описание
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, decoder_context::decode_slice_unit_tiles (libde265/decctx.cc:920) reads pps.CtbAddrRStoTS[ctbAddrRS] at line 966 where ctbAddrRS = ctbY * ctbsWidth + ctbX is computed from PPS-supplied colBd[]/rowBd[] arrays without validating the result against CtbAddrRStoTS.size() == sps->PicSizeInCtbsY. A malformed PPS that passes set_derived_values but encodes geometry inconsistent with the SPS produces a ctbAddrRS past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps-legacy/xenial | released | 1.0.2-2ubuntu0.16.04.1~esm6 |
| esm-apps/bionic | released | 1.0.2-2ubuntu0.18.04.1~esm6 |
| esm-apps/focal | released | 1.0.4-1ubuntu0.4+esm2 |
| esm-apps/jammy | released | 1.0.8-1ubuntu0.3+esm2 |
| esm-apps/resolute | released | 1.0.16-1ubuntu0.1~esm1 |
| jammy | needed | |
| noble | released | 1.0.15-1ubuntu0.1 |
| questing | ignored | end of life, was needs-triage |
| resolute | needed |
Показывать по
EPSS
Связанные уязвимости
libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, `decoder_context::decode_slice_unit_tiles` (libde265/decctx.cc:920) reads `pps.CtbAddrRStoTS[ctbAddrRS]` at line 966 where `ctbAddrRS = ctbY * ctbsWidth + ctbX` is computed from PPS-supplied `colBd[]`/`rowBd[]` arrays without validating the result against `CtbAddrRStoTS.size() == sps->PicSizeInCtbsY`. A malformed PPS that passes `set_derived_values` but encodes geometry inconsistent with the SPS produces a `ctbAddrRS` past the allocation, causing a 4-byte heap-buffer-overflow READ. Version 1.0.19 fixes the issue.
libde265 is an open source implementation of the h.265 video codec. Pr ...
EPSS