Package: libde265 / 1.0.11-1+deb12u2

CVE-2023-49467.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
commit 7e4faf254bbd2e52b0f216cb987573a2cce97b54
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Thu Nov 23 19:38:34 2023 +0100

    prevent endless loop for #434 input

diff --git a/libde265/slice.cc b/libde265/slice.cc
index 435123dc..3a8a8de1 100644
--- a/libde265/slice.cc
+++ b/libde265/slice.cc
@@ -2582,6 +2582,11 @@ static int decode_rqt_root_cbf(thread_context* tctx)
 
 static int decode_ref_idx_lX(thread_context* tctx, int numRefIdxLXActive)
 {
+  // prevent endless loop when 'numRefIdxLXActive' is invalid
+  if (numRefIdxLXActive <= 1) {
+    return 0;
+  }
+
   logtrace(LogSlice,"# ref_idx_lX\n");
 
   int cMax = numRefIdxLXActive-1;