https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652 Straight from upstream To be removed with libde265-1.1.0 or later From 691f3a3c55b3d32478c4a49895dee061a282652b Mon Sep 17 00:00:00 2001 From: Dirk Farin Date: Mon, 25 May 2026 20:14:07 +0200 Subject: [PATCH] bound aggregate short-term RPS size (GHSA-g2rg-wj66-w594) --- libde265/refpic.cc | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/libde265/refpic.cc b/libde265/refpic.cc index ea4db4b0..dcd2b214 100644 --- a/libde265/refpic.cc +++ b/libde265/refpic.cc @@ -322,6 +322,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue, out_set->compute_derived_values(); + // The unused short-term references are all collected into a single PocStFoll array + // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set). + // While each individual list is bounded above, the predicted-RPS construction can + // append the current-picture delta to an already-full source set, pushing the + // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds + // write when filling PocStFoll. + if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) { + out_set->NumNegativePics = 0; + out_set->NumPositivePics = 0; + out_set->NumDeltaPocs = 0; + out_set->NumPocTotalCurr_shortterm_only = 0; + + errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false); + return false; + } + return true; }