From 48c51c00f8d5c1d81bceb7139c5fe90fd4ce9a9c Mon Sep 17 00:00:00 2001 From: tigro Date: Tue, 24 Oct 2023 11:25:31 +0300 Subject: [PATCH 2/2] Fixes ZDI-CAN-21768, CVE-2023-40476 --- gst-libs/gst/codecparsers/gsth265parser.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/gst-libs/gst/codecparsers/gsth265parser.c b/gst-libs/gst/codecparsers/gsth265parser.c index 26e68b2..8bd2144 100644 --- a/gst-libs/gst/codecparsers/gsth265parser.c +++ b/gst-libs/gst/codecparsers/gsth265parser.c @@ -1656,6 +1656,7 @@ gst_h265_parse_vps (GstH265NalUnit * nalu, GstH265VPS * vps) READ_UINT8 (&nr, vps->max_layers_minus1, 6); READ_UINT8 (&nr, vps->max_sub_layers_minus1, 3); + CHECK_ALLOWED (vps->max_sub_layers_minus1, 0, 6); READ_UINT8 (&nr, vps->temporal_id_nesting_flag, 1); /* skip reserved_0xffff_16bits */ @@ -1834,6 +1835,7 @@ gst_h265_parse_sps (GstH265Parser * parser, GstH265NalUnit * nalu, sps->vps = vps; READ_UINT8 (&nr, sps->max_sub_layers_minus1, 3); + CHECK_ALLOWED (sps->max_sub_layers_minus1, 0, 6); READ_UINT8 (&nr, sps->temporal_id_nesting_flag, 1); if (!gst_h265_parse_profile_tier_level (&sps->profile_tier_level, &nr, -- 2.41.0