mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-08 23:51:08 -09:00
e55cb31085
https://github.com/strukturag/libde265/releases/tag/v1.1.2 Security fixes: (CVE numbers will be added when assigned.) CVE-2026-XXXXX (GHSA-xp3h-6f5r-8cxp) Heap use-after-free and double free in multi-threaded (WPP) decoding. A crafted stream whose slice segments repeat or rewind their slice_segment_address within a picture re-ran CTB rows that were already marked finished, so the CABAC context handoff between rows was no longer ordered and the shared context table was released twice. Slice segments that do not follow the previous one in tile-scan order are now rejected with the new warning DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING, and the WPP row progress is reset for each slice segment. (medium) CVE-2026-XXXXX (GHSA-mm7m-v26f-wf8x) Heap use-after-free after de265_reset(): the pointer to the previous slice header was left dangling when the DPB was cleared, and a dependent slice pushed after the reset copied from freed memory. (medium) Signed-off-by: Bernd Kuhls <bernd@kuhls.net> Signed-off-by: Julien Olivain <ju.o@free.fr>
5 lines
263 B
Plaintext
5 lines
263 B
Plaintext
# From https://github.com/strukturag/libde265/releases/tag/v1.1.2
|
|
sha256 eaacd1943ab0c452c19f6136a36ca227e6b761b39a81eaca8454d48c147e1f67 libde265-1.1.2.tar.gz
|
|
# Locally computed
|
|
sha256 02cc1585a20677992e0ba578fa692635dc193735f2691dc81de924b51c4e8020 COPYING
|