File gstreamer-plugins-bad-CVE-2023-40476.patch of Package gstreamer-plugins-bad.31551

Author: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Date:   Wed Aug 9 12:49:19 2023 -0400

    h265parser: Fix possible overflow using max_sub_layers_minus1
    
    This fixes a possible overflow that can be triggered by an invalid value of
    max_sub_layers_minus1 being set in the bitstream. The bitstream uses 3 bits,
    but the allowed range is 0 to 6 only.
    
    Fixes ZDI-CAN-21768, CVE-2023-40476
    
    Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/2895
    
    Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/5364>

diff -Nura gst-plugins-bad-1.8.3/gst-libs/gst/codecparsers/gsth265parser.c gst-plugins-bad-1.8.3_new/gst-libs/gst/codecparsers/gsth265parser.c
--- gst-plugins-bad-1.8.3/gst-libs/gst/codecparsers/gsth265parser.c	2016-03-24 19:36:40.000000000 +0800
+++ gst-plugins-bad-1.8.3_new/gst-libs/gst/codecparsers/gsth265parser.c	2023-10-31 20:49:28.579770937 +0800

@@ -1547,6 +1547,7 @@
   sps->vps = vps;
 
   READ_UINT8 (&nr, sps->max_sub_layers_minus1, 3);
+  CHECK_ALLOWED (vps->max_sub_layers_minus1, 0, 6);
   READ_UINT8 (&nr, sps->temporal_id_nesting_flag, 1);
 
   if (!gst_h265_parse_profile_tier_level (&sps->profile_tier_level, &nr,