REDHAT-BUG-2564118: Buffer Overflow
GStreamer's gst-plugins-bad provides the H.265 (HEVC) bitstream parser in subprojects/gst-plugins-bad/gst-libs/gst/codecparsers/gsth265parser.c. In the function gsth265parsespsext() at approximately line 2297, when parsing the SPS SCC (Screen Content Coding) extension, the code computes the upper bound for spsnumpalettepredictorinitializerminus1 as 'palettemaxsize + deltapalettemaxpredictorsize - 1'. If an attacker crafts a bitstream where both palettemaxsize and deltapalettemaxpredictorsize are 0 (legal values per their individual READUEMAX constraints), this subtraction produces 0xFFFFFFFF via unsigned integer underflow. The READUEMAX macro checks 'val > max' using guint32 comparison, so 0xFFFFFFFF as max accepts any guint32 value. The field spsnumpalettepredictorinitializerminus1 is stored in a guint8, so the value is truncated to 0..255. If the truncated value exceeds 127, the subsequent loop 'for (i = 0; i < num; i++) READUINT32(nr, spspalettepredictorinitializer[comp][i], numbits)' writes past the end of the guint32 spspalettepredictorinitializer[3][128] array, causing a heap buffer overflow into adjacent GstH265SPSSCCExtensionParams and GstH265SPS struct members. This corrupts the GstH265SPS object stored in the parser's static sps[] array.
Affected versions: gst-plugins-bad < 1.28.1. Fix: gst-plugins-bad 1.28.1 adds a guard 'if (palettemaxsize + deltapalettemaxpredictorsize == 0) goto error' before the bound computation. Advisory: GStreamer-SA-2026-0012. Reporter: GStreamer project (upstream self-reported).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gst-plugins-badto a version that resolves this vulnerability.Fixed in 1.28.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using GStreamer gst-plugins-bad to parse H.265 bitstreams are relevant, specifically when parsing streams containing the SPS Screen Content Coding extension. The provided data does not identify configuration-specific exposure conditions.
What does an attacker need to provide to trigger the overflow?
An attacker needs to supply a crafted H.265 bitstream whose SPS SCC extension sets both palette_max_size and delta_palette_max_predictor_size to 0. They must also cause the truncated sps_num_palette_predictor_initializer_minus1 value to exceed 127, leading the parser loop to write beyond its 3-by-128 guint32 array.
What is the direct technical impact of successful triggering?
The unsigned underflow changes the parser's intended upper bound to 0xFFFFFFFF, allowing an unchecked guint32 value before it is truncated to guint8. A resulting value above 127 causes a heap buffer overflow into adjacent SPS SCC extension data.