CVS commit: pkgsrc/multimedia/libde265

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Sep  3 04:55:25 UTC 2026

Modified Files:
        pkgsrc/multimedia/libde265: Makefile PLIST distinfo

Log Message:
libde265: updated to 1.1.2

v1.1.2 is a security and bugfix release. It is ABI- and API-compatible with v1.1.1 and is a drop-in replacement. Two enum values were added: DE265_ERROR_INVALID_ARGUMENT and 
DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING.

Security fixes

(CVE numbers will be added when assigned.)

CVE-2026-XXXXX (GHSA-xp3h-6f5r-8cxp) Heap use-after-free and double free in multi-threaded (WPP) decoding. A crafted stream whose slice segments repeat or rewind their slice_segment_address within a 
picture re-ran CTB rows that were already marked finished, so the CABAC context handoff between rows was no longer ordered and the shared context table was released twice. Slice segments that do not 
follow the previous one in tile-scan order are now rejected with the new warning DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING, and the WPP row progress is reset for each slice segment. (medium)
CVE-2026-XXXXX (GHSA-mm7m-v26f-wf8x) Heap use-after-free after de265_reset(): the pointer to the previous slice header was left dangling when the DPB was cleared, and a dependent slice pushed after 
the reset copied from freed memory. (medium)
Thanks to @rohitmahesh1, @l1ve709, and @sonicnew for reporting these issues.

Hardening

de265_push_NAL() rejects NAL units shorter than the two-byte NAL unit header (including negative lengths) with the new DE265_ERROR_INVALID_ARGUMENT instead of calling memcpy() with a NULL destination 
and then aborting the decode
SEI parsing: the overflow guard on the accumulated payload_size compared the wrong variable and could never trigger, so a crafted size could wrap around silently (thanks @94xhn)
The per-CTB progress counters and the image integrity flag are atomic with acquire/release ordering; ThreadSanitizer reported data races on them with several worker threads

Bug fixes

Regression since v1.0.17: a cu_qp_delta of -26 was rejected as out of range although the allowed range is asymmetric and -26 is valid. Real-world encoders emit this value; the rejection aborted the 
slice and corrupted every picture of the affected IDR period
Regression since v1.0.17: an out-of-range value in the advisory VUI fields (bitstream_restriction(), chroma_sample_loc_type_*) rejected the whole SPS, so HEIF images from some consumer encoders could 
not be decoded at all. These fields are never used in the decoding process; they are now clamped with a warning as in v1.0.16. Malformed exp-Golomb codes are still a hard error
16-bit decoding: the residual of 4x4 intra luma blocks (DST) was clipped to 16 bits although it needs 17 bits at bit depth 16, corrupting those blocks and everything intra-predicted from them. Output 
is now identical to the HM reference decoder; bit depths up to 15 were not affected (thanks @felixbuenemann)
MSVC: the visibility attribute is only used with GCC and Clang, fixing the static build with MSVC
CMake: building sherlock265 together with the library silently disabled the hidden symbol visibility introduced in v1.1.1. sherlock265 only uses exported symbols, so it no longer forces full 
visibility, and the configure output now states why symbols are hidden or exported. FORCE_FULL_VISIBILITY is documented in the README


To generate a diff of this commit:
cvs rdiff -u -r1.24 -r1.25 pkgsrc/multimedia/libde265/Makefile
cvs rdiff -u -r1.7 -r1.8 pkgsrc/multimedia/libde265/PLIST
cvs rdiff -u -r1.18 -r1.19 pkgsrc/multimedia/libde265/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/multimedia/libde265/Makefile
diff -u pkgsrc/multimedia/libde265/Makefile:1.24 pkgsrc/multimedia/libde265/Makefile:1.25
--- pkgsrc/multimedia/libde265/Makefile:1.24    Wed Sep  2 19:03:45 2026
+++ pkgsrc/multimedia/libde265/Makefile Thu Sep  3 04:55:25 2026
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.24 2026/09/02 19:03:45 wiz Exp $
+# $NetBSD: Makefile,v 1.25 2026/09/03 04:55:25 adam Exp $
 
-DISTNAME=      libde265-1.1.1
-PKGREVISION=   2
+DISTNAME=      libde265-1.1.2
 CATEGORIES=    multimedia
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=strukturag/}
 GITHUB_RELEASE=        v${PKGVERSION_NOREV}

Index: pkgsrc/multimedia/libde265/PLIST
diff -u pkgsrc/multimedia/libde265/PLIST:1.7 pkgsrc/multimedia/libde265/PLIST:1.8
--- pkgsrc/multimedia/libde265/PLIST:1.7        Fri Jun  5 08:19:13 2026
+++ pkgsrc/multimedia/libde265/PLIST    Thu Sep  3 04:55:25 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.7 2026/06/05 08:19:13 adam Exp $
+@comment $NetBSD: PLIST,v 1.8 2026/09/03 04:55:25 adam Exp $
 bin/dec265
 include/libde265/de265-version.h
 include/libde265/de265.h
@@ -7,5 +7,5 @@ lib/cmake/libde265/libde265-config-versi
 lib/cmake/libde265/libde265-config.cmake
 lib/libde265.so
 lib/libde265.so.0
-lib/libde265.so.0.2.1
+lib/libde265.so.0.2.2
 lib/pkgconfig/libde265.pc

Index: pkgsrc/multimedia/libde265/distinfo
diff -u pkgsrc/multimedia/libde265/distinfo:1.18 pkgsrc/multimedia/libde265/distinfo:1.19
--- pkgsrc/multimedia/libde265/distinfo:1.18    Fri Jun  5 08:19:13 2026
+++ pkgsrc/multimedia/libde265/distinfo Thu Sep  3 04:55:25 2026
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.18 2026/06/05 08:19:13 adam Exp $
+$NetBSD: distinfo,v 1.19 2026/09/03 04:55:25 adam Exp $
 
-BLAKE2s (libde265-1.1.1.tar.gz) = 354ac3ae9cfc2fca6274ae2bd3e211aca23c7978a5af4e15776f645d001dad91
-SHA512 (libde265-1.1.1.tar.gz) = 7ecc2fc2d20bc85f2a117c16562e1abd6ad9ec92785f65dfb15a5c7038687b64ae885ad31d31beaf2fa5471b4ce4dbfee98191db9457b2a6b14eabda8c483cad
-Size (libde265-1.1.1.tar.gz) = 315566 bytes
+BLAKE2s (libde265-1.1.2.tar.gz) = 441584838db2adf690028a9990f02d1d9e423e3b64c2d3c63e5c7876b86dc137
+SHA512 (libde265-1.1.2.tar.gz) = e21cebbee52cab09cd90047135704e11b45312073b3c19663096c449e9c455cb722f384dceaab25bb62e3b4ecd84995a9a6631d4797079ce9ec44a8e81f8dac1
+Size (libde265-1.1.2.tar.gz) = 319593 bytes
 SHA1 (patch-CMakeLists.txt) = 8634ecedecea2da040ade750938cfb83c7171a70
 SHA1 (patch-cmake_config.h.in) = 5d37e8331db11c93cb31c2aaf9074f7b3f1a8877