CVE-2017-13135

[Sebastian Ramacher]

A CVE was released for the embedded copy of x265 in libbpg. The corresponding bug report can be found at https://github.com/ebel34/bpg-web-encoder/issues/1.

From a first look at it, "bug 1" is also present in the current version of x265. At least in Analysis::create and FrameData::create the return value of create is not checked, so that might cause similar crashes.

[Pradeep Ramachandran]

Thanks for the report. We will try to address this asap on the stable branch, given its security implications.

[Santhoshini Sekar]

We have pushed a patch(changeset: 78c0f2c) on the stable branch of x265 to address this issue. Can you please check and let us know if this fixes it?

[Sebastian Ramacher]

Thank you. I don't have the samples crashing the code, but the fixes look good to me.

[Pradeep Ramachandran]

Changeset pushed to stable branch of x265 and merged with default branch