v1.1.2 - security and bugfix release

v1.1.2 is a security and bugfix release. It is ABI- and API-compatible with v1.1.1 and is a drop-in replacement. Two enum values were added: DE265_ERROR_INVALID_ARGUMENT and DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING.

Security fixes

(CVE numbers will be added when assigned.)

• CVE-2026-XXXXX (GHSA-xp3h-6f5r-8cxp) Heap use-after-free and double free in multi-threaded (WPP) decoding. A crafted stream whose slice segments repeat or rewind their slice_segment_address within a picture re-ran CTB rows that were already marked finished, so the CABAC context handoff between rows was no longer ordered and the shared context table was released twice. Slice segments that do not follow the previous one in tile-scan order are now rejected with the new warning DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING, and the WPP row progress is reset for each slice segment. (medium)
• CVE-2026-XXXXX (GHSA-mm7m-v26f-wf8x) Heap use-after-free after de265_reset(): the pointer to the previous slice header was left dangling when the DPB was cleared, and a dependent slice pushed after the reset copied from freed memory. (medium)

Thanks to @rohitmahesh1, @l1ve709, and @sonicnew for reporting these issues.

Hardening

• de265_push_NAL() rejects NAL units shorter than the two-byte NAL unit header (including negative lengths) with the new DE265_ERROR_INVALID_ARGUMENT instead of calling memcpy() with a NULL destination and then aborting the decode (#534)
• SEI parsing: the overflow guard on the accumulated payload_size compared the wrong variable and could never trigger, so a crafted size could wrap around silently (thanks @94xhn)
• The per-CTB progress counters and the image integrity flag are atomic with acquire/release ordering; ThreadSanitizer reported data races on them with several worker threads

Bug fixes

• Regression since v1.0.17: a cu_qp_delta of -26 was rejected as out of range although the allowed range is asymmetric and -26 is valid. Real-world encoders emit this value; the rejection aborted the slice and corrupted every picture of the affected IDR period (#531, thanks @th1nk3r-ing)
• Regression since v1.0.17: an out-of-range value in the advisory VUI fields (bitstream_restriction(), chroma_sample_loc_type_*) rejected the whole SPS, so HEIF images from some consumer encoders could not be decoded at all. These fields are never used in the decoding process; they are now clamped with a warning as in v1.0.16. Malformed exp-Golomb codes are still a hard error (#539)
• 16-bit decoding: the residual of 4x4 intra luma blocks (DST) was clipped to 16 bits although it needs 17 bits at bit depth 16, corrupting those blocks and everything intra-predicted from them. Output is now identical to the HM reference decoder; bit depths up to 15 were not affected (thanks @felixbuenemann)
• MSVC: the visibility attribute is only used with GCC and Clang, fixing the static build with MSVC (#525)
• CMake: building sherlock265 together with the library silently disabled the hidden symbol visibility introduced in v1.1.1. sherlock265 only uses exported symbols, so it no longer forces full visibility, and the configure output now states why symbols are hidden or exported. FORCE_FULL_VISIBILITY is documented in the README (#536)