sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avcodec/webvttdec: do not read the event beyond the packet

Browse Source 
Fixes: a3ewdvDE2QSe
Fixes: out of array read
Out of array read Replicated through API with ASAN
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24659

Found-by: Marton Balint <cus@passwd.hu>
This commit is contained in:
Michael Niedermayer
2026-10-20 15:10:36 +02:00
committed by michaelni
parent a3d42f72a4
commit 2fca0a73ea
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/webvttdec.c
View File

@@ -28,6 +28,7 @@
#include "avcodec.h"
#include "ass.h"
#include "codec_internal.h"
#include "decode.h"
#include "libavutil/bprint.h"
#include "libavutil/mathematics.h"
@@ -184,7 +185,7 @@ static int webvtt_decode_frame(AVCodecContext *avctx, AVSubtitle *sub,
int *got_sub_ptr, const AVPacket *avpkt)
{
int ret = 0;
const char *ptr = avpkt->data;
const char *ptr = ff_decode_subtitle_text(avctx, avpkt);
FFASSDecoderContext *s = avctx->priv_data;
AVBPrint buf;
AVRational ms = { 1, 1000 };
@@ -199,6 +200,9 @@ static int webvtt_decode_frame(AVCodecContext *avctx, AVSubtitle *sub,
end_ms = start_ms + av_rescale_q(avpkt->duration, avctx->pkt_timebase, ms);
}
if (avpkt->size > 0 && !ptr)
return AVERROR(ENOMEM);
av_bprint_init(&buf, 0, AV_BPRINT_SIZE_UNLIMITED);
if (ptr && avpkt->size > 0 &&
!webvtt_event_to_ass(&buf, ptr, start_ms, end_ms))