From 2fca0a73eae79a489fe00ce4391078b35cb83d95 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 20 Oct 2026 15:10:36 +0200 Subject: [PATCH] avcodec/webvttdec: do not read the event beyond the packet Fixes: a3ewdvDE2QSe Fixes: out of array read Out of array read Replicated through API with ASAN Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24659 Found-by: Marton Balint --- libavcodec/webvttdec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavcodec/webvttdec.c b/libavcodec/webvttdec.c index 5968359edd..4eabb0de48 100644 --- a/libavcodec/webvttdec.c +++ b/libavcodec/webvttdec.c @@ -28,6 +28,7 @@ #include "avcodec.h" #include "ass.h" #include "codec_internal.h" +#include "decode.h" #include "libavutil/bprint.h" #include "libavutil/mathematics.h" @@ -184,7 +185,7 @@ static int webvtt_decode_frame(AVCodecContext *avctx, AVSubtitle *sub, int *got_sub_ptr, const AVPacket *avpkt) { int ret = 0; - const char *ptr = avpkt->data; + const char *ptr = ff_decode_subtitle_text(avctx, avpkt); FFASSDecoderContext *s = avctx->priv_data; AVBPrint buf; AVRational ms = { 1, 1000 }; @@ -199,6 +200,9 @@ static int webvtt_decode_frame(AVCodecContext *avctx, AVSubtitle *sub, end_ms = start_ms + av_rescale_q(avpkt->duration, avctx->pkt_timebase, ms); } + if (avpkt->size > 0 && !ptr) + return AVERROR(ENOMEM); + av_bprint_init(&buf, 0, AV_BPRINT_SIZE_UNLIMITED); if (ptr && avpkt->size > 0 && !webvtt_event_to_ass(&buf, ptr, start_ms, end_ms))