sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avcodec/mpl2dec: do not read the event beyond the packet

Browse Source 
Fixes: a3ewdvDE2QSe
Fixes: out of array read
Out of array read Replicated through API with ASAN
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24659

Found-by: Marton Balint <cus@passwd.hu>
This commit is contained in:
Michael Niedermayer
2026-10-20 15:10:36 +02:00
committed by michaelni
parent 7de69e952c
commit cb8d98b4cc
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/mpl2dec.c
View File

@@ -28,6 +28,7 @@
#include "avcodec.h"
#include "ass.h"
#include "codec_internal.h"
#include "decode.h"
#include "libavutil/bprint.h"
static int mpl2_event_to_ass(AVBPrint *buf, const char *p)
@@ -68,9 +69,12 @@ static int mpl2_decode_frame(AVCodecContext *avctx, AVSubtitle *sub,
{
int ret = 0;
AVBPrint buf;
const char *ptr = avpkt->data;
const char *ptr = ff_decode_subtitle_text(avctx, avpkt);
FFASSDecoderContext *s = avctx->priv_data;
if (avpkt->size > 0 && !ptr)
return AVERROR(ENOMEM);
av_bprint_init(&buf, 0, AV_BPRINT_SIZE_UNLIMITED);
if (ptr && avpkt->size > 0 && *ptr && !mpl2_event_to_ass(&buf, ptr))
ret = ff_ass_add_rect(sub, buf.str, s->readorder++, 0, NULL, NULL);