From cb8d98b4ccb658ad9ff880d915ddfb8fb1834ae9 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 20 Oct 2026 15:10:36 +0200 Subject: [PATCH] avcodec/mpl2dec: do not read the event beyond the packet Fixes: a3ewdvDE2QSe Fixes: out of array read Out of array read Replicated through API with ASAN Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24659 Found-by: Marton Balint --- libavcodec/mpl2dec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavcodec/mpl2dec.c b/libavcodec/mpl2dec.c index 8639acf0b0..7c82a35ce9 100644 --- a/libavcodec/mpl2dec.c +++ b/libavcodec/mpl2dec.c @@ -28,6 +28,7 @@ #include "avcodec.h" #include "ass.h" #include "codec_internal.h" +#include "decode.h" #include "libavutil/bprint.h" static int mpl2_event_to_ass(AVBPrint *buf, const char *p) @@ -68,9 +69,12 @@ static int mpl2_decode_frame(AVCodecContext *avctx, AVSubtitle *sub, { int ret = 0; AVBPrint buf; - const char *ptr = avpkt->data; + const char *ptr = ff_decode_subtitle_text(avctx, avpkt); FFASSDecoderContext *s = avctx->priv_data; + if (avpkt->size > 0 && !ptr) + return AVERROR(ENOMEM); + av_bprint_init(&buf, 0, AV_BPRINT_SIZE_UNLIMITED); if (ptr && avpkt->size > 0 && *ptr && !mpl2_event_to_ass(&buf, ptr)) ret = ff_ass_add_rect(sub, buf.str, s->readorder++, 0, NULL, NULL);