sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avcodec/realtextdec: do not read the event beyond the packet

Browse Source 
Fixes: a3ewdvDE2QSe
Fixes: out of array read
Out of array read Replicated through API with ASAN
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24659

Found-by: Marton Balint <cus@passwd.hu>
This commit is contained in:
Michael Niedermayer
2026-10-20 15:10:36 +02:00
committed by michaelni
parent cb8d98b4cc
commit d26bc48f0b
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/realtextdec.c
View File

@@ -27,6 +27,7 @@
#include "avcodec.h"
#include "ass.h"
#include "codec_internal.h"
#include "decode.h"
#include "libavutil/avstring.h"
#include "libavutil/bprint.h"
@@ -60,10 +61,13 @@ static int realtext_decode_frame(AVCodecContext *avctx, AVSubtitle *sub,
int *got_sub_ptr, const AVPacket *avpkt)
{
int ret = 0;
const char *ptr = avpkt->data;
const char *ptr = ff_decode_subtitle_text(avctx, avpkt);
FFASSDecoderContext *s = avctx->priv_data;
AVBPrint buf;
if (avpkt->size > 0 && !ptr)
return AVERROR(ENOMEM);
av_bprint_init(&buf, 0, 4096);
if (ptr && avpkt->size > 0 && !rt_event_to_ass(&buf, ptr))
ret = ff_ass_add_rect(sub, buf.str, s->readorder++, 0, NULL, NULL);