From d26bc48f0b79b47eec230b610dec293fefd8e028 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 20 Oct 2026 15:10:36 +0200 Subject: [PATCH] avcodec/realtextdec: do not read the event beyond the packet Fixes: a3ewdvDE2QSe Fixes: out of array read Out of array read Replicated through API with ASAN Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24659 Found-by: Marton Balint --- libavcodec/realtextdec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavcodec/realtextdec.c b/libavcodec/realtextdec.c index b09ff78ea4..5c41a5a00d 100644 --- a/libavcodec/realtextdec.c +++ b/libavcodec/realtextdec.c @@ -27,6 +27,7 @@ #include "avcodec.h" #include "ass.h" #include "codec_internal.h" +#include "decode.h" #include "libavutil/avstring.h" #include "libavutil/bprint.h" @@ -60,10 +61,13 @@ static int realtext_decode_frame(AVCodecContext *avctx, AVSubtitle *sub, int *got_sub_ptr, const AVPacket *avpkt) { int ret = 0; - const char *ptr = avpkt->data; + const char *ptr = ff_decode_subtitle_text(avctx, avpkt); FFASSDecoderContext *s = avctx->priv_data; AVBPrint buf; + if (avpkt->size > 0 && !ptr) + return AVERROR(ENOMEM); + av_bprint_init(&buf, 0, 4096); if (ptr && avpkt->size > 0 && !rt_event_to_ass(&buf, ptr)) ret = ff_ass_add_rect(sub, buf.str, s->readorder++, 0, NULL, NULL);