mirror of
https://github.com/mpv-player/mpv
synced 2025-03-11 08:37:59 +00:00
f3c1dcf7a1
Essentially the same as d1d2370d073e9b70a181696e57075545b4802517 except for clear_rgba_overlay. From some empirical testing, the s->x1 value is either 0 or SLICE_W (256). In the case where it is 256 and s->x0 is 0, then it writes memory. For most slices, this is fine. However for the very last slice in the loop, it is possible for the width here to exceed the total width of the line (p->w). If that occurs, the memset triggers a buffer overflow. This last case needs to be guarded in the same way as the previously mentioned commit (total width - SLICE_W * x) and with MPMIN in case s->x1 is 0 here to preserve the old behavior. It's unknown if anything other than dmabuf-wayland can possibly hit this, but it's definitely a problem within mp_draw_sub_overlay itself. |
||
|---|---|---|
| .. | ||
| ass_mp.c | ||
| ass_mp.h | ||
| dec_sub.c | ||
| dec_sub.h | ||
| draw_bmp.c | ||
| draw_bmp.h | ||
| filter_jsre.c | ||
| filter_regex.c | ||
| filter_sdh.c | ||
| img_convert.c | ||
| img_convert.h | ||
| lavc_conv.c | ||
| osd_font.otf | ||
| osd_libass.c | ||
| osd_state.h | ||
| osd.c | ||
| osd.h | ||
| sd_ass.c | ||
| sd_lavc.c | ||
| sd.h | ||