From c0d9327a63db2b7f15783b59488a480e5d9d6d56 Mon Sep 17 00:00:00 2001
From: rcombs <rcombs@rcombs.me>
Date: Wed, 8 Mar 2023 15:33:24 -0600
Subject: [PATCH] lavc/ass: error if not passed exactly 1 rect

This never produced valid output.
---
 libavcodec/assenc.c | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/libavcodec/assenc.c b/libavcodec/assenc.c
index db6fd25dd7..e548b9fd3b 100644
--- a/libavcodec/assenc.c
+++ b/libavcodec/assenc.c
@@ -45,27 +45,26 @@ static int ass_encode_frame(AVCodecContext *avctx,
                             unsigned char *buf, int bufsize,
                             const AVSubtitle *sub)
 {
-    int i, len, total_len = 0;
+    int len;
 
-    for (i=0; i<sub->num_rects; i++) {
-        const char *ass = sub->rects[i]->ass;
-
-        if (sub->rects[i]->type != SUBTITLE_ASS) {
-            av_log(avctx, AV_LOG_ERROR, "Only SUBTITLE_ASS type supported.\n");
-            return AVERROR(EINVAL);
-        }
-
-        len = av_strlcpy(buf+total_len, ass, bufsize-total_len);
-
-        if (len > bufsize-total_len-1) {
-            av_log(avctx, AV_LOG_ERROR, "Buffer too small for ASS event.\n");
-            return AVERROR_BUFFER_TOO_SMALL;
-        }
-
-        total_len += len;
+    if (sub->num_rects != 1) {
+        av_log(avctx, AV_LOG_ERROR, "Only one rect per AVSubtitle is supported in ASS.\n");
+        return AVERROR_INVALIDDATA;
     }
 
-    return total_len;
+    if (sub->rects[0]->type != SUBTITLE_ASS) {
+        av_log(avctx, AV_LOG_ERROR, "Only SUBTITLE_ASS type supported.\n");
+        return AVERROR(EINVAL);
+    }
+
+    len = av_strlcpy(buf, sub->rects[0]->ass, bufsize);
+
+    if (len > bufsize - 1) {
+        av_log(avctx, AV_LOG_ERROR, "Buffer too small for ASS event.\n");
+        return AVERROR_BUFFER_TOO_SMALL;
+    }
+
+    return len;
 }
 
 #if CONFIG_SSA_ENCODER