RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge commit '5c30ae1a09b66179e16694f6137658023ed1fef3' 

* commit '5c30ae1a09b66179e16694f6137658023ed1fef3':
  dvdsubdec: Validate the RLE offsets

  Conflicts:
      libavcodec/dvdsubdec.c

Merged-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
This commit is contained in:
Derek Buitenhuis 2015-11-22 17:15:21 +00:00
parent df8e24be5d 5c30ae1a09
commit cde68661bf
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/dvdsubdec.c
View File

@ -220,7 +220,7 @@ static void reset_rects(AVSubtitle *sub_header)
static int decode_dvd_subtitles(DVDSubContext *ctx, AVSubtitle *sub_header,
const uint8_t *buf, int buf_size)
{
int cmd_pos, pos, cmd, x1, y1, x2, y2, offset1, offset2, next_cmd_pos;
int cmd_pos, pos, cmd, x1, y1, x2, y2, next_cmd_pos;
int big_offsets, offset_size, is_8bit = 0;
const uint8_t *yuv_palette = NULL;
uint8_t *colormap = ctx->colormap, *alpha = ctx->alpha;
@ -228,6 +228,7 @@ static int decode_dvd_subtitles(DVDSubContext *ctx, AVSubtitle *sub_header,
int i;
int is_menu = 0;
uint32_t size;
int64_t offset1, offset2;
if (buf_size < 10)
return -1;
@ -353,6 +354,9 @@ static int decode_dvd_subtitles(DVDSubContext *ctx, AVSubtitle *sub_header,
}
}
the_end:
if (offset1 >= buf_size || offset2 >= buf_size)
goto fail;
if (offset1 >= 0 && offset2 >= 0) {
int w, h;
uint8_t *bitmap;