virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-04 22:03:09 +02:00
Code Issues Releases Activity

avcodec/dvbsubenc: Sanity check num_rects

Browse Source 
It is written as region_id which is a single byte.
Also fixes a potential (defined) overflow in the num_rects * 6
multiplication later; this has been found by 김승호 <kimsho98@naver.com>.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt
2025-04-16 10:23:01 +02:00
parent bad3f308d3
commit 3acc3b0b50
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
libavcodec/dvbsubenc.c
View File

@ -284,6 +284,9 @@ static int dvbsub_encode(AVCodecContext *avctx, uint8_t *outbuf, int buf_size,
if (h->num_rects && !h->rects) if (h->num_rects && !h->rects)
return AVERROR(EINVAL); return AVERROR(EINVAL);
if (h->num_rects >= 256)
return AVERROR(EINVAL);
if (avctx->width > 0 && avctx->height > 0) { if (avctx->width > 0 && avctx->height > 0) {
if (buf_size < 11) if (buf_size < 11)
return AVERROR_BUFFER_TOO_SMALL; return AVERROR_BUFFER_TOO_SMALL;