diff --git a/libavcodec/movtextdec.c b/libavcodec/movtextdec.c index 52668e2ff7..a65bbb83e3 100644 --- a/libavcodec/movtextdec.c +++ b/libavcodec/movtextdec.c @@ -65,8 +65,18 @@ static int mov_text_decode_frame(AVCodecContext *avctx, const char *ptr = avpkt->data; const char *end; - if (!ptr || avpkt->size <= 2) - return avpkt->size ? AVERROR_INVALIDDATA : 0; + if (!ptr || avpkt->size < 2) + return AVERROR_INVALIDDATA; + + /* + * A packet of size two with value zero is an empty subtitle + * used to mark the end of the previous non-empty subtitle. + * We can just drop them here as we have duration information + * already. If the value is non-zero, then it's technically a + * bad packet. + */ + if (avpkt->size == 2) + return AV_RB16(ptr) == 0 ? 0 : AVERROR_INVALIDDATA; /* * The first two bytes of the packet are the length of the text string