virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-28 20:53:54 +02:00
Code Issues Releases Activity

avcodec/dvdsubdec: reject some broken packets

Browse Source 
If cmd_pos is broken, this would just keep accumulating packets in the
reassembly buffer, until it fails and flushes the buffer on overflow.
Since packets are usually rather small, this will take a lot of subtitle
packets. The perceived effect is that subtitles are not displayed
anymore after the faulty packet was passed to the decoder.

I'm not terribly sure about this, but on the other hand this code is
active only when fragmented packets need to be reassembled.

Fixes sample file in trac issue #4872.
This commit is contained in:
wm4 2015-09-21 18:22:35 +02:00
parent f874e2728b
commit 9aab222239
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/dvdsubdec.c
View File

@ -227,6 +227,7 @@ static int decode_dvd_subtitles(DVDSubContext *ctx, AVSubtitle *sub_header,
int date;
int i;
int is_menu = 0;
uint32_t size;
if (buf_size < 10)
return -1;
@ -241,10 +242,16 @@ static int decode_dvd_subtitles(DVDSubContext *ctx, AVSubtitle *sub_header,
cmd_pos = 2;
}
size = READ_OFFSET(buf + (big_offsets ? 2 : 0));
cmd_pos = READ_OFFSET(buf + cmd_pos);
if (cmd_pos < 0 || cmd_pos > buf_size - 2 - offset_size)
if (cmd_pos < 0 || cmd_pos > buf_size - 2 - offset_size) {
if (cmd_pos > size) {
av_log(ctx, AV_LOG_ERROR, "Discarding invalid packet\n");
return 0;
}
return AVERROR(EAGAIN);
}
while (cmd_pos > 0 && cmd_pos < buf_size - 2 - offset_size) {
date = AV_RB16(buf + cmd_pos);