dvdsub_decode() can call append_to_cached_buf() 2 times, the second time
with ctx->buf as argument. If the second append_to_cached_buf() reallocs
ctx->buf, the argument will be a pointer to the previous, freed block.
This can cause invalid reads at least with some fuzzed files - and
possibly with valid files.
Since packets can apparently not be larger than 64K (even if packets are
combined), just use a fixed size buffer. It will be allocated as part of
the DVDSubContext, and although some memory is "wasted", it's relatively
minimal by modern standards and should be acceptable.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
int has_palette;
uint8_t colormap[4];
uint8_t alpha[256];
int has_palette;
uint8_t colormap[4];
uint8_t alpha[256];
int buf_size;
int forced_subs_only;
#ifdef DEBUG
int buf_size;
int forced_subs_only;
#ifdef DEBUG
{
DVDSubContext *ctx = avctx->priv_data;
{
DVDSubContext *ctx = avctx->priv_data;
- if (ctx->buf_size > 0xffff - buf_size) {
+ if (ctx->buf_size >= sizeof(ctx->buf) - buf_size) {
av_log(avctx, AV_LOG_WARNING, "Attempt to reconstruct "
"too large SPU packets aborted.\n");
av_log(avctx, AV_LOG_WARNING, "Attempt to reconstruct "
"too large SPU packets aborted.\n");
return AVERROR_INVALIDDATA;
}
return AVERROR_INVALIDDATA;
}
- ctx->buf = av_realloc(ctx->buf, ctx->buf_size + buf_size);
- if (!ctx->buf)
- return AVERROR(ENOMEM);
memcpy(ctx->buf + ctx->buf_size, buf, buf_size);
ctx->buf_size += buf_size;
return 0;
memcpy(ctx->buf + ctx->buf_size, buf, buf_size);
ctx->buf_size += buf_size;
return 0;
AVSubtitle *sub = data;
int is_menu;
AVSubtitle *sub = data;
int is_menu;
int ret = append_to_cached_buf(avctx, buf, buf_size);
if (ret < 0) {
*data_size = 0;
int ret = append_to_cached_buf(avctx, buf, buf_size);
if (ret < 0) {
*data_size = 0;
ctx->buf_size = 0;
*data_size = 1;
return buf_size;
ctx->buf_size = 0;
*data_size = 1;
return buf_size;
static av_cold int dvdsub_close(AVCodecContext *avctx)
{
DVDSubContext *ctx = avctx->priv_data;
static av_cold int dvdsub_close(AVCodecContext *avctx)
{
DVDSubContext *ctx = avctx->priv_data;
ctx->buf_size = 0;
return 0;
}
ctx->buf_size = 0;
return 0;
}