har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/xsubdec: Check parse_timecode()

Browse Source 
Fixes: CID1604490 Overflowed constant

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 96fd9417e250540f228d1ad5b43a77c120208eba)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-07-05 02:21:42 +02:00
parent 5fd805dfb4
commit 8cc5348df6
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/xsubdec.c
View File

@ -59,6 +59,7 @@ static int decode_frame(AVCodecContext *avctx, AVSubtitle *sub,
int64_t packet_time = 0; int64_t packet_time = 0;
GetBitContext gb; GetBitContext gb;
int has_alpha = avctx->codec_tag == MKTAG('D','X','S','A'); int has_alpha = avctx->codec_tag == MKTAG('D','X','S','A');
int64_t start_display_time, end_display_time;
// check that at least header fits // check that at least header fits
if (buf_size < 27 + 7 * 2 + 4 * (3 + has_alpha)) { if (buf_size < 27 + 7 * 2 + 4 * (3 + has_alpha)) {
@ -73,8 +74,14 @@ static int decode_frame(AVCodecContext *avctx, AVSubtitle *sub,
} }
if (avpkt->pts != AV_NOPTS_VALUE) if (avpkt->pts != AV_NOPTS_VALUE)
packet_time = av_rescale_q(avpkt->pts, AV_TIME_BASE_Q, (AVRational){1, 1000}); packet_time = av_rescale_q(avpkt->pts, AV_TIME_BASE_Q, (AVRational){1, 1000});
sub->start_display_time = parse_timecode(buf + 1, packet_time);
sub->end_display_time = parse_timecode(buf + 14, packet_time); sub->start_display_time = start_display_time = parse_timecode(buf + 1, packet_time);
sub->end_display_time = end_display_time = parse_timecode(buf + 14, packet_time);
if (sub->start_display_time != start_display_time ||
sub-> end_display_time != end_display_time) {
av_log(avctx, AV_LOG_ERROR, "time code not representable in 32bit\n");
return -1;
}
buf += 27; buf += 27;
// read header // read header