diff options
| author | John Stebbins <[email protected]> | 2019-04-04 16:49:37 -0600 |
|---|---|---|
| committer | John Stebbins <[email protected]> | 2019-04-04 16:49:37 -0600 |
| commit | 10ca6f0f9d0a68de3df03203e561b76b0343dbd4 (patch) | |
| tree | 731142490af055d6a2b69578e3c2f82fa98327d5 /libhb/decvobsub.c | |
| parent | e67db75db08e4cbef260b851a7cdcb649039ad45 (diff) | |
decvobsub: fix crash due to malformed vobsub
Check that a runlength does not exceed the width of a line
Diffstat (limited to 'libhb/decvobsub.c')
| -rw-r--r-- | libhb/decvobsub.c | 24 |
1 files changed, 14 insertions, 10 deletions
diff --git a/libhb/decvobsub.c b/libhb/decvobsub.c index a78f7a303..77398d188 100644 --- a/libhb/decvobsub.c +++ b/libhb/decvobsub.c @@ -678,6 +678,7 @@ static hb_buffer_t * Decode( hb_work_object_t * w ) for( col = 0; col < pv->width; col += code >> 2 ) { uint8_t * lum, * alpha, * chromaU, * chromaV; + int idx, len; code = 0; GET_NEXT_NIBBLE; @@ -699,19 +700,22 @@ static hb_buffer_t * Decode( hb_work_object_t * w ) } } - lum = buf_raw; - alpha = lum + pv->width * pv->height; + lum = buf_raw; + alpha = lum + pv->width * pv->height; chromaU = alpha + pv->width * pv->height; chromaV = chromaU + pv->width * pv->height; + idx = code & 3; + len = code >> 2; + // Protect against malformed VOBSUB with invalid run length + if (len > pv->width - col) + { + len = pv->width - col; + } - memset( lum + line * pv->width + col, - pv->lum[code & 3], code >> 2 ); - memset( alpha + line * pv->width + col, - pv->alpha[code & 3], code >> 2 ); - memset( chromaU + line * pv->width + col, - pv->chromaU[code & 3], code >> 2 ); - memset( chromaV + line * pv->width + col, - pv->chromaV[code & 3], code >> 2 ); + memset( lum + line * pv->width + col, pv->lum[idx], len ); + memset( alpha + line * pv->width + col, pv->alpha[idx], len ); + memset( chromaU + line * pv->width + col, pv->chromaU[idx], len ); + memset( chromaV + line * pv->width + col, pv->chromaV[idx], len ); } /* Byte-align */ |