summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--libhb/decvobsub.c39
1 files changed, 37 insertions, 2 deletions
diff --git a/libhb/decvobsub.c b/libhb/decvobsub.c
index 510d4ac73..73401b9f3 100644
--- a/libhb/decvobsub.c
+++ b/libhb/decvobsub.c
@@ -218,7 +218,7 @@ hb_work_object_t hb_decvobsub =
* header), the width and height of the subpicture and the colors and
* alphas used in it
**********************************************************************/
-static void ParseControls( hb_work_object_t * w )
+static int ParseControls( hb_work_object_t * w )
{
hb_work_private_t * pv = w->private_data;
uint8_t * buf = pv->buf->data;
@@ -238,11 +238,20 @@ static void ParseControls( hb_work_object_t * w )
for( i = pv->size_rle; ; )
{
+ if ( i + 1 >= pv->buf->size )
+ {
+ return 1;
+ }
+
date = ( buf[i] << 8 ) | buf[i+1]; i += 2;
next = ( buf[i] << 8 ) | buf[i+1]; i += 2;
for( ;; )
{
+ if ( i >= pv->buf->size )
+ {
+ return 1;
+ }
command = buf[i++];
/*
@@ -292,6 +301,11 @@ static void ParseControls( hb_work_object_t * w )
int colors[4];
int j;
+ if ( i + 1 >= pv->buf->size )
+ {
+ return 1;
+ }
+
colors[0] = (buf[i+0]>>4)&0x0f;
colors[1] = (buf[i+0])&0x0f;
colors[2] = (buf[i+1]>>4)&0x0f;
@@ -335,6 +349,11 @@ static void ParseControls( hb_work_object_t * w )
*/
uint8_t alpha[4];
+ if ( i + 1 >= pv->buf->size )
+ {
+ return 1;
+ }
+
alpha[3] = ((buf[i+0] >> 4) & 0x0f) << 4;
alpha[2] = ((buf[i+0] ) & 0x0f) << 4;
alpha[1] = ((buf[i+1] >> 4) & 0x0f) << 4;
@@ -365,6 +384,11 @@ static void ParseControls( hb_work_object_t * w )
}
case 0x05: // 0x05 - SET_DAREA - defines the display area
{
+ if ( i + 4 >= pv->buf->size )
+ {
+ return 1;
+ }
+
pv->x = (buf[i+0]<<4) | ((buf[i+1]>>4)&0x0f);
pv->width = (((buf[i+1]&0x0f)<<8)| buf[i+2]) - pv->x + 1;
pv->y = (buf[i+3]<<4)| ((buf[i+4]>>4)&0x0f);
@@ -396,6 +420,8 @@ static void ParseControls( hb_work_object_t * w )
pv->pts_start = pv->pts;
pv->scr_sequence = pv->current_scr_sequence;
}
+
+ return 0;
}
/***********************************************************************
@@ -603,7 +629,16 @@ static hb_buffer_t * Decode( hb_work_object_t * w )
hb_job_t * job = pv->job;
/* Get infos about the subtitle */
- ParseControls( w );
+ if ( ParseControls( w ) )
+ {
+ /*
+ * Coudln't parse the info
+ */
+ hb_deep_log( 2, "decvobsub: Could not parse info!" );
+
+ hb_buffer_close( &pv->buf );
+ return NULL;
+ }
if( job->indepth_scan || ( w->subtitle->config.force && pv->pts_forced == 0 ) )
{