diff mbox series

[FFmpeg-devel,5/8] avcodec/subviewerdec: do not overread if zero padding is missing

Message ID 20210313213345.3268-5-cus@passwd.hu
State New
Headers show
Series [FFmpeg-devel,1/8] avcodec/assdec: do not overread if zero padding is missing | expand

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Marton Balint March 13, 2021, 9:33 p.m. UTC 
Signed-off-by: Marton Balint <cus@passwd.hu>
---
 libavcodec/subviewerdec.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/libavcodec/subviewerdec.c b/libavcodec/subviewerdec.c
index 805c7dd547..1016ac7ada 100644
--- a/libavcodec/subviewerdec.c
+++ b/libavcodec/subviewerdec.c
@@ -28,10 +28,10 @@ 
 #include "ass.h"
 #include "libavutil/bprint.h"
 
-static int subviewer_event_to_ass(AVBPrint *buf, const char *p)
+static int subviewer_event_to_ass(AVBPrint *buf, const char *p, const char *pend)
 {
-    while (*p) {
-        if (!strncmp(p, "[br]", 4)) {
+    while (p < pend && *p) {
+        if (pend - p >= 4 && !strncmp(p, "[br]", 4)) {
             av_bprintf(buf, "\\N");
             p += 4;
         } else {
@@ -56,7 +56,7 @@  static int subviewer_decode_frame(AVCodecContext *avctx,
     AVBPrint buf;
 
     av_bprint_init(&buf, 0, AV_BPRINT_SIZE_UNLIMITED);
-    if (ptr && avpkt->size > 0 && !subviewer_event_to_ass(&buf, ptr))
+    if (ptr && avpkt->size > 0 && !subviewer_event_to_ass(&buf, ptr, ptr + avpkt->size))
         ret = ff_ass_add_rect(sub, buf.str, s->readorder++, 0, NULL, NULL);
     av_bprint_finalize(&buf, NULL);
     if (ret < 0)