diff mbox series

[FFmpeg-devel,4/6] avcodec/movtextenc: Fix encoding of subtitles with multiple rects

Message ID AM7PR03MB6660DBA5B21411E0A3454B288F679@AM7PR03MB6660.eurprd03.prod.outlook.com
State Accepted
Commit 0bc3c070fb516319f08d7264af27e3e123f45e95
Headers show
Series [FFmpeg-devel,1/6] avcodec/movtextenc: Fix infinite loop due to variable truncation
Related show

Checks

Context Check Description
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished
andriy/make_ppc success Make finished
andriy/make_fate_ppc success Make fate finished

Commit Message

Andreas Rheinhardt Nov. 30, 2021, 10:50 a.m. UTC
The format of a mov_text (3GPP Timed Text) sample is:

uint16_t text_length;
uint8_t  text[text_length];
TextSampleModifierBox text_modifier;

Yet in case our encoder receives an AVSubtitle with multiple
ASS AVSubtitleRects, it creates something like this:
uint16_t text_length;
uint8_t  text[text_length_1];
TextSampleModifierBox text_modifier_1;
uint8_t  text[text_length_2];
TextSampleModifierBox text_modifier_2;
...

where text_length is the sum of all the text_length_*.
This commit fixes this by writing the TextSampleModifierBoxes only
after all the rects have been written.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
 libavcodec/movtextenc.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)
diff mbox series

Patch

diff --git a/libavcodec/movtextenc.c b/libavcodec/movtextenc.c
index eecadaf503..52e51503d6 100644
--- a/libavcodec/movtextenc.c
+++ b/libavcodec/movtextenc.c
@@ -640,7 +640,6 @@  static int mov_text_encode_frame(AVCodecContext *avctx, unsigned char *buf,
     MovTextContext *s = avctx->priv_data;
     ASSDialog *dialog;
     int i, length;
-    size_t j;
 
     s->byte_count = 0;
     s->text_pos = 0;
@@ -661,10 +660,6 @@  static int mov_text_encode_frame(AVCodecContext *avctx, unsigned char *buf,
         mov_text_dialog(s, dialog);
         ff_ass_split_override_codes(&mov_text_callbacks, s, dialog->text);
         ff_ass_free_dialog(&dialog);
-
-        for (j = 0; j < box_count; j++) {
-            box_types[j].encode(s);
-        }
     }
 
     if (s->byte_count > UINT16_MAX)
@@ -672,6 +667,9 @@  static int mov_text_encode_frame(AVCodecContext *avctx, unsigned char *buf,
     AV_WB16(buf, s->byte_count);
     buf += 2;
 
+    for (size_t j = 0; j < box_count; j++)
+        box_types[j].encode(s);
+
     if (!av_bprint_is_complete(&s->buffer))
         return AVERROR(ENOMEM);