[libbluray-devel] [Git][videolan/libbluray][master] 3 commits: graphics_processor: Fix OOB write on invalid input

[Petri Hintukainen (@hpi)]

Petri Hintukainen pushed to branch master at VideoLAN / libbluray


Commits:
864cd2f6 by Petri Hintukainen at 2026-08-05T18:36:03+03:00
graphics_processor: Fix OOB write on invalid input

Too small buffer size resulted in integer overflow when calculating
size of segment data.

Reported-by: Dominik Riedweg <domi.riedweg at gmail.com>

- - - - -
b30174dd by Petri Hintukainen at 2026-08-05T19:12:48+03:00
graphics_processor: skip too short segments

Sequence descriptor must be present

- - - - -
bf835c49 by Petri Hintukainen at 2026-08-05T19:20:32+03:00
m2ts_demux: Fix possible buffer overread when parsig PTS/DTS

Overread possible if ts payload_offset is near packet end.

- - - - -


2 changed files:

- src/libbluray/decoders/graphics_processor.c
- src/libbluray/decoders/m2ts_demux.c


Changes:

=====================================
src/libbluray/decoders/graphics_processor.c
=====================================
@@ -159,9 +159,15 @@ static int _join_segment_fragments(struct pes_buffer_s *p)
 
     /* check sequence descriptor - is segment complete ? */
 
+    if (p->len < sd_pos + 1) {
+        /* invalid, incomplete header */
+        BD_DEBUG(DBG_DECODE|DBG_CRIT, "Missing header in segment 0x%02x, len=%u\n", type, p->len);
+        return 1;
+    }
+
     BD_PG_SEQUENCE_DESCRIPTOR sd;
     BITBUFFER bb;
-    bb_init(&bb, p->buf + sd_pos, 3);
+    bb_init(&bb, p->buf + sd_pos, 1);
     pg_decode_sequence_descriptor(&bb, &sd);
 
     if (sd.last_in_seq) {
@@ -176,10 +182,19 @@ static int _join_segment_fragments(struct pes_buffer_s *p)
     PES_BUFFER *next;
     while (NULL != (next = _find_segment_by_idv(p->next, p->buf[0], id_pos, p->buf + id_pos, id_len))) {
 
-        bb_init(&bb, next->buf + sd_pos, 3);
+        if (next->len < sd_pos + 1) {
+            /* invalid, incomplete header */
+            BD_DEBUG(DBG_DECODE|DBG_CRIT, "Missing header in segment 0x%02x, len=%u\n", type, next->len);
+            pes_buffer_remove(&p, next);
+            continue;
+        }
+
+        bb_init(&bb, next->buf + sd_pos, 1);
         pg_decode_sequence_descriptor(&bb, &sd);
 
-        _join_fragments(p, next, data_pos);
+        if (next->len > data_pos /* at least one byte of payload */) {
+            _join_fragments(p, next, data_pos);
+        }
 
         pes_buffer_remove(&p, next);
 


=====================================
src/libbluray/decoders/m2ts_demux.c
=====================================
@@ -180,9 +180,17 @@ static int _parse_pes(PES_BUFFER *p, uint8_t *buf, unsigned len)
         }
 
         if (pts_exists) {
+            if (hdr_len < 14) {
+                BD_DEBUG(DBG_DECODE, "invalid BDAV TS (PES header too short for PTS)\n");
+                return -1;
+            }
             p->pts = _parse_timestamp(buf + 9);
         }
         if (dts_exists) {
+            if (hdr_len < 19) {
+                BD_DEBUG(DBG_DECODE, "invalid BDAV TS (PES header too short for DTS)\n");
+                return -1;
+            }
             p->dts = _parse_timestamp(buf + 14);
         }
     }



View it on GitLab: https://code.videolan.org/videolan/libbluray/-/compare/d75c88e54c893e5cbf4c61d356477655eb435769...bf835c49ae2ead6f3c46bda3cd9fa1e268ae4940

-- 
View it on GitLab: https://code.videolan.org/videolan/libbluray/-/compare/d75c88e54c893e5cbf4c61d356477655eb435769...bf835c49ae2ead6f3c46bda3cd9fa1e268ae4940
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help