[libbluray-devel] [Git][videolan/libbluray][master] 6 commits: mpls_parse: fix NULL dereference in subpath cleanup

[Petri Hintukainen (@hpi)]

Petri Hintukainen pushed to branch master at VideoLAN / libbluray


Commits:
ea2abbbb by Petri Hintukainen at 2026-08-05T19:25:59+03:00
mpls_parse: fix NULL dereference in subpath cleanup

Could be triggered only after failed calloc()

- - - - -
c43cb8be by Petri Hintukainen at 2026-08-05T19:29:37+03:00
hdmv_vm: avoid UB in shifts

- - - - -
d4eedb2b by Petri Hintukainen at 2026-08-05T19:38:14+03:00
Check buffer content size before memcmp()

Avoid false matches.
There was no buffer overread (buffer is always 256 bytes or larger).

- - - - -
a15ed91b by Petri Hintukainen at 2026-08-05T19:45:30+03:00
DSMCCObject: fix unload condition

- - - - -
5bf465d4 by Petri Hintukainen at 2026-08-05T19:57:47+03:00
EventManager: make constructor protected

As in DVB specifications

- - - - -
eb96f039 by Petri Hintukainen at 2026-08-05T19:58:58+03:00
sound_parse: use 64-bit arithmetic for sound data offsets

- - - - -


6 changed files:

- src/libbluray/bdj/java/org/dvb/dsmcc/DSMCCObject.java
- src/libbluray/bdj/java/org/dvb/event/EventManager.java
- src/libbluray/bdnav/mpls_parse.c
- src/libbluray/bdnav/sound_parse.c
- src/libbluray/decoders/graphics_processor.c
- src/libbluray/hdmv/hdmv_vm.c


Changes:

=====================================
src/libbluray/bdj/java/org/dvb/dsmcc/DSMCCObject.java
=====================================
@@ -99,7 +99,7 @@ public class DSMCCObject extends File {
     }
 
     public void unload() throws NotLoadedException {
-        if (loaded)
+        if (!loaded)
             throw new NotLoadedException();
 
         loaded = false;


=====================================
src/libbluray/bdj/java/org/dvb/event/EventManager.java
=====================================
@@ -37,6 +37,9 @@ public class EventManager implements ResourceServer {
 
     private static final Object instanceLock = new Object();
 
+    protected EventManager() {
+    }
+
     public static EventManager getInstance() {
         synchronized (instanceLock) {
             if (instance == null)


=====================================
src/libbluray/bdnav/mpls_parse.c
=====================================
@@ -681,10 +681,12 @@ _clean_subpath(MPLS_SUB *sp)
 {
     int ii;
 
-    for (ii = 0; ii < sp->sub_playitem_count; ii++) {
-        _clean_subplayitem(&sp->sub_play_item[ii]);
+    if (sp->sub_play_item != NULL) {
+        for (ii = 0; ii < sp->sub_playitem_count; ii++) {
+            _clean_subplayitem(&sp->sub_play_item[ii]);
+        }
+        X_FREE(sp->sub_play_item);
     }
-    X_FREE(sp->sub_play_item);
 }
 
 static int


=====================================
src/libbluray/bdnav/sound_parse.c
=====================================
@@ -197,7 +197,7 @@ static SOUND_DATA *_sound_parse(BD_FILE_H *fp)
 
     for (i = 0; i < data->num_sounds; i++) {
 
-        if (bs_seek_byte(&bs, data_start + data_offsets[i]) < 0) {
+        if (bs_seek_byte(&bs, (int64_t)data_start + data_offsets[i]) < 0) {
             BD_DEBUG(DBG_NAV | DBG_CRIT, "error reading samples for sound %d\n", i);
             data->sounds[i].num_frames = 0;
             continue;


=====================================
src/libbluray/decoders/graphics_processor.c
=====================================
@@ -102,7 +102,7 @@ static PES_BUFFER *_find_segment_by_idv(PES_BUFFER *p,
                                         uint8_t seg_type, unsigned idv_pos,
                                         uint8_t *idv, unsigned idv_len)
 {
-    while (p && (p->buf[0] != seg_type || memcmp(p->buf + idv_pos, idv, idv_len))) {
+    while (p && (p->buf[0] != seg_type || p->len < idv_pos + idv_len || memcmp(p->buf + idv_pos, idv, idv_len))) {
         p = p->next;
     }
     return p;


=====================================
src/libbluray/hdmv/hdmv_vm.c
=====================================
@@ -1169,10 +1169,10 @@ static int _hdmv_step(HDMV_VM *p)
                         case INSN_AND:    dst &= src;         break;
                         case INSN_OR:     dst |= src;         break;
                         case INSN_XOR:    dst ^= src;         break;
-                        case INSN_BITSET: dst |=  (1 << src); break;
-                        case INSN_BITCLR: dst &= ~(1 << src); break;
-                        case INSN_SHL:    dst <<= src;        break;
-                        case INSN_SHR:    dst >>= src;        break;
+                        case INSN_BITSET: if (src < 32) dst |=  (1 << src); break;
+                        case INSN_BITCLR: if (src < 32) dst &= ~(1 << src); break;
+                        case INSN_SHL:    if (src < 32) dst <<= src; else dst = 0; break;
+                        case INSN_SHR:    if (src < 32) dst >>= src; else dst = 0; break;
                         default:
                             BD_DEBUG(DBG_HDMV|DBG_CRIT, "unknown SET option %d in opcode 0x%08x\n",
                                      insn->set_opt, *(uint32_t*)insn);



View it on GitLab: https://code.videolan.org/videolan/libbluray/-/compare/bf835c49ae2ead6f3c46bda3cd9fa1e268ae4940...eb96f03937d35bf9d91a2866f81926a12a7b648f

-- 
View it on GitLab: https://code.videolan.org/videolan/libbluray/-/compare/bf835c49ae2ead6f3c46bda3cd9fa1e268ae4940...eb96f03937d35bf9d91a2866f81926a12a7b648f
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help