[libdvdnav-devel] [Git][videolan/libdvdread][master] 3 commits: ifo_read: avoid potential large/negative info_length from read data

[Jean-Baptiste Kempf (@jbk)]

Jean-Baptiste Kempf pushed to branch master at VideoLAN / libdvdread


Commits:
636a8e2c by Steve Lhomme at 2026-08-14T11:14:21+02:00
ifo_read: avoid potential large/negative info_length from read data

- - - - -
2b76ed36 by Steve Lhomme at 2026-08-14T11:14:21+02:00
ifo_read: remove redundant test

info_length is nr_of_pgci_srp * PGCI_SRP_SIZE
and we already checked nr_of_pgci_srp is not 0.

- - - - -
09530764 by Steve Lhomme at 2026-08-14T11:14:21+02:00
ifo_read: issue an error if the VOBU_ADMAP last_byte is too small

We cannot parse the data.

- - - - -


1 changed file:

- src/ifo_read.c


Changes:

=====================================
src/ifo_read.c
=====================================
@@ -2363,7 +2363,7 @@ int ifoRead_TT_SRPT(ifo_handle_t *ifofile) {
   struct ifo_handle_private_s *ifop = PRIV(ifofile);
   tt_srpt_t *tt_srpt;
   unsigned int i;
-  size_t info_length;
+  size_t info_length = 0;
 
   if(!ifofile)
     return 0;
@@ -2396,7 +2396,8 @@ int ifoRead_TT_SRPT(ifo_handle_t *ifofile) {
   if(tt_srpt->last_byte == 0) {
     tt_srpt->last_byte = tt_srpt->nr_of_srpts * sizeof(title_info_t) - 1 + TT_SRPT_SIZE;
   }
-  info_length = tt_srpt->last_byte + 1 - TT_SRPT_SIZE;
+  if(tt_srpt->last_byte >= TT_SRPT_SIZE - 1)
+    info_length = tt_srpt->last_byte + 1 - TT_SRPT_SIZE;
 
   tt_srpt->title = calloc(1, info_length);
   if(!tt_srpt->title) {
@@ -2476,7 +2477,7 @@ void ifoFree_TT_SRPT(ifo_handle_t *ifofile) {
 int ifoRead_VTS_PTT_SRPT(ifo_handle_t *ifofile) {
   struct ifo_handle_private_s *ifop = PRIV(ifofile);
   vts_ptt_srpt_t *vts_ptt_srpt = NULL;
-  int info_length, i, j;
+  int info_length = 0, i, j;
   uint32_t *data = NULL;
 
   if(!ifofile)
@@ -2515,7 +2516,8 @@ int ifoRead_VTS_PTT_SRPT(ifo_handle_t *ifofile) {
   if(vts_ptt_srpt->last_byte == 0) {
     vts_ptt_srpt->last_byte  = vts_ptt_srpt->nr_of_srpts * sizeof(*data) - 1 + VTS_PTT_SRPT_SIZE;
   }
-  info_length = vts_ptt_srpt->last_byte + 1 - VTS_PTT_SRPT_SIZE;
+  if(vts_ptt_srpt->last_byte >= VTS_PTT_SRPT_SIZE - 1)
+    info_length = vts_ptt_srpt->last_byte + 1 - VTS_PTT_SRPT_SIZE;
   data = calloc(1, info_length);
   if(!data)
     goto fail;
@@ -3117,7 +3119,7 @@ static int ifoRead_VOBU_ADMAP_internal(ifo_handle_t *ifofile,
                                        unsigned int sector) {
   struct ifo_handle_private_s *ifop = PRIV(ifofile);
   unsigned int i;
-  int info_length;
+  size_t info_length = 0;
 
   if(!DVDFileSeekForce_(ifop->file, sector * DVD_BLOCK_LEN, sector))
     return 0;
@@ -3127,7 +3129,13 @@ static int ifoRead_VOBU_ADMAP_internal(ifo_handle_t *ifofile,
 
   B2N_32(vobu_admap->last_byte);
 
-  info_length = vobu_admap->last_byte + 1 - VOBU_ADMAP_SIZE;
+  if(vobu_admap->last_byte >= VOBU_ADMAP_SIZE - 1)
+    info_length = vobu_admap->last_byte + 1 - VOBU_ADMAP_SIZE;
+  else {
+    Log0(ifop->ctx, "VOBU_ADMAP last_byte too small in %s:%i %" PRIu32,
+         __FILE__, __LINE__, vobu_admap->last_byte );
+    return 0;
+  }
   /* assert(info_length > 0);
      Magic Knight Rayearth Daybreak is mastered very strange and has
      Titles with a VOBS that has no VOBUs. */
@@ -3242,7 +3250,7 @@ static int ifoRead_PGCIT_internal(ifo_handle_t *ifofile, pgcit_t *pgcit,
   if(!data)
     return 0;
 
-  if(info_length && !(DVDReadBytes(ifop->file, data, info_length))) {
+  if(!(DVDReadBytes(ifop->file, data, info_length))) {
     free(data);
     return 0;
   }



View it on GitLab: https://code.videolan.org/videolan/libdvdread/-/compare/4127ab3198a2a3467206f904ec0d23509becabee...09530764823f3fb5b9ab32b80e4620438c1eed53

-- 
View it on GitLab: https://code.videolan.org/videolan/libdvdread/-/compare/4127ab3198a2a3467206f904ec0d23509becabee...09530764823f3fb5b9ab32b80e4620438c1eed53
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help