[vlc-commits] codec: substx3g: fix oob read

[Francois Cartegnie]

vlc/vlc-2.2 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Tue Jan  2 16:47:21 2018 +0100| [4473401a1c4724028f8cc733da9b149cacd0ff62] | committer: Francois Cartegnie

codec: substx3g: fix oob read

a38f6756ed57188ca1ed7def63ee7672412316bd backport

> http://git.videolan.org/gitweb.cgi/vlc/vlc-2.2.git/?a=commit;h=4473401a1c4724028f8cc733da9b149cacd0ff62
---

 modules/codec/substx3g.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/codec/substx3g.c b/modules/codec/substx3g.c
index cce24918a8..db61583093 100644
--- a/modules/codec/substx3g.c
+++ b/modules/codec/substx3g.c
@@ -257,6 +257,12 @@ static subpicture_t *Decode( decoder_t *p_dec, block_t **pp_block )
 
     /* Read our raw string and create the styled segment for HTML */
     uint16_t i_psz_bytelength = GetWBE( p_buf );
+    if( p_block->i_buffer < i_psz_bytelength + 2U )
+    {
+        block_Release( p_block );
+        return VLCDEC_SUCCESS;
+    }
+
     const uint8_t *p_pszstart = p_block->p_buffer + sizeof(uint16_t);
     char *psz_subtitle;
     if ( i_psz_bytelength > 2 &&