[vlc-commits] svcdsub: Fix potential buffer overrun

[Zinuo Han]

vlc | branch: master | Zinuo Han <ele7enxxh at gmail.com> | Mon Apr  1 11:44:26 2019 +0200| [3d2507c632003920484098e05fb21736a4c9956d] | committer: Hugo Beauzée-Luyssen

svcdsub: Fix potential buffer overrun

https://hackerone.com/reports/504722

Signed-off-by: Hugo Beauzée-Luyssen <hugo at beauzee.fr>

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=3d2507c632003920484098e05fb21736a4c9956d
---

 modules/codec/svcdsub.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/modules/codec/svcdsub.c b/modules/codec/svcdsub.c
index 8b91a68da3..d742692d64 100644
--- a/modules/codec/svcdsub.c
+++ b/modules/codec/svcdsub.c
@@ -366,17 +366,29 @@ static void ParseHeader( decoder_t *p_dec, block_t *p_block )
 {
     decoder_sys_t *p_sys = p_dec->p_sys;
     uint8_t *p = p_block->p_buffer;
+    size_t i_buffer = p_block->i_buffer;
     uint8_t i_options, i_cmd;
     int i;
 
+    if (i_buffer < 4) return;
+
     p_sys->i_spu_size = GETINT16(p);
     i_options  = *p++;
     // Skip over unused value
     p++;
 
-    if( i_options & 0x08 ) { p_sys->i_duration = FROM_SCALE_NZ(GetDWBE(p)); p += 4; }
+    i_buffer -= 4;
+
+    if( i_options & 0x08 ) {
+      if (i_buffer < 4) return;
+      p_sys->i_duration = FROM_SCALE_NZ(GetDWBE(p));
+      p += 4;
+      i_buffer -= 4;
+    }
     else p_sys->i_duration = 0; /* Ephemer subtitle */
 
+    if (i_buffer < 25) return;
+
     p_sys->i_x_start = GETINT16(p);
     p_sys->i_y_start = GETINT16(p);
     p_sys->i_width   = GETINT16(p);
@@ -391,12 +403,21 @@ static void ParseHeader( decoder_t *p_dec, block_t *p_block )
     }
 
     i_cmd = *p++;
+
+    i_buffer -= 25;
+
     /* We do not really know this, FIXME */
-    if( i_cmd ) { p += 4; }
+    if( i_cmd ) {
+      if (i_buffer < 4) return;
+      p += 4;
+      i_buffer -= 4;
+    }
 
     /* Actually, this is measured against a different origin, so we have to
      * adjust it */
+    if (i_buffer < 2) return;
     p_sys->second_field_offset = GETINT16(p);
+    i_buffer -= 2;
     p_sys->i_image_offset  = p - p_block->p_buffer;
     p_sys->i_image_length  = p_sys->i_spu_size - p_sys->i_image_offset;
     p_sys->metadata_length = p_sys->i_image_offset;