[vlc-commits] access: dvdread: check cell count

[Francois Cartegnie]

vlc/vlc-3.0 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Aug 16 15:59:09 2019 +0200| [36077b91f656d6e50b294537f1a5da8529d7bcd0] | committer: Francois Cartegnie

access: dvdread: check cell count

fixes crashes on seek when:
- both cell & vobu have sector 0
- seek sector is > of last cell start sector

(cherry picked from commit f48f84235ab784949c95e7c265a7c6f1ce753cb8)

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=36077b91f656d6e50b294537f1a5da8529d7bcd0
---

 modules/access/dvdread.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/modules/access/dvdread.c b/modules/access/dvdread.c
index c2f0e8fd4b..8e37f6d922 100644
--- a/modules/access/dvdread.c
+++ b/modules/access/dvdread.c
@@ -1133,12 +1133,16 @@ static void DvdReadSeek( demux_t *p_demux, int i_block_offset )
     }
 
 #if 1
-    int i_sub_cell = 0;
+    int i_sub_cell = 1;
     /* Find sub_cell */
-    while( p_vts->vts_c_adt->cell_adr_table[i_sub_cell].start_sector <
-           p_vts->vts_vobu_admap->vobu_start_sectors[i_vobu-1] )
+    /* need to check cell # <= vob count as cell table alloc only ensures:
+     * info_length / sizeof(cell_adr_t) < c_adt->nr_of_vobs, see ifo_read.c */
+    const uint32_t vobu_start_sector = p_vts->vts_vobu_admap->vobu_start_sectors[i_vobu-1];
+    for( int i = 0; i<p_vts->vts_c_adt->nr_of_vobs; i++ )
     {
-        i_sub_cell++;
+        const cell_adr_t *p_cell = &p_vts->vts_c_adt->cell_adr_table[i];
+        if(p_cell->start_sector <= vobu_start_sector)
+           i_sub_cell = i + 1;
     }
 
     msg_Dbg( p_demux, "cell %d i_sub_cell %d chapter %d vobu %d "