[vlc-commits] [Git][videolan/vlc][3.0.x] cvdsub: avoid reading past the end of metadata

[Thomas Guillem (@tguillem)]

Thomas Guillem pushed to branch 3.0.x at VideoLAN / VLC


Commits:
540d35fe by Steve Lhomme at 2025-09-12T16:47:37+02:00
cvdsub: avoid reading past the end of metadata

We always read p[0] to p[3]. If p[3] is further than the end
of our buffer we should not use these data.

Fixes https://code.videolan.org/videolan/vlc/-/issues/29286

- - - - -


1 changed file:

- modules/codec/cvdsub.c


Changes:

=====================================
modules/codec/cvdsub.c
=====================================
@@ -348,7 +348,7 @@ static void ParseMetaInfo( decoder_t *p_dec, block_t *p_spu  )
     uint8_t       *p     = p_spu->p_buffer + p_sys->metadata_offset;
     uint8_t       *p_end = p + p_sys->metadata_length;
 
-    for( ; p < p_end; p += 4 )
+    for( ; &p[3] < p_end; p += 4 )
     {
         switch( p[0] )
         {



View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/540d35fef5baefe2b4c4b9e5742761a0d636b63e

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/540d35fef5baefe2b4c4b9e5742761a0d636b63e
You're receiving this email because of your account on code.videolan.org.


VideoLAN code repository instance