[vlc-commits] [Git][videolan/vlc][master] codec: cvdsub: check block payload size when rendering

[Steve Lhomme (@robUx4)]

Steve Lhomme pushed to branch master at VideoLAN / VLC


Commits:
6118f5f1 by François Cartegnie at 2026-08-17T09:53:12+00:00
codec: cvdsub: check block payload size when rendering

refs #29863

- - - - -


1 changed file:

- modules/codec/cvdsub.c


Changes:

=====================================
modules/codec/cvdsub.c
=====================================
@@ -67,7 +67,7 @@ static block_t *Reassemble ( decoder_t *, block_t * );
 static void ParseMetaInfo  ( decoder_t *, block_t * );
 static int  ParseHeader    ( decoder_t *, block_t * );
 static subpicture_t *DecodePacket( decoder_t *, block_t * );
-static void RenderImage( decoder_t *, block_t *, picture_t * );
+static int  RenderImage( decoder_t *, block_t *, picture_t * );
 
 #define SUBTITLE_BLOCK_EMPTY 0
 #define SUBTITLE_BLOCK_PARTIAL 1
@@ -556,7 +556,12 @@ static subpicture_t *DecodePacket( decoder_t *p_dec, block_t *p_data )
     p_region->i_x = p_region->i_x * 3 / 4; /* FIXME: use aspect ratio for x? */
     p_region->i_y = p_sys->i_y_start;
 
-    RenderImage( p_dec, p_data, p_region->p_picture );
+    if( RenderImage( p_dec, p_data, p_region->p_picture ) != VLC_SUCCESS )
+    {
+        msg_Err( p_dec, "cannot render SPU region" );
+        subpicture_Delete( p_spu );
+        return NULL;
+    }
 
     return p_spu;
 }
@@ -584,7 +589,7 @@ static subpicture_t *DecodePacket( decoder_t *p_dec, block_t *p_data )
  a 4-bit alpha (filling 8 bits), and 8-bit y, u, and v entry.
 
  *****************************************************************************/
-static void RenderImage( decoder_t *p_dec, block_t *p_data,
+static int RenderImage( decoder_t *p_dec, block_t *p_data,
                          picture_t *dst_pic )
 {
     decoder_sys_t *p_sys = p_dec->p_sys;
@@ -593,6 +598,9 @@ static void RenderImage( decoder_t *p_dec, block_t *p_data,
     size_t i_row, i_column; /* scanline row/column number */
     bs_t bs;
 
+    if( p_data->i_buffer <= p_sys->i_image_offset )
+        return VLC_EGENERIC;
+
     bs_init( &bs, p_data->p_buffer + p_sys->i_image_offset,
              p_data->i_buffer - p_sys->i_image_offset );
 
@@ -629,4 +637,5 @@ static void RenderImage( decoder_t *p_dec, block_t *p_data,
             bs_align( &bs );
         }
     }
+    return VLC_SUCCESS;
 }



View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/6118f5f1269885f50c355187f821e0360a185165

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/6118f5f1269885f50c355187f821e0360a185165
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help