[vlc-commits] [Git][videolan/vlc][master] spudec: limit the amount of data read in p_pxctli

[Steve Lhomme (@robUx4)]

Steve Lhomme pushed to branch master at VideoLAN / VLC


Commits:
520506de by Steve Lhomme at 2026-08-21T13:44:32+00:00
spudec: limit the amount of data read in p_pxctli

i_pxclti is a counter of items in p_pxctli. But the buffer is limited is (remaining)
size to p_sys->i_spu_size - (i_index + 7) as we skip that amount of data in p_buffer.

Each pxctli item takes 6 bytes to read, so we limit the amount of pxctli items
based on the number 6 bytes elements the buffer holds.

Fixes #30046

Co-authored-by: Asif Nadaf <postasif at protonmail.com>

- - - - -


1 changed file:

- modules/codec/spudec/parse.c


Changes:

=====================================
modules/codec/spudec/parse.c
=====================================
@@ -545,11 +545,11 @@ static int ParseControlSeq( decoder_t *p_dec, vlc_tick_t i_pts,
 
             spu_properties.i_start = i_pts + date;
 
-            if( p_sys->i_spu_size >
-                i_index + 3 + 4 + (p_sys->buffer[i_index+5] >> 4) )
+            uint8_t pcxtli_count = p_sys->buffer[i_index+5] >> 4;
+            if( p_sys->i_spu_size > i_index + 3 + 4 + pcxtli_count )
             {
                 spu_data.p_pxctli = &p_sys->buffer[i_index+3 + 4];
-                spu_data.i_pxclti = p_sys->buffer[i_index+5] >> 4;
+                spu_data.i_pxclti = __MIN(pcxtli_count, (p_sys->i_spu_size - (i_index + 3 + 4)) / 6 );
             }
 
             i_index += 1 + GetWBE(&p_sys->buffer[i_index+1]);



View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/520506de3f80cd94876e6f4cfce3cf0e74e28e7d

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/520506de3f80cd94876e6f4cfce3cf0e74e28e7d
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help