[vlc-commits] [Git][videolan/vlc][master] codec: dvbsub: fix read boundary

[Felix Paul Kühne (@fkuehne)]

Felix Paul Kühne pushed to branch master at VideoLAN / VLC


Commits:
a3192f48 by François Cartegnie at 2026-07-01T11:19:06+02:00
codec: dvbsub: fix read boundary

refs #29936

- - - - -


1 changed file:

- modules/codec/dvbsub.c


Changes:

=====================================
modules/codec/dvbsub.c
=====================================
@@ -1014,12 +1014,12 @@ static void decode_region_composition( decoder_t *p_dec, bs_t *s, uint16_t i_seg
     if( !p_region->p_object_defs )
         return;
 
-    while( i_processed_length < i_segment_length )
+    while( i_processed_length + 6 <= i_segment_length )
     {
         dvbsub_objectdef_t *p_obj;
 
         /* We parse object properties */
-        p_obj = &p_region->p_object_defs[p_region->i_object_defs++];
+        p_obj = &p_region->p_object_defs[p_region->i_object_defs];
         p_obj->i_id         = bs_read( s, 16 );
         p_obj->i_type       = bs_read( s, 2 );
         bs_skip( s, 2 ); /* Provider */
@@ -1033,10 +1033,13 @@ static void decode_region_composition( decoder_t *p_dec, bs_t *s, uint16_t i_seg
         if( ( p_obj->i_type == DVBSUB_OT_BASIC_CHAR ) ||
             ( p_obj->i_type == DVBSUB_OT_COMPOSITE_STRING ) )
         {
+            if( i_processed_length + 2 > i_segment_length )
+                break;
             p_obj->i_fg_pc =  bs_read( s, 8 );
             p_obj->i_bg_pc =  bs_read( s, 8 );
             i_processed_length += 2;
         }
+        p_region->i_object_defs++;
     }
 }
 



View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/a3192f48f31d914113d3d35455886e6f038202f2

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/a3192f48f31d914113d3d35455886e6f038202f2
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help