[vlc-commits] [Git][videolan/vlc][3.0.x] 3 commits: spudec: don't hardcode the size of the internal buffer

[Steve Lhomme (@robUx4)]

Steve Lhomme pushed to branch 3.0.x at VideoLAN / VLC


Commits:
b088a0e7 by Steve Lhomme at 2026-07-26T14:59:12+00:00
spudec: don't hardcode the size of the internal buffer

(cherry picked from commit 439c9ef0c90ecb7b5ac5edf75174560c43e59d14)

- - - - -
36d98bfb by Steve Lhomme at 2026-07-26T14:59:12+00:00
spudec: allocate the SPU packet buffer dynamically

(cherry picked from commit 3ad009527922f4ebd21c6ac38ee97cb1d5a191c1) (edited)
edited:
- VLC 3 doesn't have vlc_frame_ChainProperties()

- - - - -
44cc9963 by Steve Lhomme at 2026-07-26T14:59:12+00:00
spudec: fix buffer overflow reading

We use a bogus command value to fallback in the "default:" case and exit the loop.

Fixes #29728

(cherry picked from commit dfab94b3aefff970598329ab8e3f7a6a08835dd1)

- - - - -


3 changed files:

- modules/codec/spudec/parse.c
- modules/codec/spudec/spudec.c
- modules/codec/spudec/spudec.h


Changes:

=====================================
modules/codec/spudec/parse.c
=====================================
@@ -411,7 +411,7 @@ static int ParseControlSeq( decoder_t *p_dec, vlc_tick_t i_pts,
             i_index += 4;
         }
 
-        i_command = p_sys->buffer[i_index];
+        i_command = i_index < p_sys->buffer_size ? p_sys->buffer[i_index] : (SPU_CMD_END - 1);
 
         switch( i_command )
         {


=====================================
modules/codec/spudec/spudec.c
=====================================
@@ -91,6 +91,8 @@ static int DecoderOpen( vlc_object_t *p_this )
     p_sys->b_packetizer = false;
     p_sys->b_disabletrans = var_InheritBool( p_dec, "dvdsub-transparency" );
     p_sys->i_spu_size = 0;
+    p_sys->buffer     = NULL;
+    p_sys->buffer_size = 0;
     p_sys->i_spu      = 0;
     p_sys->p_block    = NULL;
 
@@ -137,6 +139,7 @@ static void Close( vlc_object_t *p_this )
         block_ChainRelease( p_sys->p_block );
     }
 
+    free( p_sys->buffer );
     free( p_sys );
 }
 
@@ -157,8 +160,19 @@ static int Decode( decoder_t *p_dec, block_t *p_block )
         return VLCDEC_SUCCESS;
     }
 
-    /* FIXME: what the, we shouldn’t need to allocate 64k of buffer --sam. */
-    p_sys->i_spu = block_ChainExtract( p_spu_block, p_sys->buffer, 65536 );
+    size_t block_size;
+    block_ChainProperties( p_spu_block, NULL, &block_size, NULL );
+    if ( p_sys->buffer_size < block_size )
+    {
+        void *bigger = realloc( p_sys->buffer, block_size );
+        if ( unlikely(bigger == NULL) )
+        {
+            return VLCDEC_ECRITICAL;
+        }
+        p_sys->buffer = bigger;
+        p_sys->buffer_size = block_size;
+    }
+    p_sys->i_spu = block_ChainExtract( p_spu_block, p_sys->buffer, block_size );
     p_sys->i_pts = p_spu_block->i_pts;
     block_ChainRelease( p_spu_block );
 


=====================================
modules/codec/spudec/spudec.h
=====================================
@@ -35,8 +35,8 @@ struct decoder_sys_t
 
     block_t *p_block;
 
-    /* We will never overflow */
-    uint8_t buffer[65536];
+    uint8_t *buffer;
+    size_t  buffer_size;
 };
 
 /*****************************************************************************



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/ba9ca717dd2031af76563485797046e2464da466...44cc9963f78c7fd032f68d705dacc4feca919a60

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/ba9ca717dd2031af76563485797046e2464da466...44cc9963f78c7fd032f68d705dacc4feca919a60
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help