[vlc-commits] [Git][videolan/vlc][master] 2 commits: test: add cea708 regression test
Steve Lhomme (@robUx4)
gitlab at videolan.org
Fri Jul 31 16:11:09 UTC 2026
Steve Lhomme pushed to branch master at VideoLAN / VLC
Commits:
90313610 by Thomas Guillem at 2026-07-31T14:37:45+00:00
test: add cea708 regression test
- - - - -
ca61f71a by Steve Lhomme at 2026-07-31T14:37:45+00:00
codec: cea708: check row boundaries before decrement
Otherwise the uint8_t values overflow.
Fixes #29750
- - - - -
4 changed files:
- modules/codec/cea708.c
- test/Makefile.am
- + test/modules/codec/cea708.c
- test/modules/meson.build
Changes:
=====================================
modules/codec/cea708.c
=====================================
@@ -747,8 +747,10 @@ static void CEA708_Window_Scroll( cea708_window_t *p_w )
for( int i=p_w->i_firstrow; i <= p_w->i_lastrow; i++ )
p_w->rows[i-1] = p_w->rows[i];
p_w->rows[p_w->i_lastrow] = NULL;
- p_w->i_firstrow--;
- p_w->i_lastrow--;
+ if( p_w->i_firstrow != 0 )
+ p_w->i_firstrow--;
+ if( p_w->i_lastrow != 0 )
+ p_w->i_lastrow--;
break;
}
}
=====================================
test/Makefile.am
=====================================
@@ -79,6 +79,7 @@ check_PROGRAMS = \
test_modules_packetizer_hevc \
test_modules_packetizer_mpegvideo \
test_modules_codec_hxxx_helper \
+ test_modules_codec_cea708 \
test_modules_codec_cea708_aspect_ratio \
test_modules_codec_cea708_integration \
test_modules_keystore \
@@ -376,6 +377,10 @@ test_modules_codec_hxxx_helper_SOURCES = modules/codec/hxxx_helper.c \
../modules/packetizer/hevc_nal.c
test_modules_codec_hxxx_helper_LDADD = $(LIBVLCCORE) $(LIBVLC)
+test_modules_codec_cea708_SOURCES = modules/codec/cea708.c \
+ ../modules/codec/cea708.c
+test_modules_codec_cea708_LDADD = $(LIBVLCCORE) $(LIBVLC)
+
test_modules_codec_cea708_aspect_ratio_SOURCES = modules/codec/cea708_aspect_ratio.c
test_modules_codec_cea708_aspect_ratio_LDADD = $(LIBVLCCORE) $(LIBVLC)
=====================================
test/modules/codec/cea708.c
=====================================
@@ -0,0 +1,80 @@
+/*****************************************************************************
+ * cea708.c: CEA-708 decoder unit tests
+ *****************************************************************************
+ * Copyright (C) 2026 VideoLabs, VideoLAN and VLC Authors
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
+ *****************************************************************************/
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <vlc_common.h>
+#include <vlc_codec.h>
+
+#include "../../../modules/codec/cea708.h"
+
+#include "../../libvlc/test.h"
+
+const char vlc_module_name[] = "cea708_test";
+
+/*
+ * Regression test for BT-direction scroll i_lastrow underflow.
+ *
+ * A window with row_count=1 and scroll_direction=BT triggers a uint8_t
+ * underflow of i_lastrow (0 -> 255) inside CEA708_Window_Scroll().
+ * Subsequent operations like CLW iterate rows[0..255] on a 15-element
+ * heap array, causing out-of-bounds reads and writes.
+ */
+static void test_bt_scroll_underflow(void)
+{
+ cea708_t *dec = CEA708_Decoder_New(NULL);
+ assert(dec);
+
+ uint8_t payload[128];
+ int pos = 0;
+
+ /* DF0 (Define Window 0): row_count=1, visible=0, default style #1 (BT) */
+ payload[pos++] = 0x98; /* C1: DF0 */
+ payload[pos++] = 0x18; /* row_lock | col_lock, visible=0 */
+ payload[pos++] = 0x00; /* anchor_v=0 */
+ payload[pos++] = 0x00; /* anchor_h=0 */
+ payload[pos++] = 0x00; /* anchor_point=0, row_count-1=0 (row_count=1) */
+ payload[pos++] = 0x2A; /* col_count=42 */
+ payload[pos++] = 0x00; /* window_style=0, pen_style=0 -> defaults to style #1 */
+
+ /* 42 printable chars fill the single row, triggering
+ * Forward -> CarriageReturn -> Scroll BT with row_count=1 */
+ for (int i = 0; i < 42; i++)
+ payload[pos++] = 0x41; /* 'A' */
+
+ /* CLW (Clear Windows): iterates rows[firstrow..lastrow].
+ * With the underflow, lastrow=255 -> OOB on 15-element array */
+ payload[pos++] = 0x88; /* C1: CLW */
+ payload[pos++] = 0x01; /* window bitmask: window 0 */
+
+ CEA708_Decoder_Push(dec, 0, payload, pos);
+
+ CEA708_Decoder_Release(dec);
+}
+
+int main(void)
+{
+ test_init();
+
+ test_bt_scroll_underflow();
+
+ return 0;
+}
=====================================
test/modules/meson.build
=====================================
@@ -142,6 +142,15 @@ vlc_tests += {
'module_depends' : vlc_plugins_targets.keys()
}
+vlc_tests += {
+ 'name' : 'test_modules_codec_cea708',
+ 'sources' : files('codec/cea708.c',
+ '../../modules/codec/cea708.c'),
+ 'suite' : ['modules', 'test_modules'],
+ 'link_with' : [libvlc, libvlccore],
+ 'module_depends' : vlc_plugins_targets.keys()
+}
+
vlc_tests += {
'name' : 'test_modules_video_output_opengl_filters',
'sources' : files(
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/abe8b43296f789de32ef74f43cf6995df214b037...ca61f71a5edb1a78d5107341d4a447d22419943c
--
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/abe8b43296f789de32ef74f43cf6995df214b037...ca61f71a5edb1a78d5107341d4a447d22419943c
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help
More information about the vlc-commits
mailing list