[vlc-commits] [Git][videolan/vlc][master] 2 commits: test: add cea708 regression test

Steve Lhomme (@robUx4) gitlab at videolan.org
Fri Jul 31 16:11:09 UTC 2026



Steve Lhomme pushed to branch master at VideoLAN / VLC


Commits:
90313610 by Thomas Guillem at 2026-07-31T14:37:45+00:00
test: add cea708 regression test

- - - - -
ca61f71a by Steve Lhomme at 2026-07-31T14:37:45+00:00
codec: cea708: check row boundaries before decrement

Otherwise the uint8_t values overflow.

Fixes #29750

- - - - -


4 changed files:

- modules/codec/cea708.c
- test/Makefile.am
- + test/modules/codec/cea708.c
- test/modules/meson.build


Changes:

=====================================
modules/codec/cea708.c
=====================================
@@ -747,8 +747,10 @@ static void CEA708_Window_Scroll( cea708_window_t *p_w )
             for( int i=p_w->i_firstrow; i <= p_w->i_lastrow; i++ )
                 p_w->rows[i-1] = p_w->rows[i];
             p_w->rows[p_w->i_lastrow] = NULL;
-            p_w->i_firstrow--;
-            p_w->i_lastrow--;
+            if( p_w->i_firstrow != 0 )
+                p_w->i_firstrow--;
+            if( p_w->i_lastrow != 0 )
+                p_w->i_lastrow--;
             break;
     }
 }


=====================================
test/Makefile.am
=====================================
@@ -79,6 +79,7 @@ check_PROGRAMS = \
 	test_modules_packetizer_hevc \
 	test_modules_packetizer_mpegvideo \
 	test_modules_codec_hxxx_helper \
+	test_modules_codec_cea708 \
 	test_modules_codec_cea708_aspect_ratio \
 	test_modules_codec_cea708_integration \
 	test_modules_keystore \
@@ -376,6 +377,10 @@ test_modules_codec_hxxx_helper_SOURCES = modules/codec/hxxx_helper.c \
                                       ../modules/packetizer/hevc_nal.c
 test_modules_codec_hxxx_helper_LDADD = $(LIBVLCCORE) $(LIBVLC)
 
+test_modules_codec_cea708_SOURCES = modules/codec/cea708.c \
+				../modules/codec/cea708.c
+test_modules_codec_cea708_LDADD = $(LIBVLCCORE) $(LIBVLC)
+
 test_modules_codec_cea708_aspect_ratio_SOURCES = modules/codec/cea708_aspect_ratio.c
 test_modules_codec_cea708_aspect_ratio_LDADD = $(LIBVLCCORE) $(LIBVLC)
 


=====================================
test/modules/codec/cea708.c
=====================================
@@ -0,0 +1,80 @@
+/*****************************************************************************
+ * cea708.c: CEA-708 decoder unit tests
+ *****************************************************************************
+ * Copyright (C) 2026 VideoLabs, VideoLAN and VLC Authors
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
+ *****************************************************************************/
+#ifdef HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <vlc_common.h>
+#include <vlc_codec.h>
+
+#include "../../../modules/codec/cea708.h"
+
+#include "../../libvlc/test.h"
+
+const char vlc_module_name[] = "cea708_test";
+
+/*
+ * Regression test for BT-direction scroll i_lastrow underflow.
+ *
+ * A window with row_count=1 and scroll_direction=BT triggers a uint8_t
+ * underflow of i_lastrow (0 -> 255) inside CEA708_Window_Scroll().
+ * Subsequent operations like CLW iterate rows[0..255] on a 15-element
+ * heap array, causing out-of-bounds reads and writes.
+ */
+static void test_bt_scroll_underflow(void)
+{
+    cea708_t *dec = CEA708_Decoder_New(NULL);
+    assert(dec);
+
+    uint8_t payload[128];
+    int pos = 0;
+
+    /* DF0 (Define Window 0): row_count=1, visible=0, default style #1 (BT) */
+    payload[pos++] = 0x98;  /* C1: DF0 */
+    payload[pos++] = 0x18;  /* row_lock | col_lock, visible=0 */
+    payload[pos++] = 0x00;  /* anchor_v=0 */
+    payload[pos++] = 0x00;  /* anchor_h=0 */
+    payload[pos++] = 0x00;  /* anchor_point=0, row_count-1=0 (row_count=1) */
+    payload[pos++] = 0x2A;  /* col_count=42 */
+    payload[pos++] = 0x00;  /* window_style=0, pen_style=0 -> defaults to style #1 */
+
+    /* 42 printable chars fill the single row, triggering
+     * Forward -> CarriageReturn -> Scroll BT with row_count=1 */
+    for (int i = 0; i < 42; i++)
+        payload[pos++] = 0x41;  /* 'A' */
+
+    /* CLW (Clear Windows): iterates rows[firstrow..lastrow].
+     * With the underflow, lastrow=255 -> OOB on 15-element array */
+    payload[pos++] = 0x88;  /* C1: CLW */
+    payload[pos++] = 0x01;  /* window bitmask: window 0 */
+
+    CEA708_Decoder_Push(dec, 0, payload, pos);
+
+    CEA708_Decoder_Release(dec);
+}
+
+int main(void)
+{
+    test_init();
+
+    test_bt_scroll_underflow();
+
+    return 0;
+}


=====================================
test/modules/meson.build
=====================================
@@ -142,6 +142,15 @@ vlc_tests += {
     'module_depends' : vlc_plugins_targets.keys()
 }
 
+vlc_tests += {
+    'name' : 'test_modules_codec_cea708',
+    'sources' : files('codec/cea708.c',
+                      '../../modules/codec/cea708.c'),
+    'suite' : ['modules', 'test_modules'],
+    'link_with' : [libvlc, libvlccore],
+    'module_depends' : vlc_plugins_targets.keys()
+}
+
 vlc_tests += {
     'name' : 'test_modules_video_output_opengl_filters',
     'sources' : files(



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/abe8b43296f789de32ef74f43cf6995df214b037...ca61f71a5edb1a78d5107341d4a447d22419943c

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/abe8b43296f789de32ef74f43cf6995df214b037...ca61f71a5edb1a78d5107341d4a447d22419943c
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help




More information about the vlc-commits mailing list