[vlc-commits] [Git][videolan/vlc][3.0.x] demux/ogg: fix prepcr.i_size overflow on 128 packets

[Steve Lhomme (@robUx4)]

Steve Lhomme pushed to branch 3.0.x at VideoLAN / VLC


Commits:
f5ce82b5 by sheikhayaan at 2026-11-01T06:12:56+00:00
demux/ogg: fix prepcr.i_size overflow on 128 packets

prepcr.i_size is a uint8_t, but the demuxer can store up to 510
(2 * 255) in it. When the first audio page has exactly 128 packets,
__MAX(128 << 1, 255) evaluates to 256, which wraps to 0 in a uint8_t
and triggers an assertion later in Ogg_SendOrQueueBlocks.

Widen i_size and i_used to unsigned to prevent the wrap.

Fixes #30223

Signed-off-by: sheikhayaan <sheikhayaan408 at gmail.com>

- - - - -


2 changed files:

- modules/demux/ogg.c
- modules/demux/ogg.h


Changes:

=====================================
modules/demux/ogg.c
=====================================
@@ -471,6 +471,8 @@ static int Demux( demux_t * p_demux )
             if ( b_doprepcr && p_stream->prepcr.i_size < i_max_packets )
             {
                 /* always double alloc for performance */
+                if ( i_max_packets < 0 )
+                     i_max_packets = 0;
                 i_max_packets = __MAX( i_max_packets << 1, 255 );
                 /* alloc or realloc */
                 block_t **pp_realloc = realloc( p_stream->prepcr.pp_blocks,


=====================================
modules/demux/ogg.h
=====================================
@@ -119,8 +119,8 @@ typedef struct logical_stream_s
     struct
     {
         block_t **pp_blocks;
-        uint8_t i_size; /* max 255 */
-        uint8_t i_used;
+        int i_size; 
+        int i_used;
     } prepcr;
     /* All blocks that are queued because ES isn't created yet */
     block_t *p_preparse_block;



View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/f5ce82b534097145d087de3ff4e5cc4b807df33f

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/f5ce82b534097145d087de3ff4e5cc4b807df33f
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help