[vlc-commits] [Git][videolan/vlc][master] 3 commits: demux: avi: fix embedded subs segfault

[Steve Lhomme (@robUx4)]

Steve Lhomme pushed to branch master at VideoLAN / VLC


Commits:
bdfd5a6e by François Cartegnie at 2026-10-22T10:06:24+00:00
demux: avi: fix embedded subs segfault

refs #29785
Reported-By: Alexandre de Oliveira

- - - - -
5c9ae03a by François Cartegnie at 2026-10-22T10:06:24+00:00
demux: avi: early fail checking subtitle size

- - - - -
6afde0fa by François Cartegnie at 2026-10-22T10:06:24+00:00
demux: avi: fix comparison operator

- - - - -


1 changed file:

- modules/demux/avi/avi.c


Changes:

=====================================
modules/demux/avi/avi.c
=====================================
@@ -3125,7 +3125,7 @@ static void AVI_ExtractSubtitle( demux_t *p_demux,
                 break;
             }
         }
-        if( i_size <= 0 )
+        if( i_size == 0 )
             goto exit;
     }
 
@@ -3144,17 +3144,17 @@ static void AVI_ExtractSubtitle( demux_t *p_demux,
 
     /* Parse packet header */
     const uint8_t *p = p_block->p_buffer;
-    if( i_size < 8 || p[2] != 't' || p[3] != 'x' )
+    i_size = p_block->i_buffer;
+    if( i_size < (8+11) || p[2] != 't' || p[3] != 'x' )
         goto exit;
     p += 8;
     i_size -= 8;
 
     /* Parse subtitle chunk header */
-    if( i_size < 11 || memcmp( p, "GAB2", 4 ) ||
-        p[4] != 0x00 || GetWLE( &p[5] ) != 0x2 )
+    if( memcmp( p, "GAB2", 4 ) || p[4] != 0x00 || GetWLE( &p[5] ) != 0x2 )
         goto exit;
     const unsigned i_name = GetDWLE( &p[7] );
-    if( INT64_C(11) + i_name >= i_size )
+    if( i_size - 11 < i_name )
         goto exit;
     if( i_name > 0 )
         psz_description = FromCharset( "UTF-16LE", &p[11], i_name );



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/ad07a25f62e4ca748923956727358c1d45b4e644...6afde0fad6407e753b2dfe769994f8ce748719f2

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/ad07a25f62e4ca748923956727358c1d45b4e644...6afde0fad6407e753b2dfe769994f8ce748719f2
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help