Bug found? (was Re: Haunting bug in DVD subtitle handling)

[Stepan Roh]

This is the piece of code from include/input_ext-dec.h:

static __inline__ void GetChunk( bit_stream_t * p_bit_stream,
                                 byte_t * p_buffer, size_t i_buf_len )
{
    ptrdiff_t           i_available;

    if( p_bit_stream->fifo.i_available )
    {
        *((WORD_TYPE *)p_buffer) = WORD_AT( &p_bit_stream->fifo.buffer );
        p_buffer += p_bit_stream->fifo.i_available >> 3;
        i_buf_len -= p_bit_stream->fifo.i_available >> 3;
        p_bit_stream->fifo.buffer = 0;
        p_bit_stream->fifo.i_available = 0;
    }

i_buf_len is in case of crash = 2 and (p_bit_stream->fifo.i_available >>
3) results to 3, which causes i_buf_len to underrun. If I set i_buf_len to
0 in that case, vlc won't crash but it outputs a lot of errors related to
spudec and subtitles are gone (but movie continues). Selecting another
language and than choosing back the original one will reset internal
buffers (I guess) and subtitles are on again. I'll try to dig deeply into
the vlc, but it's late and I know almost nothing about vlc internals.
Maybe this will help someone.

Have a nice day.

Stepan Roh